Cache deception on a static-looking path
Decide whether a private response is stored and later served to a second client that never authenticated.
Level: intermediate
Tools: Burp Suite, browser devtools
Pipeline
Request an authenticated page at {url}, compare cache headers with the same path when its suffix looks static, then load that URL in a clean session and record whether the private body is reused.