EncryptCodec
Simulations/Web Cache Poisoning

Web Cache Poisoning

Advanced

The app reflects the X-Forwarded-Host header into a <script src>, but the CDN caches responses by URL alone. Send one malicious request and your script gets cached and served to every visitor.

Progress:
1
Poison the Cache
2
Stop the Poisoning
😈 Attacker request
GET /home HTTP/1.1
Host: bank.example
X-Forwarded-Host:
🛡 CDN / app defense
Send a request to see the cache and victim response…

Challenges

1
Poison the Cache
With defense OFF, send a request with X-Forwarded-Host = evil.tld. The poisoned response gets cached and served to the next victim.
▲ hints
#1The app reflects X-Forwarded-Host into the page's <script src>, but the CDN keys the cache only on the URL path.
2
Stop the Poisoning
Pick a defense (don't reflect the host, OR add the header to the cache key) and send the attack again — the victim must get a clean page.
▼ hints
How to fix web cache poisoning
Stop reflecting untrusted input, key the cache correctly
▼

Frequently Asked Questions