id: cache-poisoning-fuzz

info:
  name: Cache Poison Fuzzing
  author: dwisiswant0,ColbyJack1134
  severity: info
  reference:
    - https://youst.in/posts/cache-poisoning-at-scale/
    - https://portswigger.net/web-security/web-cache-poisoning
  metadata:
    max-request: 5834
  tags: fuzzing,bruteforce,cache

http:
  - raw:
      - |
        GET /?{{md5(headers)}}=1 HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
        {{headers}}: {{randstr}}.tld
      - |
        GET /?{{md5(headers)}}=1 HTTP/1.1
        Host: {{Hostname}}
        User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0

    attack: clusterbomb
    payloads:

      headers: helpers/wordlists/headers.txt
    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body_1, "{{randstr}}")'
          - 'contains(body_2, "{{randstr}}")'
        condition: and
# digest: 4b0a00483046022100bba6a80d36a07519a4f1b8528ccff3881319bdcd199c51e9d78c319e8832cac8022100f86715b3dbd1438e11a557d63175be67feddc557a7e0bbfcfa6c1b764a48aa0d:922c64590222798bb761d5b6d8e72950