hunt-cache-poison

CDN cache poisoning tests inject unkeyed headers like X-Forwarded-Host to determine if they influence cached responses. This skill guides the workflow to map cache infrastructure, inject headers, and verify if a separate unauthenticated client receives the poisoned response.

Web cache deception tricks caches into storing sensitive authenticated content. This skill validates deception scenarios by appending benign path extensions to measure blast radius, observe caching behavior across edge caches, and document the time-to-live for the cached response.

Mapping cache-key behavior requires identifying caching layers and cache-key components across CDN and edge proxies. This skill guides infrastructure mapping to determine which request components are keyed, helping pinpoint unkeyed inputs that enable cache poisoning.

Yes, you can measure blast radius and time-to-live of poisoned responses. The skill assesses cache poisoning vectors to determine their impact on both authenticated and unauthenticated responses, collecting evidence of how long poisoned entries persist.

Yes, the skill documents blast radius, TTL, and remediation guidance. It helps teams mitigate risky caching configurations by providing structured evidence collection and planning to strengthen defenses against cache abuse and poisoning.

Unkeyed header reflections occur when headers like Forwarded or X-HTTP-Method-Override influence responses but are excluded from the cache key. This skill tests these headers to identify if attacker-controlled inputs are cached and served to other users, creating broad impact.