---
id: 6571
title: "Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accounts"
source_domain: samcurry.net
source_url: "https://samcurry.net/abusing-http-path-normalization-and-cache-poisoning-to-steal-rocket-league-accounts"
published_at: "2020-04-19T00:00:00Z"
tags: ["bug-bounty", "account-takeover", "web-security", "cache-poisoning", "rocket-league", "path-normalization"]
phying_url: "https://phying.com/item/6571"
lang: en
---

# Abusing HTTP Path Normalization and Cache Poisoning to steal Rocket League accounts

## Summary

Chasing Rocket League's white-hat reward, Sam Curry chained HTTP path normalization quirks and cache poisoning into account theft—a walkthrough of finding bugs in a seemingly boring web target.

## Intelligence Metadata

- **Sources:** samcurry.net
- **Published:** 2020-04-19T00:00:00Z
- **Original:** https://samcurry.net/abusing-http-path-normalization-and-cache-poisoning-to-steal-rocket-league-accounts
- **Phying News:** https://phying.com/item/6571