hunt-cache-poison

What problem does it solve?

This Skill helps you identify and prove cache poisoning issues where an attacker-controlled request causes other users to receive an attacker-injected (or attacker-chosen) cached response.

Core Features & Use Cases

• Cache infrastructure mapping: Detect caching layers and signals (Age, X-Cache, CF-Cache-Status, Via) to confirm that poisoning is even possible.
• Unkeyed input discovery: Determine which headers or parameters are not included in the cache key by varying requests and checking whether the cached response changes.
• Web cache deception validation: Identify cases where attacker-controlled URLs (e.g., appending extensions like .css/.jpg) make dynamic authenticated content get cached as if it were static.
• Blast-radius and severity gating: Reproduce the effect from a separate client and estimate persistence/impact using TTL and cache behavior before claiming severity.

Quick Start

Use the hunt-cache-poison skill to map cache behavior, test for unkeyed headers like X-Forwarded-Host, attempt web cache deception with extension-like URL paths, and confirm cross-client impact using fresh unauthenticated requests.