Testing for browser cache weaknesses

Browser caching is provided for improved performance and a better end user experience. However, when sensitive data is typed into a browser by the user, such data can also be cached in the browser history. We can view this cached data by examining the browser’s cache or simply pressing the browser’s back button.

Getting ready

Using the browser’s back button, determine whether login credentials are cached, allowing for unauthorized access. Examine these steps in Burp to understand the vulnerability.

How to do it...

1. Log in to the Mutillidae application as admin with a password of admin:

Figure 4.47 – Logging in as admin

2. Now, log out of the application by clicking the Logout button from the top menu.

Figure 4.48 – Logout

3. Verify you are logged out by noting the Not Logged In message:

Figure...