What problem does it solve? Web applications behind CDNs and reverse proxies can leak authenticated user data or serve attacker-controlled content when cache keys and path normalization differ between layers. This Skill provides a structured methodology to identify, exploit, and verify web cache deception and cache poisoning vulnerabilities during authorized security assessments. ## Core Features & Use Cases - Cache Deception Testing: Append static extensions (.css, .js, .png) to authenticated endpoints, exploit path normalization differences between CDN and origin, and verify cross-user cache hits to steal victim session data. - Cache Poisoning Techniques: Discover and exploit unkeyed headers (X-Forwarded-Host, X-Original-URL), unkeyed parameters (utm_*, callback), Fat GET bodies, and parameter cloaking via semicolon or duplicate-parameter parsing differentials. - CDN-Specific Behavior Reference: Covers cache key composition, debug headers, and quirks for Cloudflare, CloudFront, Akamai, Varnish, and Fastly, plus Vary header manipulation and ESI injection. - Use Case: During a web penetration test, you notice an X-Cache header on responses. Use this Skill to determine the cache key composition, test whether /account/profile/x.css returns cached authenticated content, and check if X-Forwarded-Host is reflected but unkeyed. ## Quick Start Test whether the target's CDN caches authenticated responses by appending a static extension like .css to the /account/profile endpoint and checking for an X-Cache HIT on an unauthenticated follow-up request.
