id: akamai-cache-detect

info:
  name: Akamai Cache Detection
  author: nybble04
  severity: info
  description: |
    Sends a HEAD request with a Pragma header value of "akamai-x-cache-on" and looks for an akamai-specific response header value.
  reference:
    - https://community.akamai.com/customers/s/article/Using-Akamai-Pragma-headers-to-investigate-or-troubleshoot-Akamai-content-delivery?language=en_US
    - https://spyclub.tech/2022/12/14/unusual-cache-poisoning-akamai-s3/
  metadata:
    verified: true
    max-request: 1
  tags: cache,akamai,tech

http:
  - method: HEAD
    path:
      - "{{BaseURL}}"

    headers:
      Pragma: akamai-x-cache-on
    matchers:
      - type: regex
        part: header
        regex:
          - '(?:TCP_HIT|TCP_MISS).*deploy\.akamaitechnologies\.com'

# digest: 4a0a00473045022011341588cf8e4c3fef946497f57b95b143aa9947a35255c0c6c96b5a70d1ba8b022100910f3e2b59c3d46eacdebcf3a458b69e2f86333e12b96dcd775e0f5e48af45d0:922c64590222798bb761d5b6d8e72950