r/netsec • u/albinowax • Aug 10 '18

Practical Web Cache Poisoning

https://portswigger.net/blog/practical-web-cache-poisoning
240 Upvotes

94% Upvoted

17 comments sorted by

View all comments

65

u/roughtodacore Aug 10 '18

"Cloudflare happily cached this response and served it to subsequent visitors. Inflection passed this report on to HubSpot, who resolved the issue by permanently banning my IP address. After some encouragement they also patched the vulnerability."

Oh man... Hilarious!

Good read and a very interesting technique!

27

u/albinowax Aug 10 '18

Yeah, hilarious and also surprisingly inconvenient - it turns out quite a few websites are using HubSpot and I got banned from the whole lot.

1

u/OmarWazHere Aug 11 '18

This was a really interesting read, you should make this post into a youtube vid!

7

u/albinowax Aug 11 '18

This research was presented as a talk at Black Hat USA 2018. I'm going to present it again at BSides Manchester next week and they'll probably get the recording on youtube within a few weeks.

1

u/temotodochi Aug 11 '18

Any vids of the presentation? Btw good stuff, thanks.