Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to path confusion or cache key manipulation.

SKILL: Web Cache Deception — Expert Attack Playbook AI LOAD INSTRUCTION : Web cache deception and poisoning techniques. Covers path confusion attacks, CDN cache behavior exploitation, cache key manipulation, and the distinction between cache deception (steal data) and cache poisoning (serve malicious content). Presented by Omer Gil at Black Hat 2017 and significantly expanded since. Advanced Reference Also load [CACHE POISONING TECHNIQUES.md](./CACHE POISONING TECHNIQUES.md) when you need: Web Cache Poisoning vs Web Cache Deception — clear distinction and attack flow comparison Unkeyed header poisoning (X Forwarded Host, X Forwarded Scheme, X Original URL, multiple Host headers) Unkeyed parameter poisoning (utm content, fbclid, callback, reflected but not in cache key) Fat GET cache poisoning (body parameters reflected but not keyed) Parameter cloaking via semicolons and duplicate parameter parsing differentials CDN specific behavior: Cloudflare, CloudFront, Akamai, Varnish, Fastly (cache key composition, debug headers, ESI) Vary header manipulation, cache partitioning attacks, and missing Vary vulnerabilities 1. CORE CONCEPTS Web Cache Deception (steal authenticated data) The attacker tricks a victim into requesting their authenticated page at a URL that the cache considers static: Web Cache Poisoning (serve malicious content) The attacker manipulates unkeyed request components (headers, cookies) to make the cache store a malicious response: 2. CACHE DECEPTION — ATTACK METHODOLOGY Step 1: Identify Cacheable Path Patterns CDNs typically cache by file extension: Step 2: Test Path Confusion Step 3: Verify Caching Step 4: Deliver to Victim Send the crafted URL to victim via phishing, message, or embed: 3. CACHE POISONING — ATTACK METHODOLOGY Unkeyed Input Discovery Cache keys typically include: Host , URL path, query string. These are typically NOT in the cache key: X Forwarded Host , X Forwarded Scheme , X Original URL , cookies, custom headers. Common Unkeyed Headers Cache Poisoning via Host Header 4. PATH NORMALIZATION DIFFERENCES The key to cache deception: CDN and application normalize paths differently . Component Behavior CDN (Cloudflare, Akamai) Caches based on full URL path including extension Application (Rails, Django, Express) May ignore trailing path segments or extensions Reverse proxy (Nginx) May strip or rewrite path before forwarding 5. CACHE POISONING REAL WORLD PATTERN X Forwarded Host → Open Graph / Meta Tag Injection Cache Deception with Path Separator Tricks 6. DEFENSE For Cache Deception Cache only explicitly static paths (e.g., /static/ , /assets/ ) Never cache based on file extension alone Set Cache Control: no store, private on authenticated endpoints Use Vary: Cookie to prevent cross user cache hits For Cache Poisoning Include all reflected headers in cache key Validate and sanitize X Forwarded headers Use Cache Control: no cache for dynamic content Strip unknown headers at CDN edge 6. TESTING CHECKLIST

web-cache-deception