web-cache-deception

What is the difference between web cache deception and web cache poisoning?

Web cache deception tricks a cache into storing private authenticated data via path confusion, whereas cache poisoning injects malicious content into public cached responses. Distinguishing them ensures you test the correct failure mode against CDNs and reverse proxies.

Yes, this skill assesses CDN, reverse proxy, and application caches. It identifies cache keys, checks unkeyed inputs, and performs authentication-aware verification to confirm whether sensitive or attacker-influenced responses are stored and reused.

You check for unkeyed header reflection and parameter cloaking by analyzing cache keys and testing duplicate parameters or Fat GET requests. This verifies whether unkeyed inputs are reflected and if attacker-influenced responses get cached.

Vary header manipulation is testing cache-key mistakes where incorrect Vary headers allow unauthorized response reuse. This skill verifies whether manipulating the Vary header causes caches to store and serve malicious or sensitive responses to unintended users.

You should test for static-extension abuse when a CDN or reverse proxy might misinterpret dynamic authenticated paths as static assets. This skill verifies if appending static extensions causes path confusion, leading the cache to store private account data.