> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/web-applications/web-cache-deception.md).

# Web Cache Deception

> In **web cache deception**, the attacker causes the application to store some sensitive content belonging to another user in the cache, and the attacker then retrieves this content from the cache.

### Exploitation

Extensions such as `.css`, `.js`, `.png`, etc, are usually configured to be saved in the cache. Therefore, if you were to access a non-existent URL such as `www.example.com/profile.php/nonexistent.js` the cache could potentially store response because it sees the `.js` extension. 

This is dangerous as if the application being tested is replaying the request with sensitive user contents stored in `www.example.com/profile.php`, an attacker can craft a malicious URL to steal these contents from other users.

Other things to test:

* *[www.example.com/profile.php/.js](http://www.example.com/profile.php/.js)*
* *[www.example.com/profile.php/.css](http://www.example.com/profile.php/.css)*
* *[www.example.com/profile.php/test.js](http://www.example.com/profile.php/test.js)*
* *[www.example.com/profile.php/../test.js](http://www.example.com/profile.php/../test.js)*
* *[www.example.com/profile.php/%2e%2e/test.js](http://www.example.com/profile.php/%2e%2e/test.js)*
* *Use lesser known extensions such as* `.avif`

### References

{% embed url="<https://omergil.blogspot.com/2017/02/web-cache-deception-attack.html>" %}

{% embed url="<https://book.hacktricks.xyz/pentesting-web/cache-deception>" %}

{% embed url="<https://book.hacktricks.xyz/pentesting-web/http-request-smuggling#using-http-request-smuggling-to-perform-web-cache-deception>" %}

{% embed url="<https://portswigger.net/daily-swig/web-cache-deception-named-top-web-hacking-technique-of-2019>" %}