Cache Attack Skill

Web Cache Poisoning (WCP) and Web Cache Deception (WCD) methodology. WCP poisons cached pages with malicious content served to other users. WCD tricks the cache into storing sensitive pages that the attacker can then read. Both techniques exploit CDN and reverse-proxy caching behavior on CloudFront, Cloudflare, Fastly, Varnish, and Nginx.

When to Use

• Target uses a CDN (CloudFront, Cloudflare, Fastly) or reverse proxy (Varnish, Nginx cache).
• Headers show X-Cache, Age, cf-cache-status, or X-Cache-Hits.
• After surface recon finds no direct vulnerabilities — pivot to infrastructure layer.
• Target allows file extension manipulation in URL paths (.css, .json, .js).

Prerequisites

• terminal with curl.
• Cache buster parameter for safe testing (?cb=RANDOM).
• Patience: cache poisoning requires precise timing and may need multiple attempts.

How to Run