Exploiting path mapping for web cache deception

Platform: PortSwigger | Category: Web Cache Deception | Type: Lab | Difficulty: N/A | OS: N/A | Author: XESXOR | Date: 2026-08-24 | Status: Solved Techniques: Web Security Academy, Web Cache Deception

Summary

Walkthrough of the PortSwigger Web Security Academy lab Exploiting path mapping for web cache deception (Web Cache Deception). This lab demonstrates a web cache deception vulnerability and its exploitation to achieve the lab objectives.

Lab Overview

PortSwigger Web Security Academy — Web Cache Deception

This writeup is part of the XESXOR PortSwigger collection. The original lab description and solution have been preserved and reformatted for clarity.

Lab Description :

Solution :

Login to the site using the credentials provided - wiener:peter

Once logged in, we can see the API key of Wiener in the /my-account endpoint.

The above response is from the Origin server as it contains sensitive information.

Analysing origin server's behaviour -

Entering random path at the end of the URI doesn't change the page's response.

As an attacker, we can abuse this origin server's behaviour to cache the reponse of this endpoint when another user clicks it.

- Analysing Cache server's behaviour -

The cache server caches the response of endpoints that end with static file extension .

The Cache: Miss header indicates that the response came from Origin server .

Now the next time when we hit the same endpoint, we get X-Cache: hit endpoint which indicates the response is served from the cache.

Stealing Carlos's API key -

Now we want carlos to click on our malicious link, so we send the following payload to carlos using the exploit server.

 js read-only • copy allowed Copy
<script>document.location="https://0a58007d0382174983bf10b9000c00a3.web-security-academy.net/my-account/victim.js"</script>

Once carlos clicks on our link, the response will be stored in the cache server & then we can retreive the API key of carlos by performing a unauthenticated GET request to that endpoint.

Submit the API key of carlos & the lab is solved.

Key Takeaways / Lessons

• Understanding Web Cache Deception detection and exploitation is crucial for web security.
• Always validate and sanitize user input; implement proper access controls.
• This lab is part of the PortSwigger Web Security Academy — practice in a safe, legal environment.

---

Crafted by XESXOR Research • 2026-08-24 • PortSwigger Web Security Academy • Lab: Exploiting path mapping for web cache deception