thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Advanced

Web Cache Deception

Tricking a cache into storing a victim's private, authenticated page by making it look like a static resource.

Definition

An attacker lures a victim to a URL such as /account/profile.css; the application ignores the suffix and returns private content, and the cache stores it as static. Mitigations: cache based on Content-Type and Cache-Control rather than extension, return 404 for unexpected paths and mark private pages no-store.

Example

A cache stores /my-account/x.jpg containing the victim's account details because of the .jpg extension.

Exam tip

Deception stores the victim's data; poisoning serves the attacker's content.

Related terms