BACKGROUND

To solve the lab, find the API key for the user carlos. You can log in to your own account using the following credentials: wiener:peter.

We have provided a list of possible delimiter characters to help you solve the lab: Web cache deception lab delimiter list.

---

EXPLOITATION

After testing with the ";" delimeter as /myaccount;asdf.js and still getting the profile information on the response and observing it was being cached, we build an script that makes a request to this

<script>document.location="https://0a6600ff0370fa4e80a9bc0000af0046.web-security-academy.net/my-account;wcd.js"</script>

so the next request to this static resource returns the cached profile information from carlos