Agent skill · security · yaklang
web-cache-deception
Web cache deception and poisoning playbook. Use when CDN, reverse proxy, or application caching may serve sensitive authenticated content to other users due to path confusion or cache key manipulation.
Why this skill is useful
Provides detailed attack methodologies and techniques for exploiting web cache vulnerabilities, including executable scripts for testing cache behavior.
What it needs
About 3k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Web Cache Deception — Expert Attack Playbook AI LOAD INSTRUCTION: Web cache deception and poisoning techniques. Covers path confusion attacks, CDN cache behavior exploitation, cache key manipulation, and the distinction between cache deception (steal data) and cache poisoning (serve malicious content). Presented by Omer Gil at Black Hat 2017 and significantly expanded since. Advanced Reference Also load CACHEPOISONINGTECHNIQUES.md when you need: Web Cache Poisoning vs Web Cache Deception — clear distinction and attack flow comparison Unkeyed header poisoning (X-Forwarded-Host, X-Forwarded-Scheme, X-Original-URL, multiple Host headers) Unkeyed parameter poisoning (utmcontent, fbclid, callback, reflected but not in cache key) Fat GET cache poisoning (body parameters reflected but not keyed) Parameter cloaking via semicolons and duplicate parameter parsing differentials CDN-specific behavior: Cloudflare, CloudFront, Akamai, Varnish, Fastly (cache key composition, debug headers, ESI) Vary header manipulation, cache partitioning attacks, and missing Vary vulnerabilities 1. CORE CONCEPTS Web Cache Deception (steal authenticated data) The attacker tricks a victim into requesting their authenticated page at a URL that the cache considers static: Web Cache Poisoning (serve malicious content) The attacker manipulates unkeyed request components (headers, cookies) to make the cache store a malicious response: --- 2. CACHE DECEPTION — ATTACK METHODOLOGY Step 1: Identify Cacheable Path Patterns CDNs typically cache by file extension: Step 2: Test Path Confusion Step 3: Verify Caching Step 4: Deliver to Victim Send the crafted URL to victim via phishing, message, or embed: --- 3. CACHE POISONING — ATTACK METHODOLOGY Unkeyed Input Discovery Cache keys typically include: Host, URL path, query string. These are typically NOT in the cache key: X-Forwarded-Host, X-Forwarded-Scheme, X-Original-URL, cookies, custom headers. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/web-cache-deception