Lab: Web cache poisoning via ambiguous requests
Summary: PortSwigger's lab demonstrates web cache poisoning caused by discrepancies in how the cache and the back-end application handle ambiguous requests. The exercise requires adding a second Host header containing the exploit server's domain name in Burp Repeater, poisoning the cache so the home page executes alert(document.cookie) in the browser of a user who regularly visits the site.
Key Takeaway: The attack hinges on a single ambiguous request - a second Host header - that the cache and back-end interpret differently, and the payload then runs in the browser of a routine visitor to the home page.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026