POST-to-GET interchange found on 407 of Tranco top 10k
Some equivalent GETs accept CSRF tokens rejected on POST and return cacheable responses.
Stories per day · 30 days
2 RSS
2 stories, newest first · one card per story
Stories tagged #web-cache-deception
Hackers Can Manipulate Web Cache Keys to Access Restricted Data and Poison Websites
Researcher Alex Brumen demonstrates Nginx cache key injection enabling restricted-data access, cache-poisoned denial of service, and stored XSS.
5