BACKGROUND

To solve the lab, change the email address for the user administrator. You can log in to your own account using the following credentials: wiener:peter.

We have provided a list of possible delimiter characters to help you solve the lab: Web cache deception lab delimiter list.

EXPLOITATION

Path delimeter discrepancies tests shows that ";" and "?" works as delimeters normalization discrepancies tests shows that when an static asset is retrieved with a path traversal sequence, it resolves it and caches it GET /asdf/..%2ffavicon.ico but it doesn't work the same with dynamic resources like /my-account

Using the following request we make the cache server resolve to /robots.txt and origin server to /my-account so /robots.txt it's gonna save the my-account information on /robots.txt cache

GET /my-account;%2f%2e%2e%2frobots.txt