Cache Me If You Can: Messing with Web Caching

on YouTube ↗44m

" summary

Covers three concrete attack classes with real results: web cache deception (2017-style URL trick that caches sensitive HTML/CSRF tokens, Cloudflare seen ignoring cache headers), ESI injection (edge side include payloads that leak HTTPOnly session cookies, enable SSRF and even RCE via XSLT in some vendors; proof-of-concept backdoored jQuery that exfiltrates PHPSESSID works against Apache Traffic Server), and web cache poisoning (header bruteforce yields SEO takeover via rel=canonical and long-lived DoS via X-Forwarded-Proto). Tools used: Trustwave scanner, Burp active scans, header brute forcing extensions; mitigations and easy fixes are shown.

AI-written summary · about

" chapters (5)

1. 0:00Start
2. 8:21Web Cache Deception Impact
3. 26:34Edge Side Includes (ESI) Real World Example
4. 36:27Example #1 - SEO takeover
5. 40:53Example #2 - Denial of Service

" related talks

• 42mHack Me If You CanKonstantin Haase · Ancient City Ruby 2014
• 33mHacking The Front-EndAlex Sexton · Full Stack Fest 2015
• 42mModern web application bugsErlend Oftedal · NDC Sydney 2018
• 45mHTTP Desync Attacks: Smashing Into The Cell Next DoorJames Kettle · OWASP Global AppSec Amsterdam 2019
• 43mAttacking Modern Web TechnologiesFrans Rosén · OWASP AppSec Europe 2018
• 50mHTTP Desync Attacks: Smashing into the Cell Next DoorJames Kettle · Black Hat USA 2019
• 23mJavaScript attack surfaceDavit Karapetyan · JavaScript Summit Armenia 2023
• 58mModern web application bugsErlend Oftedal · NDC Minnesota 2019