hunt-cache-poison

To test for unkeyed headers in web cache poisoning, vary attacker-controlled headers like X-Forwarded-Host in your requests and check whether the cached response changes. This identifies inputs excluded from the cache key that enable cross-user content injection.

Web cache deception occurs when attacker-controlled URLs with static extensions like .css or .jpg trick a caching proxy into storing dynamic authenticated content. This allows unauthorized users to access cached private data served as static resources.

Confirm cache poisoning cross-client impact by reproducing the attack effect from a separate IP address or incognito browser session. Validate persistence and severity by assessing the TTL and cache behavior before claiming widespread blast radius.

Cache poisoning testing works on CDN and proxy-backed web applications where caching headers indicate HIT/MISS behavior. Map cache infrastructure by detecting signals like Age, X-Cache, CF-Cache-Status, and Via headers to confirm poisoning is possible.

The best way to find cache keys ignoring URL parameters is to manipulate URL parameters in repeated requests and observe if the shared cache serves the altered response. This detects unkeyed inputs enabling cross-tenant cache poisoning effects.