35 lines
667 B
YAML
35 lines
667 B
YAML
|
id: cache-poisoning-fuzz
|
||
|
|
|
||
|
|
info:
|
||
|
|
name: Cache Poison Fuzzing
|
||
|
|
author: dwisiswant0
|
||
|
|
severity: info
|
||
|
|
reference:
|
||
|
|
- https://youst.in/posts/cache-poisoning-at-scale/
|
||
|
|
tags: cache,fuzz
|
||
|
|
|
||
|
|
requests:
|
||
|
|
- raw:
|
||
|
|
- |
|
||
|
|
GET /?{{uniq}}=1 HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
{{headers}}: {{uniq}}.tld
|
||
|
|
|
||
|
|
- |
|
||
|
|
GET /?{{uniq}}=1 HTTP/1.1
|
||
|
|
Host: {{Hostname}}
|
||
|
|
|
||
|
|
attack: clusterbomb
|
||
|
|
payloads:
|
||
|
|
uniq:
|
||
|
|
- "{{md5(rand_text_numeric(32))}}"
|
||
|
|
headers: helpers/wordlists/headers.txt
|
||
|
|
|
||
|
|
stop-at-first-match: true
|
||
|
|
req-condition: true
|
||
|
|
|
||
|
|
matchers:
|
||
|
|
- type: dsl
|
||
|
|
dsl:
|
||
|
|
- 'contains(body_2, "{{uniq}}")'
|