Portswigger - Web Cache Poisoning on Offensive security blog

Portswigger - Cache Poisoning with an Unknown Header

Sun, 22 Feb 2026 00:00:00 +0000

Lab Description

This lab is vulnerable to web cache poisoning. A victim user will view any comments that you post. To solve this lab, you need to poison the cache with a response that executes alert(document.cookie) in the visitor’s browser. However, you also need to make sure that the response is served to the specific subset of users to which the intended victim belongs.

Solve

Looking for unkeyed input with param miner, we find the X-Host header:

Portswigger - Combining web cache poisoning vulnerabilities

Sun, 22 Feb 2026 00:00:00 +0000

Lab Description

This lab is susceptible to web cache poisoning, but only if you construct a complex exploit chain.

A user visits the home page roughly once a minute and their language is set to English. To solve this lab, poison the cache with a response that executes alert(document.cookie) in the visitor’s browser.

Solve

Portswigger - Cache Poisoning with an Unkeyed Cookie

Sat, 21 Feb 2026 00:00:00 +0000

Lab Description

This lab is vulnerable to web cache poisoning because cookies aren’t included in the cache key. An unsuspecting user regularly visits the site’s home page. To solve this lab, poison the cache with a response that executes alert(1) in the visitor’s browser.

Access here

Solve

Intercepting the request to the homepage, we find a cookie fehost=prod-cache-01 which is reflected in the response inside a javascript object:

fehost cookie reflected

Portswigger - Cache Poisoning with multiple headers

Sat, 21 Feb 2026 00:00:00 +0000

Lab Description

This lab contains a web cache poisoning vulnerability that is only exploitable when you use multiple headers to craft a malicious request. A user visits the home page roughly once a minute. To solve this lab, poison the cache with a response that executes alert(document.cookie) in the visitor’s browser.

[!TIP]- Hint This lab supports both the X-Forwarded-Host and X-Forwarded-Scheme headers.

Access here

Solve

Using param miner to guess headers, we find that X-Forwarded-Scheme is an unkeyed headers:

Portswigger - Cache Poisoning with an Unkeyed Header

Fri, 20 Feb 2026 00:00:00 +0000

Lab Description

This lab is vulnerable to web cache poisoning because it handles input from an unkeyed header in an unsafe way. An unsuspecting user regularly visits the site’s home page. To solve this lab, poison the cache with a response that executes alert(document.cookie) in the visitor’s browser.

[!TIP]- Hint This lab supports the X-Forwarded-Host header.

Access here

Finding Unkeyed Inputs

The first step is to find unkeyed headers. For this we can use the param miner extension in Burp Suite. After running the extension to find unkeyed headers on the home page, we see that X-Forwarded-Host is an unkeyed header:

Portswigger - Cache Poisoning to DOM XSS

Sat, 06 Dec 2025 00:00:00 +0000

Lab Description

This lab contains a DOM-based vulnerability that can be exploited as part of a web cache poisoning attack. A user visits the home page roughly once a minute. Note that the cache used by this lab has stricter criteria for deciding which responses are cacheable, so you will need to study the cache behavior closely.

To solve the lab, poison the cache with a response that executes alert(document.cookie) in the visitor’s browser.