Exploiting origin server normalization for web cache deception

Platform: PortSwigger | Category: Web Cache Deception | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Web Cache Deception

Summary

Walkthrough of the PortSwigger Web Security Academy lab Exploiting origin server normalization for web cache deception (Web Cache Deception). This lab demonstrates a web cache deception vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Web Cache Deception

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Log into the site using the credentials provided - wiener:peter.

Analyzing cache rule & normalization behaviour of cache server -

The GET request the static resource at /resource endpoint is being cached.

Now we to identify what is the cache rule that is configured.

1. Appending a random directory at the start of the path , we see that the response comes from the origin server & not the cache.

This means the cache rule is set such a way that it caches any path that starts with /resources directory. This also means that the cache server does not normalize the URL path

1. Now we also need to check whether the cache rule considers the static file extension also.

From the above image, we can observe that the response is cached eventhough the static extension is not present.

Analyzing Origin server's normalization behaviour -

Upon adding a random path prefix with dot sequence, it was observed that the origin server normalizes the path & thus returns the profile info in the response.

This confirms that the Origin server normalizes the URL

Crafting an exploit -

So based on our analysis, we know that

The cache server caches the reponse if the URI starts with /resource static directory.

Only the Origin server performs path normalization

So we can use the following payload in the exploit server to send the link to carlos on which he will click on it.

 js read-only • copy allowed Copy
<script>document.load="https://0a6100a903a0f1fd80a8b21c00d70049.web-security-academy.net/resources/abc/..%2f..%2fmy-account"</script>

Once carlos clicks on the link, we can get the API key of carlos just by visiting the endpoint unauthenticated.

Now submit the API key of carlos to solve the lab.

Key Takeaways / Lessons

• Understanding Web Cache Deception detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Exploiting origin server normalization for web cache deception