hunt-cache-poison

Name: hunt-cache-poison
Availability: InStock
Author: pdparchitect

Identify and validate cache poisoning and Web Cache Deception vulnerabilities in CDN and edge caching infrastructures.

13|2|Updated Jun 1, 2026

Search Tags:#security #reconnaissance #cdn #web-security #bug-bounty #cache-poisoning

Ready to run

npx skills add https://github.com/pdparchitect/rook --skill hunt-cache-poison-pdparchitect

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hunt-cache-poison
Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-cache-poison
Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-cache-poison-pdparchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical security risk of cache poisoning and Web Cache Deception, where attackers manipulate caching layers to serve malicious or private content to legitimate users globally.

Core Features & Use Cases

Cache Infrastructure Mapping: Automatically identifies caching layers like Cloudflare, Fastly, or Akamai and analyzes their configuration.
Unkeyed Input Testing: Detects vulnerabilities where unkeyed headers (e.g., X-Forwarded-Host) are reflected in cached responses.
Web Cache Deception Analysis: Tests for path-based routing flaws that allow unauthorized access to authenticated content.
Use Case: Use this skill to audit a CDN-fronted e-commerce platform for vulnerabilities that could lead to mass account takeover or global service denial.

Quick Start

Use the hunt-cache-poison skill to audit the target domain for unkeyed header reflection and cache deception vulnerabilities.

Frequently Asked Questions about hunt-cache-poison

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I test for unkeyed header reflection in CDN cache poisoning?▼

To test for unkeyed header reflection in CDN cache poisoning, you systematically inject headers like X-Forwarded-Host into requests and verify if the response reflects them while being cached globally across different clients.

What is Web Cache Deception and how does path-based routing manipulation exploit it?▼

Web Cache Deception exploits path-based routing flaws by manipulating URL paths to trick edge caches into storing authenticated content, allowing unauthorized access to private user data through static asset delivery networks.

How do I audit an e-commerce platform for edge cache vulnerabilities?▼

You audit an e-commerce platform for edge cache vulnerabilities by mapping caching layers like Cloudflare or Fastly, testing unkeyed inputs, and verifying cross-client response consistency to confirm exploitability for mass account takeover.

Can I use automated reconnaissance to detect Cloudflare or Fastly cache poisoning?▼

Yes, automated reconnaissance identifies caching layers like Cloudflare, Fastly, or Akamai and analyzes their configurations to detect cache poisoning vulnerabilities by verifying cache key components and unkeyed input reflection.

What is required to validate cache key components for bug bounty hunting?▼

Validating cache key components for bug bounty hunting requires systematically testing unkeyed input reflection and verifying cross-client response consistency to confirm that manipulated CDN responses are served to legitimate users globally.

Does this cache poisoning detection approach work on authentication endpoints?▼

Yes, this cache poisoning detection approach targets authentication endpoints by testing for unkeyed header reflection and path-based routing manipulation that could lead to mass account takeover or global service denial.