web-cache-deception-path

What problem does it solve?

Web applications using CDN or cache layers are vulnerable to cache deception attacks when the cache and origin server parse URL paths differently, leading to sensitive user-specific data being exposed via publicly accessible cached responses.

Core Features & Use Cases

• CDN/Cache Detection: Identifies active CDN or cache layers via headers like cf-cache-status, x-cache, age, and x-served-by.
• Path Delimiter Testing: Tests a range of path delimiters (semicolons, encoded slashes, dot segments, null bytes, etc.) that are parsed inconsistently between cache and origin to trigger the vulnerability.
• Vulnerability Validation: Confirms cache deception by checking for cached responses containing authenticated user data accessible via unauthenticated requests.
• Use Case: Security testers can use this skill to verify if sensitive endpoints like /account/settings or /api/me leak user profile, session, or token data when accessed with crafted path delimiters.

Quick Start

Use the web-cache-deception-path skill to test your target web application for path delimiter-based cache deception vulnerabilities by submitting crafted delimiter requests as an authenticated user and verifying if unauthenticated requests return cached sensitive user data.