Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
Web Cache Deception
Tricking a cache into storing a victim's private page under an attacker-guessable URL — then reading it as a stranger. The cache stores a personalized response under a shared key; you fetch the key.
Severity guide
High when PII/private pages are cached and retrievable cross-user; medium for partial data leaks; requires both the app's path handling and the cache's key rules to misalign.
Where to look
entry points to test first01
Profile & account pages
/settings, /profile, /billing — private pages behind a cacheable-looking suffix.
02
CDN-fronted apps
Cloudflare/Fastly/Varnish in front — the cache is the victim; check its extension rules.
03
Static-asset conventions
Apps serving everything under /static/ or /assets/ patterns — caches cache by extension/prefix.
04
API GET responses
GET endpoints with authorization gaps that caches assume are public.
05
Mobile API behind same CDN
Same cache, different paths — mobile endpoints often escape the cache-key tests the web team ran.
How to hunt it
in order, start to finishAppend a static extension
Add /nonexistent.css (or .js, .ico) to an authenticated page's path — if the app serves the page and the cache stores it, the deception works.
Send a victim to that URL
The victim must be logged in — any link/image embed triggers their browser to fetch it.
Fetch the cached copy
Request the same URL from a clean session — the cache serves the victim's private page to you.
Check the cache key
Header-based variants (X-Original-URL, X-Forwarded-Host) shift the key — servers normalizing headers inconsistently cache across users.
Distinguish from web cache poisoning
Deception stores the VICTIM's content for you; poisoning stores YOUR content for victims. Test both — same cache, opposite directions.
Filter & validation bypasses
when your first tries get blocked- 01.css suffix stripped? Try delimiter variants: ;.css, ?.css, %3b.css, #.css — path parsing differs per stack.
- 02Cache keyed on full URL? Header tricks (X-Original-URL, X-Rewrite-URL) decouple routing from the key.
- 03Vary: User-Agent honored? Match the victim's UA — the cache splits, you match the split.
- 04Authenticated-only caching? Find the response that leaks Set-Cookie or embedded user data even when cached 302s redirect.
Impact ladder
what makes it payable- 01PII theft — profiles, emails, billing data cached cross-user.
- 02Auth-token/CSRF leakage — tokens embedded in cached pages.
- 03Session data exposure — partial account access via cached fragments.
- 04Chain with cache poisoning — both directions of cache abuse compound.
Payloads
5 · from PayloadsAllTheThingsexample.com/settings/nonexistent.cssThe core trick — private page cached under a static-looking path.
example.com/profile;.cssSemicolon delimiter — path parsing splits where the cache doesn't.
Header: X-Original-URL (Symfony)Header-key confusion — cache and app disagree on which URL was requested.
Header: X-Forwarded-HostHost-header variants that split the cache key from the routing.
Values: CookieVary-header abuse — caches that don't vary on Cookie serve one user's render to another.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.