nuclei-templates/vulnerabilities/generic/cache-poisoning.yaml

34 lines
795 B
YAML

id: cache-poisoning
info:
name: Cache Poisoning
author: melbadry9,xelkomy,akincibor,dogasantos
severity: low
reference:
- https://blog.melbadry9.xyz/fuzzing/nuclei-cache-poisoning
- https://portswigger.net/research/practical-web-cache-poisoning
tags: cache,generic
requests:
- raw:
- |
GET /?{{randstr}}=9 HTTP/1.1
X-Forwarded-Prefix: prefix.cache.example.com
X-Forwarded-Host: host.cache.example.com
X-Forwarded-For: for.cache.example.com
- |
GET /?{{randstr}}=9 HTTP/1.1
req-condition: true
matchers:
- type: dsl
dsl:
- 'contains(body_2, "cache.example.com")'
extractors:
- type: regex
part: response
regex:
- "(prefix|host|for).cache.example.com"