web-vuln-cache-poisoning

What problem does it solve?

Identifies when a CDN or reverse-proxy cache serves attacker-influenced content or authenticated content to unintended users, preventing open redirects, XSS, and sensitive-data disclosure via poisoned cache entries.

Core Features & Use Cases

• Cache behavior detection: Records caching headers (Age, X-Cache, CF-Cache-Status) to determine whether responses are cached.
• Unkeyed input enumeration: Tests header and parameter vectors such as X-Forwarded-Host, X-Original-URL, and fat GET payloads to find inputs not included in the cache key.
• Poisoning and deception verification: Injects payloads into fresh cache slots, fetches without injected headers to confirm persistence, and compares authenticated vs unauthenticated responses to detect web cache deception.
• Use case: Audit a site behind Cloudflare or Varnish to confirm whether attacker-controlled host headers or appended .css/.js paths can cause cached authenticated pages to be served to anonymous users.

Quick Start

Ask the AI to test https://www.example.com for cache poisoning using attacker.com for payload verification and provide an auth cookie for deception checks.