Introducing Web Cache Tunneling

Written by Justin Ohneiser 


1. This cache arrangement was chosen for its simplicity and clarity. For an alternative example, the entire URL could be keyed, while the Referer header is unkeyed and reflected. Any combination would work, as long as some controllable unkeyed content is reflected on cached pages.

2. Note that reflected does not mean unfiltered, nor does it have to in this case. For this technique to work, we just need the content to exist, we don’t need it to execute.

3. Cachecat was built for this particular cache arrangement, that is, a cached response that reflects its URL, with a subset of its query arguments serving as cache keys. Several components of cachecat are dependent on that arrangement, including the packaging of data into HTTP requests and the parsing of data from HTTP responses, but those could likely be modified to fit an alternate environment.

1 - 4 of 8