Web Cache Attacks (Poisoning / Deception)

Cross-platform resources for Web Cache Attacks (Poisoning / Deception): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Web Cache Attacks (Poisoning / Deception): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 22 challenges across 2 platforms — 21 PortSwigger · 1 TryHackMe. 0 with a Spanish writeup, 0 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Cache key injection (Apprentice) · 🇬🇧
2. PortSwigger — Combining web cache poisoning vulnerabilities (Apprentice) · 🇬🇧
3. PortSwigger — Exploiting exact-match cache rules for web cache deception (Apprentice) · 🇬🇧
4. PortSwigger — Exploiting HTTP request smuggling to perform web cache deception (Apprentice) · 🇬🇧
5. PortSwigger — Exploiting HTTP request smuggling to perform web cache poisoning (Apprentice) · 🇬🇧
6. PortSwigger — Exploiting path mapping for web cache deception (Apprentice) · 🇬🇧

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/web-cache-deception

PortSwigger labs practicing Web Cache Attacks (Poisoning / Deception) (21)

Lab	Difficulty	Topic	Official
Cache key injection	APPRENTICE	Web Cache Poisoning	Open
Combining web cache poisoning vulnerabilities	APPRENTICE	Web Cache Poisoning	Open
Exploiting exact-match cache rules for web cache deception	APPRENTICE	Web Cache Deception	Open
Exploiting HTTP request smuggling to perform web cache deception	APPRENTICE	HTTP Request Smuggling	Open
Exploiting HTTP request smuggling to perform web cache poisoning	APPRENTICE	HTTP Request Smuggling	Open
Exploiting path mapping for web cache deception	APPRENTICE	Web Cache Deception	Open
Internal cache poisoning	APPRENTICE	Web Cache Poisoning	Open
Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria	APPRENTICE	Web Cache Poisoning	Open
Exploiting cache server normalization for web cache deception	PRACTITIONER	Web Cache Deception	Open
Exploiting origin server normalization for web cache deception	PRACTITIONER	Web Cache Deception	Open
Exploiting path delimiters for web cache deception	PRACTITIONER	Web Cache Deception	Open
Parameter cloaking	PRACTITIONER	Web Cache Poisoning	Open
Targeted web cache poisoning using an unknown header	PRACTITIONER	Web Cache Poisoning	Open
URL normalization	PRACTITIONER	Web Cache Poisoning	Open
Web cache poisoning via a fat GET request	PRACTITIONER	Web Cache Poisoning	Open
Web cache poisoning via ambiguous requests	PRACTITIONER	HTTP Host Header Attacks	Open
Web cache poisoning via an unkeyed query parameter	PRACTITIONER	Web Cache Poisoning	Open
Web cache poisoning via an unkeyed query string	PRACTITIONER	Web Cache Poisoning	Open
Web cache poisoning with an unkeyed cookie	PRACTITIONER	Web Cache Poisoning	Open
Web cache poisoning with an unkeyed header	PRACTITIONER	Web Cache Poisoning	Open
Web cache poisoning with multiple headers	PRACTITIONER	Web Cache Poisoning	Open

TryHackMe rooms practicing Web Cache Attacks (Poisoning / Deception) (1)

Room	Difficulty	Type	Access	Official
L2 MAC Flooding & ARP Spoofing	EASY	Walkthrough	🟢 Free	Open

---

← Back to the full glossary

Last updated: 2026-08-13