domains / families / security / performing-web-cache-poisoning-attack

performing-web-cache-poisoning-attack

separate

Exploiting web cache mechanisms to serve malicious content to other users

When to use

• During authorized penetration tests when the application uses CDN or reverse proxy caching (Cloudflare, Akamai, Varnish, Nginx)
• When assessing web applications for cache-based vulnerabilities that could affect all users
• For testing whether unkeyed HTTP headers are reflected in cached responses
• When evaluating cache key behavior and cache deception vulnerabilities
• During security assessments of applications with aggressive caching policies

When not to use

• unauthorized use against systems you do not own or have written permission to test

Skill page

Source