web-vuln-cache-poisoning

What this skill does

Detects web cache poisoning and web cache deception vulnerabilities by identifying caching behavior, enumerating unkeyed inputs (headers and parameters), injecting payloads, and verifying whether poisoned responses are served to subsequent requests. Also tests for web cache deception by checking whether authenticated responses are cached and served to unauthenticated users.

When to use

• When auditing a web application that sits behind a CDN or reverse proxy cache (Varnish, Nginx, Cloudflare, Fastly, Akamai, etc.)
• When testing for unkeyed header injection via X-Forwarded-Host, X-Original-URL, or X-Rewrite-URL
• When investigating parameter cloaking via fat GET requests or semicolon delimiter differences
• When checking whether authenticated pages can be tricked into being cached and served to unauthenticated users

Prerequisites

• curl must be installed
• HTTP/HTTPS access to the target application
• A controlled domain or Burp Collaborator URL for payload injection verification

Inputs

Variable	Description	Example
TARGET_URL	Full URL of the target page or endpoint	https://www.example.com/
ATTACKER_DOMAIN	Attacker-controlled domain for payload injection	attacker.com
AUTH_COOKIE	Session cookie for authenticated requests (cache deception tests)	session=abc123

Workflow

Step 1: Detect caching behavior

TARGET_URL="https://www.example.com/"
ATTACKER_DOMAIN="attacker.com"
AUTH_COOKIE="session=abc123"

echo "=== Step 1: Detect caching behavior ==="
for i in 1 2 3; do
  echo "--- Request $i ---"
  curl -s -I "$TARGET_URL" \
    --max-time 10 \
    -H "Cache-Control: no-cache" \
    2>&1 | grep -iE "^(age|x-cache|cf-cache-status|x-varnish|via|cache-control|etag):"
  sleep 1
done

echo ""
echo "[Analysis]"
echo "  Age: > 0            -> response served from cache"
echo "  X-Cache: HIT        -> cached by CDN/proxy"
echo "  CF-Cache-Status: HIT -> cached by Cloudflare"
echo "  Via: varnish/nginx  -> reverse proxy present"