web-cache-deception

Web cache deception exposes authenticated content to unauthorized users, while web cache poisoning persists attacker-controlled responses for others to consume. Both exploit cache key mismatches but differ in attack goals and observable signals.

To test for cache poisoning via unkeyed reflection, identify the cache layer, probe cache key composition, and verify whether unkeyed inputs like headers or parameters are reflected into cached responses by observing HIT/MISS persistence.

Path confusion with static extensions tricks the cache into storing authenticated dynamic content by appending static file extensions to URLs, causing the cache layer to serve private content to unauthorized users.

Identify the cache layer by analyzing CDN debug headers and Vary handling to determine how responses are partitioned, then confirm caching behavior by observing HIT/MISS persistence across requests.

Yes, this testing approach covers fat GET behaviors and Vary-related partitioning issues, examining how unkeyed inputs and Vary headers affect cache key composition and response persistence across CDN and proxy layers.

Cache key manipulation testing requires observable HIT/MISS persistence to confirm exploitation, meaning misconfigurations without clear cache indicators cannot be verified, and impact assessment depends on affected user base.