skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-cache-poison

Detects web cache poisoning and cache deception vulnerabilities in CDN-fronted applications.

Updated Sep 6, 2026
Search Tags:#security testing#cdn#bug bounty#vulnerability hunting#cache poisoning#web cache deception#x-forwarded-host
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-cache-poison-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-cache-poison
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-cache-poison
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-cache-poison-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Web cache poisoning and Web Cache Deception bugs are hard to find manually because they depend on subtle mismatches between CDN cache keys and origin behavior. This Skill provides a structured hunting methodology, built from real disclosed bug bounty reports, to systematically identify, validate, and document these vulnerabilities during authorized security testing. ## Core Features & Use Cases - Unkeyed Header Discovery: Test headers like X-Forwarded-Host, X-Host, X-Original-URL, and X-HTTP-Method-Override to find inputs that influence responses but are excluded from cache keys. - Web Cache Deception Testing: Append static-looking extensions (.css, .jpg, .avif) to authenticated routes to trick CDNs into caching private responses. - Cache Validation Workflow: Confirm poisoning by fetching the URL from a separate client or IP, measure TTL via Age and Cache-Control headers, and assess blast radius across CDN edges. - Use Case: While testing a Shopify or Cloudflare-fronted target in a bug bounty program, use the step-by-step methodology to probe for X-Forwarded-Host reflection, verify the poisoned response is cached, and reproduce it from an incognito session to build a valid report. ## Quick Start Ask the AI to test a target URL for cache poisoning by probing unkeyed headers like X-Forwarded-Host and verifying the poisoned response from a second client.

Frequently Asked Questions about hunt-cache-poison

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for web cache poisoning vulnerabilities?▼

Send requests with unkeyed headers like X-Forwarded-Host pointing to a domain you control, then check if the value is reflected in the response body. Confirm the poisoned response is cached by requesting the same URL from a different IP or incognito session without the malicious header.

What is Web Cache Deception and how do I find it?▼

Web Cache Deception tricks a CDN into caching authenticated content by appending static-looking extensions like .css or .jpg to dynamic routes. Request /account/profile.css with a session, then fetch the same URL unauthenticated to check if private data was cached.

Which response headers indicate a caching layer?▼

Look for X-Cache: HIT, CF-Cache-Status (Cloudflare), Age with a nonzero value, Via referencing varnish/cloudfront/fastly, and Cache-Control with public max-age. These signals reveal the CDN vendor and whether responses are being stored.

Does cache poisoning testing work against Cloudflare and Fastly?▼

Yes, the methodology covers Cloudflare, Fastly, Akamai, Varnish, and CloudFront, including documented bypasses like Cloudflare Cache Deception Armor evasion via unlisted extensions such as .avif. Each CDN has distinct cache-key and normalization behaviors to probe.

Why is my cache poisoning finding rejected as not reproducible?▼

Reports fail when the poisoned response is only visible to the attacker's own session. You must demonstrate that a separate unauthenticated client or different IP receives the cached poisoned response, and avoid relying on Cache-Control: no-cache, which CDNs typically ignore.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

web-vuln-cache-poisoning

Detect web cache poisoning and deception in cached HTTP responses.

Community
Intermediate
Wyl-cmdWyl-cmd
6

hunt-cache-poison

Detects cache poisoning and Web Cache Deception vulnerabilities in CDN-fronted web applications.

Community
Advanced
wgpsecwgpsec
1.7k

http-smuggling-advanced

Exploit confirmed HTTP request smuggling vulnerabilities through chained attacks and HTTP/2 downgrade techniques.

Official
Advanced
marcboggsmarcboggs

hunt-host-header

Tests web applications for Host header injection leading to account takeover, cache poisoning, and SSRF.

Community
Advanced