skills.rest
ok-helloworld
ok-helloworldCOMMUNITY
Explore all skills by this author →
GitHub

web-cache-deception

Detect web cache deception and poisoning vulnerabilities across CDN intermediaries.

241|28|Updated May 20, 2026
Search Tags:#web security#cdn#pentesting#http headers#cache poisoning#vary header#cache deception
One-click install
npx skills add https://github.com/ok-helloworld/vibe-pentest --skill web-cache-deception-ok-helloworld
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: web-cache-deception
Source: https://github.com/ok-helloworld/vibe-pentest/tree/main/references/pentest_skills/web-cache-deception
Command: npx skills add https://github.com/ok-helloworld/vibe-pentest --skill web-cache-deception-ok-helloworld

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This skill helps you identify and validate web cache deception and poisoning risks where CDNs, reverse proxies, or caching apps may serve one user’s sensitive content to another.

Core Features & Use Cases

  • Cache Deception Playbook: Find path/extension normalization mismatches (e.g., authenticated endpoints interpreted as static assets) that cause sensitive authenticated responses to be cached and re-served.
  • Cache Poisoning Playbook: Discover and test unkeyed header and parameter inputs (e.g., X-Forwarded-* or reflected unkeyed query parameters) that allow a crafted response to be stored in cache.
  • Vary & CDN Behavior Coverage: Check Vary header correctness, cache key composition, and CDN-specific behaviors across Cloudflare, CloudFront, Akamai, Varnish, and Fastly to assess real-world exploitability.
  • Clear Verification Signals: Use cache hit/miss indicators and reflection checks to confirm whether the crafted input actually results in exploitable cached behavior.

Quick Start

Ask the AI to walk you through identifying the cache layer, testing cache deception via static extensions on authenticated paths, and validating cache poisoning via unkeyed X-Forwarded-* reflections with HIT-on-follow-up confirmation.

Frequently Asked Questions about web-cache-deception

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
What is the difference between web cache deception and cache poisoning?▼

Web cache deception exploits path confusion to cache authenticated responses as static assets, whereas cache poisoning manipulates unkeyed headers or parameters to store crafted malicious responses in the cache.

How do I test for web cache deception vulnerabilities on authenticated endpoints?▼

Test web cache deception by appending static file extensions to authenticated paths, then verify if the CDN caches the sensitive response by checking cache HIT indicators on a subsequent unauthenticated request.

Does this methodology support testing cache behavior across Cloudflare, CloudFront, and Akamai?▼

Yes, this methodology assesses CDN-specific cache behaviors and Vary header correctness across common intermediaries including Cloudflare, CloudFront, Akamai, Varnish, and Fastly to determine real-world exploitability.

How do I verify if a crafted cache poisoning payload is actually served to users?▼

Verify cache poisoning by injecting unkeyed inputs like X-Forwarded headers, checking for reflection in the response, and confirming a cache HIT indicator appears on a follow-up request to validate exploitable behavior.

What are Vary header misconfigurations and how do they cause cache leaks?▼

Vary header misconfigurations occur when cache key composition fails to account for specific request headers, causing CDNs or reverse proxies to serve one user's sensitive authenticated content to another.

Can I use this approach to test unkeyed parameters and path normalization tricks?▼

Yes, you can test unkeyed query parameters, path normalization mismatches, and reflected unkeyed headers to discover cache key manipulation vulnerabilities that expose sensitive authenticated content.

Related Skills

Explore More Legal & Compliance Skills→
EntroVyxEntroVyx
3

cache-attack

Detect CDN providers and test web cache poisoning and deception vulnerabilities.

Community
Advanced
dreadnodedreadnode
11

web-cache-deception-path

Detect web cache deception vulnerabilities from inconsistent URL path parsing.

Official
Intermediate
DorianGalloDorianGallo
5

web-cache-deception

Detect CDN and proxy cache deception via cache key manipulation.

Community
Advanced
pdparchitectpdparchitect
13

hunt-cache-poison

Identify and validate cache poisoning and Web Cache Deception vulnerabilities in CDN and edge caching infrastructures.

Community
Advanced