PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Bypassing Web Cache Poisoning Countermeasures

portswigger.net | research | #web-security | #cloudflare | #portswigger | #waf-bypass | #akamai | #web-cache-poisoning | #fastly
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

James Kettle examines and bypasses vendor countermeasures to web cache poisoning from Cloudflare, Akamai and Fastly, flagging pitfalls like cacheable block pages enabling DoS.
Published
Collected

Related coverage

research · portswigger.net
When security features collide
James Kettle argues stacked security features can make systems easier to exploit, demonstrating a Cloudflare email obfuscation quirk that bypasses its WAF and all browser XSS filters.
research · portswigger.net
What's in a tag name? JavaScript, apparently
This research provides technical context that security teams can use for monitoring and validation.
research · portswigger.net
HTTP/1.1 must die: the desync endgame
HTTP/1.1 desync attacks can mass-compromise credentials via flaws in Akamai, Cloudflare and Netlify. A parser-discrepancy toolkit earned $200,000 in two weeks — Kettle argues HTTP/1.1 must die.
research · portswigger.net
Practical Web Cache Poisoning
James Kettle's whitepaper shows how to turn web caches into exploit delivery systems, hijacking JavaScript and poisoning responses across popular sites, plus defenses and open source tooling.
blog · yeswehack.com
Cache key injection: Smuggling poison through the door
How ambiguous NGINX cache keys can enable access-control bypasses, cache deception, CPDoS, stored XSS and origin cache poisoning.
blog · yeswehack.com
Web application firewall bypass
Bypassing web application firewalls after a flaw is found: abusing regex and blacklist weaknesses, normalisation quirks and frontend/backend filter collisions to slip payloads past WAFs.
Back