Labs / Redis Cache Poisoner
- Daily Challenge
- Released 04 Sep 2025
💉 Can you inject Redis commands through their note caching system?
A note caching API constructs Redis commands using string concatenation, creating opportunities for CRLF injection attacks. When user input meets insufficient sanitization, even simple note storage can become a pathway to Redis command injection and session manipulation. 🎯 Time to test your protocol injection skills!
Start Lab Environment
Launch your dedicated AWS machine to begin hacking
💉 Redis Cache Poisoning via CRLF Injection
CRLF injection in Redis commands is a critical vulnerability that allows attackers to inject arbitrary Redis commands by manipulating user input. This challenge teaches you how to exploit CRLF injection to poison Redis cache and escalate privileges through command injection.
🎯 What You'll Learn
- ✓ CRLF injection attack techniques
- ✓ Redis command injection methods
- ✓ Cache poisoning via protocol manipulation
- ✓ Session hijacking through cache
- ✓ Privilege escalation via Redis
🔍 Challenge Overview
You'll encounter a note caching API that constructs Redis commands using string concatenation. The application fails to sanitize CRLF characters in user input, allowing injection of arbitrary Redis commands to manipulate session data and gain admin privileges.