webPromedium

Lab 181 — PostFlow — Stored XSS via Cache Poisoning

hackadvisor

Task: Express.js blogging platform behind nginx reverse proxy; X-Forwarded-Host header reflected unsanitized in canonical link tags, nginx caches responses with unkeyed X-Forwarded-Host, admin bot visits reported posts. Solution: poison nginx cache with XSS payload in X-Forwarded-Host header, trigger admin bot via post report, exfiltrate admin's flag cookie via same-origin comments API.

$ ls tags/ techniques/
xssstored_xssnginxexpressadmin_botcookie_exfiltrationsame_origin_exfiltrationx_forwarded_hostweb_cache_poisoningcache_key_manipulationunkeyed_headercanonical_link
honeypot_flag_identificationweb_cache_poisoning_via_unkeyed_x_forwarded_host_headerxss_attribute_breakout_in_canonical_link_tagspace_free_javascript_payload_constructionsame_origin_cookie_exfiltration_via_comments_apiadmin_bot_exploitation_via_post_reportcache_race_timing_for_poisoning
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups