BACKGROUND

To solve the lab, find the API key for the user carlos. You can log in to your own account using the following credentials: wiener:peter.

We have provided a list of possible delimiter characters to help you solve the lab: Web cache deception lab delimiter list.

EXPLITATION

/resources/..%2fmy-account?wcd

Cache: caches every asset that starts with /resources

origin server: uses "?" as a delimeter and resolves .. and decodes %2f sa "/" solving /my-account which is a non cacheable resource

Finally the response of /my-account is saved on the /resources/..%2fmy-account?wcd location