Cache Poisoning to DoS
In this page you can find different variations to try to make the web server respond with errors to requests that are valid for the cache servers
HTTP Header Oversize (HHO)
Send a request with a header size larger than the one supported by the web server but smaller than the one supported by the cache server. The web server will respond with a 400 response which might be cached:
HTTP Meta Character (HMC) & Unexpected values
Send a header that contain some harmfull meta characters such as \n and \r. In order the attack to work you must bypass the cache first.
A badly configured header could be just \: as a header.
This could also work if unexpected values are sent, like an unexpected Content-Type:
Unkeyed header
Some websites will return an error status code if they see some specific headers in the request like with the X-Amz-Website-Location-Redirect: someThing header:
HTTP Method Override Attack (HMO)
If the server supports changing the HTTP method with headers such as X-HTTP-Method-Override, X-HTTP-Method or X-Method-Override. It's possible to request a valid page changing the method so the server doesn't supports it so a bad response gets cached:
Unkeyed Port
If port in the Host header is reflected in the response and not included in the cache key, it's possible to redirect it to an unused port:
Long Redirect DoS
Like in the following example, x is not being cached, so an attacker could abuse the redirect response behaviour to make the redirect send a URL so big that it returns an error. Then, people trying to access the URL without the uncached x key will get the error response:
Host header case normalization
The host header should be case insensitive but some websites expect it to be lowercase returning an error if it's not:
Path normalization
Some pages will return error codes sending data URLencode in the path, however, the cache server with URLdecode the path and store the response for the URLdecoded path:
Fat Get
Some cache servers, like Cloudflare, or web servers, stops GET requests with a body, so this oucld be abused to cache a invalid response:
References
Last updated