web-vuln-cache-poisoning

What this skill does

Detects web cache poisoning and web cache deception vulnerabilities by identifying caching behavior, enumerating unkeyed inputs (headers and parameters), injecting payloads, and verifying whether poisoned responses are served to subsequent requests. Also tests for web cache deception by checking whether authenticated responses are cached and served to unauthenticated users.

When to use

• When auditing a web application that sits behind a CDN or reverse proxy cache (Varnish, Nginx, Cloudflare, Fastly, Akamai, etc.)
• When testing for unkeyed header injection via X-Forwarded-Host, X-Original-URL, or X-Rewrite-URL
• When investigating parameter cloaking via fat GET requests or semicolon delimiter differences
• When checking whether authenticated pages can be tricked into being cached and served to unauthenticated users

Prerequisites

• curl must be installed
• HTTP/HTTPS access to the target application
• A controlled domain or Burp Collaborator URL for payload injection verification

Inputs