Web Cache Deception · passage 3 of 7

Caching Sensitive Data

Text · Web Cache Deception/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

**Example 1** - Web Cache Deception on PayPal Home Page 1. Normal browsing, visit home : `https://www.example.com/myaccount/home/` 2. Open the malicious link : `https://www.example.com/myaccount/home/malicious.css` 3. The page is displayed as /home and the cache is saving the page 4. Open a private tab with the previous URL : `https://www.example.com/myaccount/home/malicious.css` 5. The content of the cache is displayed Video of the attack by Omer Gil - Web Cache Deception Attack in PayPal Home Page [![DEMO](https://i.vimeocdn.com/video/674856618-f9bac811a4c7bcf635c4eff51f68a50e3d5532ca5cade3db784c6d178b94d09a-d)](https://vimeo.com/249130093) **Example 2** - Web Cache Deception on OpenAI 1. Attacker crafts a dedicated .css path of the `/api/auth/session` endpoint. 2. Attacker distributes the link 3. Victims visit the legitimate link. 4. Response is cached. 5. Attacker harvests JWT Credentials.

Every one of the 7 is a mark on the map. Named now: 1 to 7, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.