Collected research
Internet's Invisible Enemy: Detecting and Measuring Web Cache Poisoning in the Wild
HCache mutates the request line, headers and body to find fields the cache omits from its key but the origin still reacts to, then sends normal, attack and validation requests behind a cache buster to confirm the error response is cached and served. Across Tranco top 1,000 domains and subdomains, 1,354 sites were poisonable through 14 vector families, 7 of them new: CDN internal-route headers, Authorization, If-*, X-Forwarded-Proto and Range. Caches are shared between HTTP/1.1 and HTTP/2.
Record
- Researcher
- Yuejia Liang, Jianjun Chen, Run Guo, Kaiwen Shen, Hui Jiang, Man Hou, Yue Yu and Haixin Duan
- Published by
- doi.org
- Topic
- HTTP
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Yuejia Liang, Jianjun Chen, Run Guo, Kaiwen Shen, Hui Jiang, Man Hou, Yue Yu and Haixin Duan, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .