webPromedium
Lab 231 — PagePulse — XSS via Web Cache Poisoning
hackadvisor
Task: Content analytics platform with caching layer; query parameter reflected unsanitized in HTML meta tags but excluded from cache key. Solution: Web cache poisoning via unkeyed query string to inject XSS, then trigger admin bot visit to exfiltrate non-HttpOnly flag cookie through same-origin API endpoint.
$ ls tags/ techniques/
xssbot_exploitationreflected_xsscookie_exfiltrationweb_cache_poisoningunkeyed_query_stringcache_key_manipulation
admin_bot_exploitationsame_origin_data_exfiltrationweb_cache_poisoning_unkeyed_queryxss_attribute_breakoutcache_timing_attack
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 33 — PulsePress — Reflected XSS in Search Page— hackadvisor
- [web][Pro]PublishWave — XSS via HTTP Cache Poisoning— hackadvisor
- [web][Pro]Lab 69 — TeamPulse — Reflected XSS in OAuth2 Error Callback— hackadvisor
- [web][Pro]Lab 53 — TeamPulse — SQL Injection via WebSocket Employee Lookup— hackadvisor
- [web][Pro]MailPulse— hackadvisor