Web Cache Poisoning with an unkeyed header writeup
Web Cache Poisoning cheatsheet and other things to note