PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Web Cache Entanglement: Novel Pathways to Poisoning

portswigger.net | research | #black-hat | #web-security | #cdn | #web-cache-poisoning | #cache-entanglement | #research-paper
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Cache entanglement: probing cache internals for inconsistencies and chaining them into poisoning attacks that hit every page of a newspaper, a DoD site's admin interface, and Firefox's update channel.
Published
Collected

Related coverage

research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
blog · vercel.com
How we run Vercel's CDN in front of Discourse
Vercel Community uses Vercel as a CDN in front of monolithic servers like Discourse or Wordpress. Use microfrontends to incrementally migrate to a new app.
research · portswigger.net
Can AI do novel security research? Meet the HTTP Terminator
James Kettle's Black Hat USA 2026 research: the HTTP Terminator, an autonomous system that invented novel HTTP desync triggers and exploited banks, security products and government infrastructure.
research · portswigger.net
Gotta cache 'em all: bending the rules of web cache exploitation
Doyhenard's research exploits URL parser discrepancies and RFC ambiguities between CDNs and origins — delimiters, normalization, static extensions — achieving arbitrary cache poisoning and deception.
research · portswigger.net
A hacking hat-trick: previewing three PortSwigger Research publications coming to DEF CON & Black Hat USA
PortSwigger previews three Black Hat USA and DEF CON 32 research releases: timing attacks, email parser exploitation and web cache attacks, each with accompanying tools, labs and pre-reading.
research · portswigger.net
HTTP Desync Attacks: Request Smuggling Reborn
James Kettle revives HTTP Request Smuggling as HTTP Desync Attacks, splicing requests into victims' connections to poison caches and compromise PayPal's login page, earning over $70k in bounties.
Back