> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# Web Cache Attacks (Poisoning / Deception)

> Cross-platform resources for Web Cache Attacks (Poisoning / Deception): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

# Web Cache Attacks (Poisoning / Deception)

This page aggregates **cross-platform resources to practice Web Cache Attacks (Poisoning / Deception)**: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

## Curated resources

| Source      | Link                                                                                                                 |
| ----------- | -------------------------------------------------------------------------------------------------------------------- |
| PortSwigger | [https://portswigger.net/web-security/web-cache-deception](https://portswigger.net/web-security/web-cache-deception) |

## PortSwigger labs practicing Web Cache Attacks (Poisoning / Deception) (21)

| Lab                                                                                                                                                                                                                                                                   | Difficulty                                                 | Topic                    | Official                                                                                                                                                                                      |
| --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| [Cache key injection](/en/portswigger/labs/web-cache-poisoning/exploiting-implementation-flaws-web-cache-poisoning-cache-key-injection)                                                                                                                               | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-cache-key-injection)                                                  |
| [Combining web cache poisoning vulnerabilities](/en/portswigger/labs/web-cache-poisoning/exploiting-design-flaws-web-cache-poisoning-combining-vulnerabilities)                                                                                                       | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-combining-vulnerabilities)                                                    |
| [Exploiting exact-match cache rules for web cache deception](/en/portswigger/labs/web-cache-deception/wcd-exploiting-exact-match-cache-rules)                                                                                                                         | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Web Cache Deception      | [Open](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-exact-match-cache-rules)                                                                                   |
| [Exploiting HTTP request smuggling to perform web cache deception](/en/portswigger/labs/request-smuggling/exploiting-perform-web-cache-deception)                                                                                                                     | <span className="dbadge dbadge-easy">APPRENTICE</span>     | HTTP Request Smuggling   | [Open](https://portswigger.net/web-security/request-smuggling/exploiting/lab-perform-web-cache-deception)                                                                                     |
| [Exploiting HTTP request smuggling to perform web cache poisoning](/en/portswigger/labs/request-smuggling/exploiting-perform-web-cache-poisoning)                                                                                                                     | <span className="dbadge dbadge-easy">APPRENTICE</span>     | HTTP Request Smuggling   | [Open](https://portswigger.net/web-security/request-smuggling/exploiting/lab-perform-web-cache-poisoning)                                                                                     |
| [Exploiting path mapping for web cache deception](/en/portswigger/labs/web-cache-deception/wcd-exploiting-path-mapping)                                                                                                                                               | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Web Cache Deception      | [Open](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-path-mapping)                                                                                              |
| [Internal cache poisoning](/en/portswigger/labs/web-cache-poisoning/exploiting-implementation-flaws-web-cache-poisoning-internal)                                                                                                                                     | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-internal)                                                             |
| [Web cache poisoning to exploit a DOM vulnerability via a cache with strict cacheability criteria](/en/portswigger/labs/web-cache-poisoning/exploiting-design-flaws-web-cache-poisoning-to-exploit-a-dom-vulnerability-via-a-cache-with-strict-cacheability-criteria) | <span className="dbadge dbadge-easy">APPRENTICE</span>     | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-to-exploit-a-dom-vulnerability-via-a-cache-with-strict-cacheability-criteria) |
| [Exploiting cache server normalization for web cache deception](/en/portswigger/labs/web-cache-deception/wcd-exploiting-cache-server-normalization)                                                                                                                   | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Deception      | [Open](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-cache-server-normalization)                                                                                |
| [Exploiting origin server normalization for web cache deception](/en/portswigger/labs/web-cache-deception/wcd-exploiting-origin-server-normalization)                                                                                                                 | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Deception      | [Open](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-origin-server-normalization)                                                                               |
