hunt-cache-poison

To detect edge-cache poisoning, you identify cache-key misconfigurations and unkeyed header reflection by manipulating HTTP headers and assessing cache TTL behavior across edge proxies. This involves structured hunting steps to reproduce poisoned cached responses served to multiple users.

Web cache deception exploits edge CDN caching rules to force authenticated routes to cache sensitive user data. It uses path extension tactics to trick the CDN into caching dynamic responses, exposing private information to unauthorized users.

You test cache poisoning safely by following controlled testing notes and practical payload examples to validate caching behavior on Cloudflare, Fastly, and Akamai. This includes header manipulation and path extension tactics to reproduce scenarios without disrupting production traffic.

Cache poisoning detection applies to multi-tenant services and third-party integrations like Linkpop. It provides risk assessment and disclosure guidance tailored for enterprise platforms hosting shared caches and affiliate-link services.

The best way to document cache poisoning for bug bounty disclosure is to follow disclosure-ready guidance that codifies detection patterns, hunting steps, and payload examples. This ensures reproducible tests and clear risk assessment for enterprise platforms.