vulns.co
/
mcp by GKData.io

Web cache poisoning

If a header or query changes the response but is not in the cache key, you poison everyone who shares that key. Two clients. One poisons. The other must receive it.

Playbooks

  • HTTP Request Smuggling - Exploit disagreements between a front-end proxy and back-end server on where one request ends, to poison the connection of the next user.
  • Web Cache Poisoning & Deception - Get a malicious response cached and served to other users, or trick the cache into storing sensitive pages.
  • Host Header & Password Reset Poisoning - If the app builds absolute URLs from the request Host, reset mails and caches become ATO.
  • LFI to RCE - File read is P3-P4. Wrappers, log poison, session files, and upload + include are how it becomes RCE.
  • Cache Key Analysis - Work out the key, then find something the origin uses that the key ignores.
  • CRLF / header injection - A parameter that lands in a response header or a backend request header is a split gadget. Prove a new header you control, then ask what it becomes.

Gadgets

  • Unkeyed header / cache key - If a header changes the response but is not in the cache key, you poison everyone who shares that key.
  • Host header / password reset poisoning - If the Host (or X-Forwarded-Host) is copied into a reset email, you steal accounts. If it is copied into asset URLs and cached, you poison the cache.
  • CRLF / header injection - Set-Cookie, Location, or a second response on a shared connection. Often a cache or XSS gadget, not a standalone RCE.
  • HTTP request smuggling desync - Front-end and origin disagree on Content-Length vs Transfer-Encoding. That desync is a request queue gadget, not a party trick.

Payloads

  • LFI / Path Traversal - Read local files, then escalate. PHP wrappers turn LFI into source disclosure or RCE (log poisoning, php://filter chains). Later entries defeat filters via encoding and traversal padding.
  • CRLF / Header Injection - Inject %0d%0a to split responses - set cookies, poison caches, or land reflected XSS via an injected body. Test in params reflected into Location or Set-Cookie headers.
  • Host Header Injection - Poison password-reset links and cache keys by overriding the Host the app trusts. Prime targets: reset emails, absolute URL generation, and unkeyed cache inputs.
  • Cache poison / deception - Unkeyed header and path-deception probes. Confirm with a second client. Harmless markers only.

Bypasses

  • Cache key / deception bypass - Make the CDN store a response the next user should never see, or store your poison under a popular key.
  • Host / forwarded header - Password reset, cache, and absolute URL generation. Try every forwarded header the proxy might trust.
  • HTTP desync probes - Front-end vs origin disagreement on CL vs TE. Detect with a harmless timeout or echo. Do not poison other users.

Checklists

  • Cache - Two clients. One poisons. The other must receive it.

Questions

How do I prove it?

Poison with a unique marker, then fetch as a second user-agent or IP and show CF-Cache-Status / Age / X-Cache HIT with your marker.

Can I leave it poisoned?

No. Use a harmless marker and purge or wait. Production poison of real users is how you get banned.

This page is the public form of hunt_brief("cache") on the MCP connector. Authorized testing only.