Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →elementalsouls/hunt-cache-poison
Hunting skill for cache poison vulnerabilities. Built from 10 public bug bounty reports including X-Forwarded-Host poisoning, X-HTTP-Method-Override / GCS cache, reflected→stored XSS via cache, classic Omer-Gil Web Cache Deception, Cloudflare Cache Deception Armor bypass, session-token cache deception, Akamai hop-by-hop smuggling → server-side edge poisoning, and Kettle's 2024 path-normalization WCD against Cloudflare/Fastly/GCP. Host/X-Forwarded-Host injection that reaches app logic (reset-link
Passed 21 of 23 test cases with the skill, and 20 of 23 without it.
2 fixed19 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
In a 2018 vulnerability report against HackerOne's infrastructure, an attacker poisoned 301 redirects to cause widespread denial of service for site visitors. Identify the non-standard forwarded header injected and the specific header value that broke browser connectivity.
| Checked | Without skill | With skill |
|---|---|---|
| Identifies X-Forwarded-Port as the injected header | Passed | Passed |
| Specifies port value 1 as the payload that broke client HTTP connection attempts | Missed | Passed |
The instructions your model reads when the skill loads.
Cache poisoning is high-value because a single poisoned cache entry can affect thousands or millions of victims simultaneously — one request, mass exploitation. Payout scales with blast radius.
Highest-value targets:
Asset types that pay most: CDN hostnames, subdomain-per-tenant patterns, update/download servers, login/account pages cached incorrectly, affiliate link shorteners.
Two distinct attacks live under this skill — target the simpler one first.
Attack 1 — Password Reset Poisoning (Host header injection):
The app uses the Host header to construct the password reset link in the email. Inject an attacker-controlled hostname; the victim's reset email contains a link to your server.
POST /forgot-password
Host: attacker.com
X-Forwarded-Host: attacker.com
X-Host: attacker.com
[email protected]
Content-Type: application/x-www-form-urlencoded
Use a distinctive hostname you control or can identify in the response. Proof: the injected hostname appears in the response body (some apps reflect the generated reset link), or the action succeeds (2xx with a "reset email sent" message) after injection — confirming the poisoned link would be sent to the victim.
Try multiple host headers — apps vary in which one they trust (X-Forwarded-Host is most common, but Host itself also works when the proxy passes it through).
Attack 2 — Web Cache Poisoning:
test cases passed, vs 20 / 23 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.