skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-cache-poison

Identify and validate cache poisoning and Web Cache Deception vulnerabilities in CDN-fronted web applications.

1.1k|191|Updated Jun 24, 2026
Search Tags:#red team#bug bounty#waf bypass#cache poisoning#web cache deception#cdn security#http header manipulation
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-cache-poison-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-cache-poison
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-cache-poison
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-cache-poison-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Cache poisoning and Web Cache Deception (WCD) are high-severity vulnerabilities that let attackers poison CDN caches to serve malicious content to thousands of users simultaneously, leading to mass cross-site scripting, account takeover, or denial of service, but these flaws are frequently missed in standard web application reconnaissance.

Core Features & Use Cases

  • End-to-end hunting methodology: Step-by-step workflow to map cache infrastructure, identify unkeyed inputs, test for header-based poisoning and path-based WCD, and validate real-world exploitability.
  • Payload and detection patterns: Pre-built curl commands, Burp Intruder wordlists, and grep patterns to quickly identify cache behavior and reflected unkeyed inputs.
  • Bypass techniques: Workarounds for common mitigations including WAF header stripping, cache key normalization rules, and Cloudflare Cache Deception Armor protections.
  • Real-world validation: 10 disclosed bug bounty case studies (2017-2024) with payloads, root causes, and impact metrics to confirm findings and prioritize high-value, high-blast-radius targets.

Quick Start

Use the hunt-cache-poison skill to test a CDN-fronted web application for exploitable cache poisoning and Web Cache Deception vulnerabilities, including unkeyed header reflection and path-based cache storage flaws.

Frequently Asked Questions about hunt-cache-poison

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for web cache deception and cache poisoning vulnerabilities on a CDN-fronted application?▼

To test for web cache deception and cache poisoning, map the cache infrastructure, identify unkeyed inputs, test header-based poisoning and path-based WCD, and validate exploitable flaws with real-world case studies. This skill provides step-by-step workflows and payload patterns for validation.

What is an unkeyed input in CDN security and how does it lead to cache poisoning?▼

An unkeyed input in CDN security is a header or parameter excluded from the cache key. By manipulating these unkeyed inputs, attackers can poison the CDN cache to serve malicious content to thousands of users simultaneously, causing mass cross-site scripting or denial of service.

How can I bypass WAF header stripping and cache key normalization rules during a red team engagement?▼

You can bypass WAF header stripping and cache key normalization rules using specific workarounds included in this skill. It provides bypass techniques for common mitigations including Cloudflare Cache Deception Armor protections to confirm exploitable cache flaws.

Does this cache poisoning hunting methodology support SaaS multi-tenant services and e-commerce platforms?▼

Yes, this cache poisoning hunting methodology supports SaaS multi-tenant services and e-commerce platforms. It specifically targets public-facing CDN asset endpoints to identify high-severity vulnerabilities with measurable user impact in these environments.

What is the best way to validate exploitable cache flaws and prioritize high-blast-radius targets for bug bounty hunting?▼

The best way to validate exploitable cache flaws is comparing findings against 10 disclosed bug bounty case studies from 2017-2024. These real-world cases provide payloads, root causes, and impact metrics to confirm exploitable vulnerabilities and prioritize high-value targets.

Related Skills

Explore More Software Engineering Skills→
EntroVyxEntroVyx
3

cache-attack

Detect CDN providers and test web cache poisoning and deception vulnerabilities.

Community
Advanced
cc01cccc01cc
4

bug-root-cause-structurer

Produces structured bug root-cause analyses with actionable repair plans and verification steps.

Community
Advanced
AndyAnh174AndyAnh174

Burp Suite Web Application Testing

Guide web application security testing with Burp Suite's interception and scanning tools.

Community
Advanced
pdparchitectpdparchitect
13

hunt-cache-poison

Identify and validate cache poisoning and Web Cache Deception vulnerabilities in CDN and edge caching infrastructures.

Community
Advanced