nuclei-templates/vulnerabilities/generic/cache-poisoning.yaml

id: cache-poisoning

info:
  name: Cache Poisoning
  author: melbadry9,xelkomy,akincibor
  severity: low
  reference:
    - https://blog.melbadry9.xyz/fuzzing/nuclei-cache-poisoning
    - https://portswigger.net/research/practical-web-cache-poisoning
  tags: cache,generic

requests:
  - raw:
      - |
        GET /?{{randstr}}=9 HTTP/1.1
        X-Forwarded-Prefix: cache.example.com
        X-Forwarded-Host: cache.example.com
        X-Forwarded-For: cache.example.com

      - |
        GET /?{{randstr}}=9 HTTP/1.1

    req-condition: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_2, "cache.example.com")'
Update cache-poisoning.yaml 2021-04-02 13:49:50 +00:00			`id: cache-poisoning`
Create cache-poisoning.yaml 2021-04-02 13:14:09 +00:00
			`info:`
			`name: Cache Poisoning`
Update cache-poisoning.yaml 2022-03-17 11:19:43 +00:00			`author: melbadry9,xelkomy,akincibor`
			`severity: low`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-18 11:37:49 +00:00			`reference:`
Satisfying the linter (all errors and warnings) * whitespace modifications only 2021-08-19 14:44:46 +00:00			`- https://blog.melbadry9.xyz/fuzzing/nuclei-cache-poisoning`
			`- https://portswigger.net/research/practical-web-cache-poisoning`
Update cache-poisoning.yaml 2021-08-11 07:37:27 +00:00			`tags: cache,generic`
Create cache-poisoning.yaml 2021-04-02 13:14:09 +00:00
			`requests:`
			`- raw:`
			`- \|`
Update cache-poisoning.yaml 2022-03-17 11:19:43 +00:00			`GET /?{{randstr}}=9 HTTP/1.1`
Update cache-poisoning.yaml 2021-04-02 13:49:50 +00:00			`X-Forwarded-Prefix: cache.example.com`
			`X-Forwarded-Host: cache.example.com`
			`X-Forwarded-For: cache.example.com`
Create cache-poisoning.yaml 2021-04-02 13:14:09 +00:00
			`- \|`
Update cache-poisoning.yaml 2022-03-17 11:19:43 +00:00			`GET /?{{randstr}}=9 HTTP/1.1`
Create cache-poisoning.yaml 2021-04-02 13:14:09 +00:00
			`req-condition: true`
			`matchers:`
			`- type: dsl`
			`dsl:`
Update cache-poisoning.yaml 2021-04-02 13:49:50 +00:00			`- 'contains(body_2, "cache.example.com")'`