{"id":5398,"date":"2020-11-27T15:04:39","date_gmt":"2020-11-27T09:34:39","guid":{"rendered":"https:\/\/www.varutra.com\/?p=5398"},"modified":"2022-12-02T14:54:40","modified_gmt":"2022-12-02T09:24:40","slug":"web-cache-poisoning-through-host-header-injection","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/web-cache-poisoning-through-host-header-injection\/","title":{"rendered":"Web Cache Poisoning \u2013 Through Host Header Injection"},"content":{"rendered":"


\nWeb cache poisoning is an advanced hacking technique through which an attacker can exploit the pattern or behavior of a web cache and server. But before comprehending what is web cache poisoning, we should understand web cache and its vulnerabilities. This will help us in taking measures to prevent web cache poisoning.<\/p>\n

 <\/p>\n

The first question here is what is web cache?<\/strong><\/h3>\n

A cache is a term that is generally used for the information between server and user. When a web server saves data from certain requests temporarily or for some limited amount of time, those data or information is known as a cache. In case, the server receives a similar request then the user will receive the cached information which was saved earlier without having to interact with the server again.<\/p>\n

\"HTTP<\/p>\n

Figure: HTTP web cache.<\/p>\n

 <\/p>\n

Working of Web Cache<\/strong><\/h3>\n

Servers receive a lot of requests and can get overloaded if it will have to send a new request every single time for each separate HTTP request. Due to this factor, a server can face delay problems and an unsatisfactory user experience. Therefore, the primary use of cache is to reduce the overloading of the webserver.<\/p>\n

When an HTTP request is received by the cache, it will check for a past similar cached response. If there is a response already present then it does not forward the requests to the back-end server for handling. This procedure is carried by Cache Keys. It comprises a pre-defined set of components that consists of the host header and request line from the request. The remaining components of the request that are not present in the key are known as unkeyed components. In case, there are two requests from cached keys, those two requests will be considered equivalent by the server. For such requests, the server provides a saved cached copy of a response to the subsequent requests. There is an expiration time for every saved cache.<\/p>\n

 <\/p>\n

Web Cache Poisoning<\/strong>:<\/h3>\n

Web cache poisoning is an advance attacking technique through which an attacker tries to exploit the target\u2019s web cache and server to distribute malicious HTTP responses.<\/p>\n

The exploitation attack is carried out in two phases:<\/p>\n

    \n
  1. In the first step, the attacker needs to conjure a malicious response from the server. This response will carry some kind of harmful payload.<\/li>\n
  2. After successfully receiving a malicious response from the server, the attacker will try to get the cache response. This response will be finally be delivered to users.<\/li>\n<\/ol>\n

    Here are some points that are to be considered when we need to perform a web cache poisoning attack.<\/p>\n

    Firstly, we need to recognize the unkeyed inputs present in a request. It is because they are often neglected by the server. By using them, we can easily manipulate the server by including payloads in the request inputs when cached data is getting delivered. To identify unkeyed inputs, we need to include different inputs in the request and then observe them. It is done to see whether they cause any effect on response or not. After analyzing those keyed inputs, we can conjure a damaging response from the server with the help of these inputs.<\/p>\n

    After we are successful in receiving a payload that contains a damaging response, we can start working on getting this response cached by the user. Once harmful response gets cached, we can finally deliver the payloads to targeted users.<\/p>\n

     <\/p>\n

    Exploiting web cache poisoning vulnerabilities<\/strong>:<\/h3>\n

    With web cache poisoning, we can carry out multiple payload attacks. Here is the list of vulnerabilities that can be exploited by using web cache poisoning:<\/p>\n