Exploiting path mapping for web cache deception

PortSwigger

Lab Description

This lab exploits a path mapping discrepancy between the cache and the origin server to access a user’s sensitive API key.

Objective: Find the API key for the user carlos.

Credentials: wiener:peter

---

---

Step 1: Identify the Target Endpoint

1. Log in as wiener:peter
2. Open GET /my-account in Burp Proxy
3. Notice the response contains your API key

---

Step 2: Identify the Path Mapping Discrepancy

1. Send GET /my-account to Repeater

2. Add an arbitrary segment: /my-account/abc

   • Still returns your account page → origin abstracts the path to /my-account
   • 

3. Add a static extension: /my-account/abc.js

   • Response contains X-Cache: miss and Cache-Control: max-age=30
   • 

4. Resend within 30 seconds

   • X-Cache changes to hit → Cache treats this as a static .js file
   • 

---

Step 3: Craft the Exploit

1. Go to the Exploit server
2. In the Body section, paste:

<script>
    document.location = "https://YOUR-LAB-ID.web-security-academy.net/my-account/wcd.js"
</script>

Why wcd.js:

• The arbitrary path segment should be unique (prevents receiving your own cached response)
• .js extension triggers the cache rule

---

Step 4: Deliver the Exploit

1. Click Deliver exploit to victim
2. The victim visits the exploit → navigates to /my-account/wcd.js
3. Origin server returns Carlos’s account page (with API key)
4. Cache stores the response for 30 seconds

---

Step 5: Retrieve the Cached Response

1. In your browser, visit:

https://YOUR-LAB-ID.web-security-academy.net/my-account/wcd.js

2. Copy Carlos’s API key from the response

---

Step 6: Submit the Solution

1. Go back to the lab page
2. Click Submit solution
3. Paste Carlos’s API key
4. Click Submit

---

Step 7: Lab Solved

---

---