vulns.co
/
GKData.io MCP

Back to Checklists

Cache

Two clients. One poisons. The other must receive it.

Tags: cache, xss, cdn

Checklist

  • Identify the cache: CF-Cache-Status, X-Cache, Age, Via, Akamai, Fastly, CloudFront, nginx proxy_cache.
  • Key: What is in the key? Host, path, query, cookie, accept? Unkeyed header that changes the body is the bug.
  • Fat GET / unkeyed query: Body on GET, extra query that the origin uses and the CDN ignores.
  • Deception: Path /account plus static suffix, path normalization disagreements, encoded dots.
  • Poison: Header, query, method. Confirm HIT on a second UA / IP.
  • Do not persist junk: Use a harmless marker. Purge or wait if you poisoned a production cache.