| [Exploiting path delimiters for web cache deception](/en/portswigger/labs/web-cache-deception/wcd-exploiting-path-delimiters)                                                                                                                                         | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Deception      | [Open](https://portswigger.net/web-security/web-cache-deception/lab-wcd-exploiting-path-delimiters)                                                                                           |
| [Parameter cloaking](/en/portswigger/labs/web-cache-poisoning/exploiting-implementation-flaws-web-cache-poisoning-param-cloaking)                                                                                                                                     | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-param-cloaking)                                                       |
| [Targeted web cache poisoning using an unknown header](/en/portswigger/labs/web-cache-poisoning/exploiting-design-flaws-web-cache-poisoning-targeted-using-an-unknown-header)                                                                                         | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-targeted-using-an-unknown-header)                                             |
| [URL normalization](/en/portswigger/labs/web-cache-poisoning/exploiting-implementation-flaws-web-cache-poisoning-normalization)                                                                                                                                       | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-normalization)                                                        |
| [Web cache poisoning via a fat GET request](/en/portswigger/labs/web-cache-poisoning/exploiting-implementation-flaws-web-cache-poisoning-fat-get)                                                                                                                     | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-fat-get)                                                              |
| [Web cache poisoning via ambiguous requests](/en/portswigger/labs/host-header/exploiting-host-header-web-cache-poisoning-via-ambiguous-requests)                                                                                                                      | <span className="dbadge dbadge-medium">PRACTITIONER</span> | HTTP Host Header Attacks | [Open](https://portswigger.net/web-security/host-header/exploiting/lab-host-header-web-cache-poisoning-via-ambiguous-requests)                                                                |
| [Web cache poisoning via an unkeyed query parameter](/en/portswigger/labs/web-cache-poisoning/exploiting-implementation-flaws-web-cache-poisoning-unkeyed-param)                                                                                                      | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-unkeyed-param)                                                        |
| [Web cache poisoning via an unkeyed query string](/en/portswigger/labs/web-cache-poisoning/exploiting-implementation-flaws-web-cache-poisoning-unkeyed-query)                                                                                                         | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-implementation-flaws/lab-web-cache-poisoning-unkeyed-query)                                                        |
| [Web cache poisoning with an unkeyed cookie](/en/portswigger/labs/web-cache-poisoning/exploiting-design-flaws-web-cache-poisoning-with-an-unkeyed-cookie)                                                                                                             | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-with-an-unkeyed-cookie)                                                       |
| [Web cache poisoning with an unkeyed header](/en/portswigger/labs/web-cache-poisoning/exploiting-design-flaws-web-cache-poisoning-with-an-unkeyed-header)                                                                                                             | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-with-an-unkeyed-header)                                                       |
| [Web cache poisoning with multiple headers](/en/portswigger/labs/web-cache-poisoning/exploiting-design-flaws-web-cache-poisoning-with-multiple-headers)                                                                                                               | <span className="dbadge dbadge-medium">PRACTITIONER</span> | Web Cache Poisoning      | [Open](https://portswigger.net/web-security/web-cache-poisoning/exploiting-design-flaws/lab-web-cache-poisoning-with-multiple-headers)                                                        |

## TryHackMe rooms practicing Web Cache Attacks (Poisoning / Deception) (1)

| Room                                                         | Difficulty                                       | Type        | Access  | Official                                  |
| ------------------------------------------------------------ | ------------------------------------------------ | ----------- | ------- | ----------------------------------------- |
| [L2 MAC Flooding & ARP Spoofing](/en/tryhackme/rooms/layer2) | <span className="dbadge dbadge-easy">EASY</span> | Walkthrough | 🟢 Free | [Open](https://tryhackme.com/room/layer2) |

***

← [Back to the full glossary](/en/glossary)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"Web Cache Attacks (Poisoning / Deception)","termCode":"web-cache-attacks","inLanguage":"en","url":"https://rootea.es/en/skills/web-cache-attacks","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Tactical pentesting glossary","url":"https://rootea.es/en/glossary"}}`}
</script>

*Last updated: 2026-05-09*