Web Cache Poisoning
An unkeyed input changes the response other users receive. That is poisoning. A private response stored at a URL the cache treats as static is deception, and it belongs on the cache-deception playbook. Report them separately.
Tags: cache, poisoning, headers
Level: advanced
Method
Find unkeyed inputs
Identify headers or parameters that change the response but are not part of the cache key. Record the header and the cache key you observed. Do not mix in a static-looking path: that test is deception.
Tools: Burp Suite
Show a shared cache entry
Send one request that changes an unkeyed input, then a second request that does not. A cache hit that still carries the first change is the note. Use a cache-buster you control so the entry is not a page other people are reading.
Tools: Burp Suite
Name the impact
Say which response changed for a second viewer, and which header caused it. Stop there. Do not turn the note into a script for other people's browsers.
Field notes
- Read Cache-Control, Age, and X-Cache. They tell you whether the response was stored.
- Deception is a different bug. Use the cache-deception playbook when a private response is stored at a static-looking URL.