cachedeception

# Cache Deception Skill Expert-level web cache exploitation for bug bounty hunting. Covers URL parsing discrepancies between CDNs and origin servers that enable cache deception (hijack sensitive data) and cache poisoning (store malicious payloads). ## When to Activate - "cache deception" → Arbitrary Web Cache Deception section - "cache poisoning" → Arbitrary Web Cache Poisoning section - "CDN bypass" → URL Discrepancies section - "path confusion" → Delimiters & Normalization sections - "static extension" → Static Extensions Exploitation - "cache key" → Key Normalization section --- ## Core Concepts ### Web Cache Deception Trick the cache into storing dynamic responses containing sensitive user data. Attacker creates malicious URL, victim clicks it, their authenticated response gets cached, attacker retrieves it. **Impact:** Token theft, API key leakage, PII exposure, account takeover ### Web Cache Poisoning Store malicious payloads in cache under legitimate keys. All users requesting that resource receive the poisoned response. **Impact:** Mass XSS, redirect hijacking, full site defacement ### The Key Insight CDNs and origin servers parse URLs differently. Exploit these discrepancies to: 1. Make cache think a dynamic response is static (deception) 2. Make cache store response under a different key than intended (poisoning) --- ## URL Discrepancies ### Delimiters Different servers treat different characters as path delimiters: | Server/Framework | Delimiter | Ex...