hunt-cache-deception

Web cache deception testing accesses an authenticated page with a cacheable path suffix, then requests the same URL from an unauthenticated profile to check if cached content leaks. This skill uses a baseline, single-variable probe, and oracle verification with owned test accounts only.

Cache deception tricks the cache into storing authenticated private content via path manipulation, while cache poisoning injects malicious content via unkeyed inputs like headers. Findings involving unkeyed header influence are routed to the hunt-cache-poison skill instead.

A valid finding requires an unauthenticated profile retrieving an owned authenticated marker, supported by cache headers and timeline evidence. A 200 status, CDN header, or path mapping alone does not confirm a vulnerability.

Stop immediately when testing touches shared public pages, unknown TTL or purge behavior, real user data, or cross-user verification. WAF blocks, captchas, and timeouts are recorded as inconclusive rather than bypassed.

You need explicit authorization, an isolated cache test window, two owned accounts or an unauthenticated profile, a controllable URL namespace, and a TTL/purge plan. Baselines for authenticated, unauthenticated, and random-path behavior must be established first.