BACKGROUND

To solve the lab, find the API key for the user carlos. You can log in to your own account using the following credentials: wiener:peter.

We have provided a list of possible delimiter characters to help you solve the lab: Web cache deception lab delimiter list.

---

EXPLOITATION

/my-account%23%2f%2e%2e%2fresources

Different parser behavior:

Cache :

• resolves the path traversal sequence ../resources so it process /resourcess and caches it

On the other hand, the origin server uses the # (%23) delimeter and only uses /my-account thus in this path /my-account%23%2f%2e%2e%2fresources we are actually saving the result of /my-account This is because the different ways normalization happens on both servers. This is a exploitable normalization discrepancy where the cache server resolves the path traversal.