hunt-cache-poison

Cache poisoning is a web security vulnerability where malicious content is stored in a CDN cache and served to users. It can cause mass denial of service or account takeover by manipulating unkeyed headers in cached responses.

To identify cache poisoning, map the target's cache infrastructure, identify cache keys, and test for unkeyed header reflection. This process targets CDN-served assets, e-commerce platforms, and authentication endpoints.

Cache poisoning on CDN-served assets works by exploiting unkeyed headers or web protocols to inject malicious responses. The poisoned cache then serves this harmful content to subsequent users requesting the same asset.

Yes, hunting for cache poisoning requires a solid understanding of caching mechanisms and web protocols. You must know how cache keys are generated and how CDN infrastructure processes requests to identify exploitable unkeyed inputs.

The best way to map cache infrastructure is to systematically analyze how the target application handles requests and generates cache keys. This step-by-step methodology identifies cache behavior before testing unkeyed header reflection.

Yes, cache poisoning can lead to account takeovers on authentication endpoints. By caching malicious scripts or redirected responses, attackers can intercept user credentials when they access the poisoned cached endpoint.