web-vuln-cache-poisoning

Web cache poisoning detection involves enumerating unkeyed HTTP headers like X-Forwarded-Host, injecting payloads into fresh cache slots, and fetching without those headers to confirm the malicious response persists. This process requires HTTP(S) access and curl for request orchestration.

Web cache deception occurs when a cache serves authenticated content to unintended users. It is detected by comparing authenticated versus unauthenticated responses after appending paths like .css or .js, checking if cached authenticated pages are served to anonymous users.

Yes, you can test for unkeyed headers on Cloudflare or Varnish using curl. The process records caching headers like Age and CF-Cache-Status, manipulates headers and parameters, and uses cache-busting techniques to verify if attacker-controlled inputs influence cached responses.

Yes, an attacker-controlled domain or collaborator endpoint is required for payload verification during web cache poisoning tests. It confirms whether injected payloads in unkeyed headers are successfully reflected and persisted in the cached HTTP response served to other users.

Testing for web cache poisoning vectors targets unkeyed inputs like X-Forwarded-Host, X-Original-URL, and fat GET payloads. These headers and parameters are manipulated to determine if they are excluded from the cache key and can inject malicious content.

A cached response shows different content because the injected host header was unkeyed, meaning it was not part of the cache key. This allows the attacker-influenced response to be stored and served to unintended users, confirming a web cache poisoning vulnerability.