What problem does it solve? When a target sits behind a CDN, reverse proxy, or cache layer (Cloudflare, Varnish, Nginx), front-end and back-end servers often parse requests differently. This Skill provides a systematic methodology to find unkeyed cache inputs, detect CL.TE/TE.CL/TE.TE desynchronization, and turn those parsing discrepancies into cache poisoning, security control bypasses, or cross-user data theft during authorized CTF and penetration testing engagements. ## Core Features & Use Cases - Cache Poisoning Workflow: Identify cache behavior via X-Cache/Age/CF-Cache-Status headers, discover unkeyed inputs (X-Forwarded-Host, X-Original-URL), and poison shared caches to deliver stored XSS or trigger DoS. - Request Smuggling Detection: Concrete CL.TE, TE.CL, and TE.TE payloads with timing-based confirmation, plus advanced variants like HTTP/2 downgrade (H2.TE/H2.CL), h2c upgrade smuggling, CL.0, and response queue desync. - Cache Deception & URL Discrepancy: Exploit delimiter, encoding, and dot-segment normalization differences between cache and origin to steal authenticated responses. - Use Case: In a CTF challenge behind Cloudflare, you confirm X-Forwarded-Host is reflected but unkeyed, poison the cache with a malicious script URL, and every subsequent visitor loads your JavaScript. ## Quick Start Ask the AI to load the cache-poisoning-smuggling skill and test the target for CL.TE request smuggling and unkeyed cache headers.
