Lab: Exploiting path delimiters for web cache deception
Summary: PortSwigger's lab walks through a web cache deception attack in which the tester uses Burp Intruder to find that the origin server treats ';' and '?' as path delimiters, then appends ';abc.js' to /my-account so the cache stores the victim's account page under a static-extension rule, confirmed by the X-Cache header flipping from miss to hit. The crafted URL is delivered to the user carlos, whose cached account response exposes his API key.
Key Takeaway: The whole exploit hinges on a mismatch between how the origin server and the cache parse the same URL - a gap that lets one user's authenticated page get stored and served to anyone who requests the same path.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026