What problem does it solve? Web cache poisoning and Web Cache Deception vulnerabilities are difficult to find manually because they depend on subtle mismatches between CDN cache keys and origin behavior, and a single missed unkeyed header or path-normalization quirk can hide a mass-exploitation flaw. ## Core Features & Use Cases - Cache Infrastructure Mapping: Identify caching layers (Cloudflare, Fastly, Akamai, Varnish, Nginx) from response headers like X-Cache, CF-Cache-Status, and Age, then determine which headers are unkeyed. - Poisoning & Deception Testing: Test unkeyed header reflection (X-Forwarded-Host, X-HTTP-Method-Override), path-extension Web Cache Deception, cached error-response DoS, and HTTP parameter pollution with concrete curl commands and Burp grep patterns. - Validation & Impact Scoping: Apply Gate 0 checks requiring reproduction from a separate client/IP, measure cache TTL, and document blast radius for severity rating. - Use Case: While testing a Shopify storefront, send a request with X-Forwarded-Host pointing to a canary domain plus a cache-busting query parameter, confirm reflection in the cached response, then fetch the URL from an incognito session to prove the poisoned entry is served to other users. ## Quick Start Ask the agent to test https://target.com/account for cache poisoning and Web Cache Deception using the hunt-cache-poison methodology and report any confirmed poisoned cache entries.
