« Announcing WASC Web Hacking Incident Database (WHID) Mail-list | Main | The OWASP AppSec USA 2011 Call for Papers (CFP) »

Easy Method For Detecting Caching Proxies

While thinking about some of the transparent proxy problems I came up with a fairly reliable way to detect caching proxies. Caching proxies can be either explicit or transparent, but are typically used in a transparent mode by an ISP to cut down on upstream bandwidth. A side effect (and benefit :) of caching is that content tends to load faster since it has less hops to travel because the caching proxy is closer. On its own this isn't reliable enough to determine if a caching proxy exists because network latency can vary depending on the time of day. However if you introduce an artificial lag at the web app/web server layer (say for 3-4 seconds) and the content ever loads faster than this, then you know a caching server is present.

One could make a flash application performing the following steps to easily detect this.

Step 1: User visits site.com
Step 2: site.com loads flash (or java applet/silverlight) on user's browser
Step 3: Flash fetches a page from site.com (or another server with access rights). This page intentionally introduces a static sized lag (say 4 seconds) that would be longer than anything naturally introduced during the routing process. It's important that flash requests a random resource/supply a nonce such as a random query string to ensure that it's fetching a resource that isn't previous cached. After fetching the resource it checks to see if it took less than 4 seconds to load. If it takes less than the statically defined time period at the web app layer to load, then the page is cached by an intermediary device. 

This method of detection should work for both transparent and explicit proxies. While I'm likely not the first to come up with this method, I didn't find anything posted anywhere on it so decided to write this post. In case you're wondering, the reason I didn't make a PoC for this is because my hoster won't allow me to upload an app to introduce this artificial lag but figured I'd post it since someone may find this useful.


Feed You can follow this conversation by subscribing to the comment feed for this post.

All Comments are Moderated and will be delayed!