How Web Cache Poisoning works — Complete Guide | Bug Bounty Course Day 29 of 60

This article explains web cache poisoning, a high-impact vulnerability where attackers inject malicious payloads via unkeyed HTTP headers to poison cached responses served to all subsequent users without requiring user interaction. The article provides a complete bug bounty methodology covering how caching works, cache key mechanics, attack vectors, automated discovery using Burp Param Miner, safe testing practices with cache busters, and real-world payout data showing rewards from $500 to $25,000+ depending on impact scope.

• Cache poisoning exploits unkeyed inputsWeb caches use cache keys (typically URL, hostname, and specific headers) to determine if two requests are identical. Unkeyed inputs are headers or parameters that affect the response content but are not included in the cache key. When an attacker injects a malicious payload via an unkeyed input like X-Forwarded-Host, the poisoned response gets cached under the legitimate cache key and served to every subsequent user requesting that URL without any special headers needed.
• Common attack vectors by header typeX-Forwarded-Host reflected in script src tags enables JavaScript injection; X-Forwarded-Scheme can force HTTP downgrades; X-Original-URL can override request paths for access control bypass; unkeyed query parameters like utm_source get reflected in responses; Vary header abuse with unescaped cookies enables cookie poisoning. The specific payload depends on where the unkeyed input appears in the response and what it controls.
• Detecting caching with response headersResponse headers indicate active caching: X-Cache: HIT (Varnish/custom), CF-Cache-Status: HIT (Cloudflare), Age header showing seconds cached, and Cache-Control headers. Testing methodology involves sending the same request twice; if Age increases or X-Cache switches from MISS to HIT, caching is confirmed. These headers appear in Burp Repeater response panels on GET requests.
• Param Miner automates unkeyed discoveryBurp Param Miner (installed from BApp Store) automatically tests hundreds of headers and parameters against cacheable endpoints to identify which ones influence response content without being in the cache key. The workflow is: intercept a cacheable request, send to Repeater, right-click → Extensions → Param Miner → Guess headers with cache busters enabled. It flags findings as 'Cacheable unkeyed header' in the Issues tab, eliminating manual header testing.
• Cache busters prevent production cache pollutionA cache buster is a unique query parameter (e.g., ?cb=X7K2M9P1) added to test URLs to create a unique cache key for testing only. Without cache busters, poisoning tests contaminate the production cache and affect real users — violating bug bounty rules and potentially breaking the law. The methodology: add cache buster to poisoning request, verify poisoning by resending with same buster but no malicious header, and immediately stop if confirming poisoning on the real URL without buster to avoid user impact.
• Impact multiplier drives payout variancePayouts range from $500 for unkeyed header reflected XSS on low-traffic endpoints to $25,000+ for CDN-cached JavaScript poisoning on high-traffic sites. The article's impact matrix shows unkeyed header XSS pays $500–$3,000 (High), CDN-cached JS injection pays $5,000–$25,000 (Critical), and CSRF token leaks via cache poisoning pay $5,000–$20,000. Highest payouts target JavaScript files and high-organic-traffic pages affecting millions of daily users.
• Confirmation requires second request without injectionTo verify cache poisoning is working: send the attack request with cache buster and malicious header, then send the same URL with the same cache buster but without the injected header. If the response still contains the attacker's injected content and X-Cache shows HIT, poisoning is confirmed — the malicious content was cached and served without the original header present.
• Reporting strategy prioritizes discovery over exploitationThe article advises finding and thoroughly documenting the unkeyed input itself with responsible testing methodology using cache busters, rather than immediately jumping to full XSS impact demonstration. A clearly demonstrated cache poisoning primitive with proper documentation gets triaged at high severity even before showing the full XSS chain, and demonstrates legal compliance with bug bounty program requirements.

Bottom line: Web cache poisoning is a high-impact vulnerability where unkeyed HTTP headers or parameters poison cached responses served to thousands of users; exploit it using Param Miner for automated discovery, always employ cache busters during testing to avoid affecting real users, and prioritize thorough documentation of the poisoning primitive itself to achieve critical severity ratings and maximum bug bounty payouts.