domains / families / security / hunt-cache-poison

hunt-cache-poison

combined

Hunting skill for cache poison vulnerabilities. Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization WCD against Cloudflare/Fastly/GCP. Use when hunting cache poisoning, Web Cache Deception, CDN-fronted apps.

When to use

• You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
• You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

When not to use

• Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
• Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
• Validate every finding (see `triage-validation`) before reporting; report via `report-writing`. Prefer a sandbox, disposable VM, or controlled lab.

Skill page

Conflict

The two copies share the same core methodology (map cache, identify unkeyed headers, test reflection, WCD, validate storage), but each contains material steps the other lacks. The uphiago copy includes a 10-step methodology with DoS-via-cache, parameter pollution, TTL measurement, and blast-radius documentation, plus a detailed payload/detection section. The sickn33 copy adds a mandatory authorization/confirmation gate and an 'Autonomous Testing Priority' section that explicitly prioritizes password-reset poisoning (Host header injection) as a distinct first attack, which the uphiago copy does not highlight as a separate priority. Because the sickn33 copy imposes a strict authorization gate and a different attack prioritization, crowning one would hide a real alternative procedure.