What problem does it solve?
This Skill addresses the critical risk of CDNs, reverse proxies, or application caching layers serving sensitive authenticated user content to unauthorized parties, or serving malicious content to all users, due to path confusion between cache and application logic or manipulation of unkeyed request components.
Core Features & Use Cases
- Cache Deception Testing: Step-by-step methodology to identify path confusion flaws that allow attackers to trick caches into storing and serving authenticated user data.
- Cache Poisoning Testing: Guidance to detect unkeyed request headers that can be manipulated to inject malicious content into cached responses served to all users.
- Use Case: Security teams can use this playbook during authorized penetration tests to validate the security of their web application caching configurations and prevent data leaks or widespread malicious content distribution.
Quick Start
Use the web-cache-deception skill to test your target application's CDN and caching configuration for cache deception and poisoning vulnerabilities during an authorized security assessment.
