Cache Key Analysis

Tags: cache, cdn, xss

Level: advanced

Method

1. Detect the cache

   CF-Cache-Status, Age, X-Cache, Fastly, Akamai, CloudFront. Note HIT vs MISS vs DYNAMIC.

   httpx -l live.txt -title -sc -include-response-header -silent

   Copy

   Tools: httpx

2. Probe the key

   Change query, Host, method, cookie, Accept, Origin, a random header. See what still HITs.

   Tools: Burp Suite

3. Unkeyed input that changes output

   X-Forwarded-Host in links, unkeyed query in JS, fat GET body, path normalization.

4. Two-client confirm

   Poison with a marker, fetch from another UA/IP, show HIT with the marker. Then stop.

Field notes

• Do not leave a stored XSS in a production cache. Use a unique, harmless marker and purge if you can.
• Web cache deception is a different bug (personalised page stored as static). Test both.

References

• https://portswigger.net/research/web-cache-entanglement