<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Web Cache Poisoning Testing

## curl — Cache Detection
```bash
curl -s -D- https://target.com/ | grep -iE 'x-cache|age|cf-cache|via'
curl -s -D- "https://target.com/?cb=$RANDOM" | grep -i x-cache
```

## curl — Unkeyed Header Testing
```bash
curl -s -H "X-Forwarded-Host: evil.com" "https://target.com/?cb=$RANDOM"
curl -s -H "X-Original-URL: /admin" https://target.com/
```

## Burp Suite Param Miner
```
1. Right-click > Extensions > Param Miner > Guess headers
2. Review Output tab for unkeyed inputs
3. Manually verify reflection in Repeater
```

## nuclei — Cache Poisoning Templates
```bash
nuclei -u https://target.com -t http/vulnerabilities/cache-poisoning/ -json
```
