Acme Search (Cache Poison)

web · hard · 350 pts

/search caches by URL only. X-Forwarded-Host gets reflected. Poison the cache so the admin bot loads attacker JS, then read the log on /. --- ### Run locally ```bash cd content/aysec/AYSEC-CTF docker compose up cache-poison ``` Then open `http://localhost:8000` and start solving.