Web Cache Deception

This is a comprehensive playbook for exploiting cache layer vulnerabilities, split into two attack classes: cache deception (tricking a CDN into caching authenticated user data so attackers can retrieve it) and cache poisoning (injecting malicious content via unkeyed headers like X-Forwarded-Host). The methodology is thorough, covering path confusion tricks, CDN-specific behaviors across Cloudflare and Akamai, and normalization mismatches between proxies and applications. Use this when testing applications behind CDNs or reverse proxies where routing logic might treat /account/profile and /account/profile/x.css differently. The testing checklist and real-world patterns (especially the semicolon path separator tricks) make this immediately actionable for security assessments.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill web-cache-deception --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Web Cache Deception — Expert Attack Playbook

AI LOAD INSTRUCTION: Web cache deception and poisoning techniques. Covers path confusion attacks, CDN cache behavior exploitation, cache key manipulation, and the distinction between cache deception (steal data) and cache poisoning (serve malicious content). Presented by Omer Gil at Black Hat 2017 and significantly expanded since.

Advanced Reference

Also load CACHE_POISONING_TECHNIQUES.md when you need:

Web Cache Poisoning vs Web Cache Deception — clear distinction and attack flow comparison
Unkeyed header poisoning (X-Forwarded-Host, X-Forwarded-Scheme, X-Original-URL, multiple Host headers)
Unkeyed parameter poisoning (utm_content, fbclid, callback, reflected but not in cache key)
Fat GET cache poisoning (body parameters reflected but not keyed)
Parameter cloaking via semicolons and duplicate parameter parsing differentials
CDN-specific behavior: Cloudflare, CloudFront, Akamai, Varnish, Fastly (cache key composition, debug headers, ESI)
Vary header manipulation, cache partitioning attacks, and missing Vary vulnerabilities