# Web cache poisoning via ambiguous requests

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FsLjMbX760BU3LGjyfdnG%2Fimage.png?alt=media&#x26;token=53625f4f-7ab4-4c4b-a627-f69bda39bf56" alt=""><figcaption></figcaption></figure></div>

## <mark style="color:red;">Exploitation</mark>

We fire up Burp Suite, set up our proxy, then explore the site for a bit in order to collect some info. The request to the main page looks like this:

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FJNO9QS8HlDdxW5icYqs9%2Fimage.png?alt=media&#x26;token=08aa4995-b8ca-413b-b519-ff63f7cfe8d5" alt=""><figcaption></figcaption></figure></div>

We notice in the response that it’s loading a JavaScript resource from `https://0a4f008b04b8bab18151b12b0006000a.h1-web-security-academy.net/resoures/js/tracking.js`&#x20;

Let’s try to edit the `Host` header in our request. We’ll see if the response reflects our change :&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Fbgohnq4orqbFTgOvqrTW%2Fimage.png?alt=media&#x26;token=4c5fb62c-bfc4-4e17-8018-e2f3acd56685" alt=""><figcaption></figcaption></figure></div>

Unfortunately, this doesn’t work out as expected. We get back a `504` HTTP error. Now let’s try creating an ambiguous request by duplicating the `Host` header in our request. Here’s what it looks like:&#x20;

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2Ftg4BQYT5JAD1NfIvvH3M%2Fimage.png?alt=media&#x26;token=c957bf8d-bbc2-43a2-8e51-ffb40e037599" alt=""><figcaption></figcaption></figure></div>

Now that we’re able to trick the target into loading a resource from an arbitrary server, let’s craft a quick HTTP endpoint on a server we control.

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FXTo7xgAVdkGx8l1pn5VB%2Fimage.png?alt=media&#x26;token=9ba45272-31f2-4398-9622-bfb7ae8d260c" alt=""><figcaption></figcaption></figure></div>

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FdkowQfAEtI1d2gyMJyse%2Fimage.png?alt=media&#x26;token=9f565abc-4076-422b-9f05-945af6b0eeea" alt=""><figcaption></figcaption></figure></div>

Now, we can send request multiple times, and test it works or not:

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FSWOxQXrVAlRLtCN5TwKj%2Fimage.png?alt=media&#x26;token=8f772235-9ae3-485b-903a-6baa75755a54" alt=""><figcaption></figcaption></figure></div>

and we solved the challenge

<div align="left"><figure><img src="https://1410593648-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FYI2noEqPw69jd0hR7Prp%2Fuploads%2FCe01Q5GoqZznZEHvKX7O%2Fimage.png?alt=media&#x26;token=86c2ab3e-787e-4892-883e-63429019f995" alt=""><figcaption></figcaption></figure></div>

hope you found this walkthrough easy to understand and follow

Greeting From [<mark style="color:red;">**Sayonara**</mark>](https://github.com/ismail-arame)
