hunt-cache-poison

Identify and validate cache poisoning and web cache deception vulnerabilities in CDN deployments.

3.3k|507|Updated May 5, 2026

Search Tags:#cdn #pentest #edge-cache #security-research #bug-bounty #cache-poisoning #web-cache-deception

Ready to run

npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-cache-poison-elementalsouls

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-cache-poison
Source: https://github.com/elementalsouls/Claude-BugHunter/tree/main/skills/hunt-cache-poison
Command: npx skills add https://github.com/elementalsouls/Claude-BugHunter --skill hunt-cache-poison-elementalsouls

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cache poisoning and web cache deception threaten edge CDN integrity by poisoning cached responses served to many users. This skill provides a structured approach to identify, understand, and assess such vulnerabilities in modern CDN and reverse-proxy architectures.

Core Features & Use Cases

Guided hunting workflow for cache-key misconfigurations, unkeyed header reflection, and Web Cache Deception edge cases.
Practical payloads and patterns to reproduce poisoning scenarios (with safe, controlled testing notes) and to validate caching behavior across CDNs like Cloudflare, Fastly, and Akamai.
Risk assessment and disclosure guidance for enterprise platforms hosting shared caches, multi-tenant apps, and affiliate-link services.

Quick Start

Follow the short guide to begin safe, controlled cache-poisoning testing and documentation.

Frequently Asked Questions about hunt-cache-poison

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect edge-cache poisoning vulnerabilities in a CDN deployment?▼

To detect edge-cache poisoning, you identify cache-key misconfigurations and unkeyed header reflection by manipulating HTTP headers and assessing cache TTL behavior across edge proxies. This involves structured hunting steps to reproduce poisoned cached responses served to multiple users.

What is web cache deception and how does it affect authenticated routes?▼

Web cache deception exploits edge CDN caching rules to force authenticated routes to cache sensitive user data. It uses path extension tactics to trick the CDN into caching dynamic responses, exposing private information to unauthorized users.

How do I test cache poisoning safely on platforms like Cloudflare, Fastly, and Akamai?▼

You test cache poisoning safely by following controlled testing notes and practical payload examples to validate caching behavior on Cloudflare, Fastly, and Akamai. This includes header manipulation and path extension tactics to reproduce scenarios without disrupting production traffic.

Can I use cache poisoning detection for multi-tenant services and third-party integrations?▼

Cache poisoning detection applies to multi-tenant services and third-party integrations like Linkpop. It provides risk assessment and disclosure guidance tailored for enterprise platforms hosting shared caches and affiliate-link services.

What is the best way to document cache poisoning findings for bug bounty disclosure?▼

The best way to document cache poisoning for bug bounty disclosure is to follow disclosure-ready guidance that codifies detection patterns, hunting steps, and payload examples. This ensures reproducible tests and clear risk assessment for enterprise platforms.