hunt-cache-poison

Name: hunt-cache-poison
Availability: InStock
Author: entrovyx

Identify and validate cache poisoning and Web Cache Deception vulnerabilities via CDN headers.

3|1|Updated Jul 2, 2026

Search Tags:#cache #cdn #web-security #pentesting #poisoning #recon

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-cache-poison-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-cache-poison
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-cache-poison
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-cache-poison-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and validating cache poisoning and Web Cache Deception vulnerabilities, which often require complex, multi-step manual testing across various CDN and origin configurations.

Core Features & Use Cases

Infrastructure Mapping: Automatically identifies caching layers and key components like X-Cache headers and unkeyed inputs.
Vulnerability Validation: Provides a structured methodology to test for unkeyed header reflection, path manipulation, and DoS via cache poisoning.
Use Case: Use this skill when auditing CDN-fronted applications to determine if an attacker can force the cache to store malicious responses, such as poisoned redirects or sensitive authenticated data, affecting all global users.

Quick Start

Use the hunt-cache-poison skill to identify unkeyed headers and test for cache reflection on the target domain.

Frequently Asked Questions about hunt-cache-poison

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect CDN cache poisoning vulnerabilities in web applications?▼

You detect cache poisoning by analyzing CDN headers and testing unkeyed input reflection to validate if malicious responses can be stored globally for all users. This skill automates that multi-step manual testing process across various CDN configurations.

What is Web Cache Deception and how does it affect multi-tenant SaaS environments?▼

Web Cache Deception tricks caching layers into storing authenticated user data by manipulating URL path normalization. This skill validates these vulnerabilities specifically in multi-tenant SaaS environments by testing path manipulation against caching rules.

How do I test for unkeyed header reflection during a pentesting engagement?▼

Testing unkeyed header reflection involves mapping cache key components like X-Cache headers and injecting unkeyed inputs to verify if they are cached globally. This skill automates the infrastructure mapping and structured testing methodology for security assessments.

Can I use this to audit e-commerce platforms for DoS via cache poisoning?▼

Yes, this skill is designed for auditing CDN-fronted e-commerce platforms and provides a structured methodology to test for DoS via cache poisoning. It confirms impact on global cache entries by validating poisoned redirects or stored malicious responses.

What is the best way to find unkeyed inputs that cause poisoned redirects?▼

The best way to find unkeyed inputs causing poisoned redirects is to systematically test unkeyed headers and URL path normalization against the target domain. This skill identifies caching layers and validates if those inputs are reflected in globally stored responses.