vulns.co
/
GKData.io MCP

Back to Checklists

Cache deception

Deception is a disagreement about what is safe to store. A second client must receive the private response before you call it cached.

Tags: cache, deception, cdn, session

Checklist

  • Name the cache: Age, X-Cache, CF-Cache-Status, or the vendor header on the host you are testing. No header means you do not yet know it is cached.
  • Cache key: Record whether path, query, cookie, and Authorization change the stored object. A private URL that ignores the session cookie is the lead.
  • Static-looking path: Compare the private URL with the same path when the suffix looks like a static file. Different cache status on the same account data is the result.
  • Normalization: Note whether the cache and the origin agree on case, extra segments, and encoded path characters. Disagreement is the note, not a wordlist.
  • Second client: Load the URL in a clean session that never authenticated. Your own replay is not proof that someone else receives the body.
  • What was stored: Use an account you own. Look for email, object ids, or tokens in the cached body. Stop if the body is not yours.
  • Vary and Set-Cookie: A HIT that still carries a private Set-Cookie, or a missing Vary where the body depends on the viewer, is the result to record.
  • Cleanup: Do not leave a private response in a shared cache. Purge, wait out the stated lifetime, or use a path that only your test user can request.