hunt-cache-poison

Name: hunt-cache-poison
Availability: InStock
Author: carlos-reyes-utp

Detect cache poisoning by testing unkeyed headers and URL manipulations.

2|Updated Apr 11, 2025

Search Tags:#security testing #cdn #bug bounty #http headers #cache poisoning #web cache deception #unkeyed headers

Ready to run

npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill hunt-cache-poison

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-cache-poison
Source: https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda/tree/main/.agent/skills/hunt-cache-poison
Command: npx skills add https://github.com/Carlos-Reyes-UTP/Desarrollo-de-Sistema-de-Ventas-Empresas-de-Moda --skill hunt-cache-poison

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps you identify and prove cache poisoning issues where an attacker-controlled request causes other users to receive an attacker-injected (or attacker-chosen) cached response.

Core Features & Use Cases

Cache infrastructure mapping: Detect caching layers and signals (Age, X-Cache, CF-Cache-Status, Via) to confirm that poisoning is even possible.
Unkeyed input discovery: Determine which headers or parameters are not included in the cache key by varying requests and checking whether the cached response changes.
Web cache deception validation: Identify cases where attacker-controlled URLs (e.g., appending extensions like .css/.jpg) make dynamic authenticated content get cached as if it were static.
Blast-radius and severity gating: Reproduce the effect from a separate client and estimate persistence/impact using TTL and cache behavior before claiming severity.

Quick Start

Use the hunt-cache-poison skill to map cache behavior, test for unkeyed headers like X-Forwarded-Host, attempt web cache deception with extension-like URL paths, and confirm cross-client impact using fresh unauthenticated requests.

Frequently Asked Questions about hunt-cache-poison

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for unkeyed headers in web cache poisoning?▼

To test for unkeyed headers in web cache poisoning, vary attacker-controlled headers like X-Forwarded-Host in your requests and check whether the cached response changes. This identifies inputs excluded from the cache key that enable cross-user content injection.

What is web cache deception and how does it expose authenticated content?▼

Web cache deception occurs when attacker-controlled URLs with static extensions like .css or .jpg trick a caching proxy into storing dynamic authenticated content. This allows unauthorized users to access cached private data served as static resources.

How do I confirm a cache poisoning vulnerability affects other users?▼

Confirm cache poisoning cross-client impact by reproducing the attack effect from a separate IP address or incognito browser session. Validate persistence and severity by assessing the TTL and cache behavior before claiming widespread blast radius.

Does cache poisoning testing work on CDN and proxy-backed web applications?▼

Cache poisoning testing works on CDN and proxy-backed web applications where caching headers indicate HIT/MISS behavior. Map cache infrastructure by detecting signals like Age, X-Cache, CF-Cache-Status, and Via headers to confirm poisoning is possible.

What is the best way to find cache keys that ignore URL parameters?▼

The best way to find cache keys ignoring URL parameters is to manipulate URL parameters in repeated requests and observe if the shared cache serves the altered response. This detects unkeyed inputs enabling cross-tenant cache poisoning effects.