Poison the cache
The caching proxy on 127.0.0.1:8081 keys only on the path, and /app/home reflects the unkeyed X-Forwarded-Host header. Poison the cached copy with X-Forwarded-Host: evil.example, then fetch the page without the header and capture the flag the cache now serves — saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
Your single poisoned request was cached under the path, so the next visitor — sending no special header — was served your attacker-controlled response from the cache. Key the cache on everything that affects the response (or Vary on it), stop reflecting unkeyed input, and mark sensitive responses no-store.
Show solution
cd /home/student
curl -s -H 'X-Forwarded-Host: evil.example' http://127.0.0.1:8081/app/home
curl -s http://127.0.0.1:8081/app/home | tee loot.txt