Exploiting path delimiters for web cache deception

Platform: PortSwigger | Category: Web Cache Deception | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Web Cache Deception

Summary

Walkthrough of the PortSwigger Web Security Academy lab Exploiting path delimiters for web cache deception (Web Cache Deception). This lab demonstrates a web cache deception vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Web Cache Deception

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Login to the site using the credentils - wiener:peter.

The /my-account page has the API key of the logged in user.

Analyzing behaviour of Origin server -

The Origin server used here is Apache Coyote which is built using Java.

When we try to append random characters in URI, the application returns 404 NOT FOUND.

For Java based applications, the delimiter used is ;. The path my-account;abc.js would be treated as /my-account by the Origin server . In this case, the Apache Coyote server.

So from our understanding, we can craft a payload such that the origin server truncates anything after my-account; but the cache server considers the URI as path to a static resource & caches the response.

Send the following payload to Carlos using exploit server,

 js read-only • copy allowed Copy
<script>document.location="https://0a58007d0382174983bf10b9000c00a3.web-security-academy.net/my-account;exploit.js"</script>

After carlos clicks the link, We can now access the same URL unauthenticated to retreive the API key of carlos.

Submit the API key to solve the lab.

Key Takeaways / Lessons

• Understanding Web Cache Deception detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Exploiting path delimiters for web cache deception