From f54a07bd0dd516faeb5ef0caaeadb4edf5b4dd5e Mon Sep 17 00:00:00 2001 From: xanhacks Date: Fri, 3 Nov 2023 20:51:11 +0100 Subject: [PATCH] add cache poisoning --- content/en/docs/framework/drupal.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/content/en/docs/framework/drupal.md b/content/en/docs/framework/drupal.md index 5375a48..ce71b94 100644 --- a/content/en/docs/framework/drupal.md +++ b/content/en/docs/framework/drupal.md @@ -52,4 +52,5 @@ toc: true ### Others -- Drupal often use `$_REQUEST` instead of `$_GET` or `$_POST`, so you can switch a POST request to a GET request and vice versa. \ No newline at end of file +- Drupal frequently utilizes `$_REQUEST` over `$_GET` or `$_POST`, allowing you to alternate between POST and GET requests. +- Drupal commonly caches web requests based on the `User-Agent`. Additionally, some URLs on HTML pages include the `Host` HTTP header. This can occasionally lead to cache poisoning and the generation of harmful URLs on the intended site. \ No newline at end of file