I am recently exploring and playing with James Kettle's Practical Web Cache Poisoning attack. The last part of his post mentioned that Cross-Cloud Poisoning is possible, however, I can't find a way to make it work.

I think the basic idea is to cURL a request with malicious header to a specific edge server by its IP address, however, Cloudflare uses Anycast among their data centers, which means you can't control which data center you will eventually reach even though you cURL to a specific IP address.

I made quite a few tries at my home, and I found no matter what IP address I cURL to, I was always routed to the closest data center around me.

I wonder if I have missed anything, and if it is really possible to remotely poisoning a data center?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.