skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

cache-attack

Detect CDN providers and test web cache poisoning and deception vulnerabilities.

3|1|Updated Jul 2, 2026
Search Tags:#security#cdn#pentest#recon#web-cache#cache-poisoning
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill cache-attack-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cache-attack
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/cache-attack
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill cache-attack-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3, masscan, subfinder, httpx, nuclei.

What problem does it solve?

This skill addresses the security gap where misconfigured CDNs and reverse proxies allow attackers to poison cached content or deceive systems into storing sensitive user data.

Core Features & Use Cases

  • Cache Detection: Automatically identifies CDN providers and caching headers like X-Cache or cf-cache-status.
  • WCP & WCD Testing: Executes systematic tests for Web Cache Poisoning and Web Cache Deception to validate infrastructure security.
  • Use Case: Use this skill to verify if a target application is vulnerable to cache poisoning via unkeyed headers or if sensitive profile pages are being cached by a CDN.

Quick Start

Run the cache-attack skill against the target domain example.com to detect cache headers and test for potential poisoning vectors.

Frequently Asked Questions about cache-attack

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for web cache poisoning vulnerabilities in CDN configurations?▼

Testing for web cache poisoning involves manipulating HTTP requests to identify unkeyed header reflection and verify cache storage behavior. This skill systematically validates exploitable vectors by checking CDN caching headers like X-Cache or cf-cache-status.

What is web cache deception and how does it impact reverse proxy security?▼

Web cache deception occurs when a reverse proxy caches sensitive user data from dynamic profile pages. This skill validates infrastructure security by testing whether targeted CDNs are deceived into storing private user data within cache layers.

Can I use curl and nmap to detect CDN caching headers during a pentest?▼

Yes, curl and standard shell utilities are used to perform HTTP request manipulation and verify cache status. This skill automatically identifies CDN providers and caching headers like X-Cache or cf-cache-status during security reconnaissance.

How do I validate unkeyed header reflection for cache poisoning during recon?▼

Validating unkeyed header reflection requires sending crafted HTTP requests and observing cache storage responses. This skill targets infrastructure-layer security by automating request manipulation to confirm if target applications reflect unkeyed headers into cached content.

Does this approach work for detecting cache vulnerabilities across different CDN providers?▼

Yes, this approach tests cache storage behavior across various CDN providers and reverse-proxy infrastructures. It systematically checks for web cache poisoning and web cache deception vulnerabilities regardless of the specific CDN caching implementation.

Related Skills

Explore More Software Engineering Skills→
zebbernzebbern
5

subdomain-enum

Enumerate subdomains with Subfinder, Amass, and Httpx pipelines.

Community
Advanced
pdparchitectpdparchitect
13

hunt-cache-poison

Identify and validate cache poisoning and Web Cache Deception vulnerabilities in CDN and edge caching infrastructures.

Community
Advanced
zebbernzebbern
5

port-scan

Identify open ports and running services using naabu, masscan, and nmap.

Community
Intermediate
AcczdyAcczdy
2

testing-for-host-header-injection

Detect HTTP Host header injection vulnerabilities and generate a JSON findings report.

Community
Intermediate