马丁·多伊纳德_全部缓存弯曲Web缓存利用规则.docxVIP

GottaCache

GottaCache‘emall

Bendingtherulesofwebcacheexploitation

MartinDoyhenard

PortSwiggerResearch

Agenda.

Agenda

1.

2.

3.

4.

5.

6.

WebCaches

CacheRuleExploitationCacheKeyExploitationCache-What-Where(DEMO)Defences

Takeaways

Web

WebCaches

WebCachesCacheProxyOriginServerKeyResponse

WebCaches

CacheProxy

OriginServer

Key

Response

WebCachesCacheProxyOriginServerKeyResponseGET/styles.css

WebCaches

CacheProxy

OriginServer

Key

Response

GET/styles.css

WebCachesCacheProxyOriginServerKeyResponseGET/styles.css

WebCaches

CacheProxy

OriginServer

Key

Response

G