Web-Cache-Vulnerability-Scanner - Web Cache Vulnerability Scanner is a Go-based CLI

项目说明

<h1 align="center">
<img src=" width="100%" alt=""/>
</h1>

![Release]()
![Go Report Card]()
![GitHub go.mod Go ]()
![License]()

Web Cache Scanner (WCVS) is a fast and CLI scanner for web cache poisoning and web cache deception de by Hackmanit and Maximilian Hildebrand.

The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify further URLs to test,
and can adapt to a specific web cache for more efficient testing. It is highly customizable and can be easily integrated into existing CI/CD pipelines.

Features

Installation

- Option 1: Pre-built Binary
- Option 2: Kali Linux / BlackArch Repository
- Option 3: Install Using Go
- Option 4: Docker

Usage

- Specify Headers, Parameters, Cookies, and More
- Generate a JSON Report
- Crawl for URLs
- Use a Proxy
- Throttle or Accelerate
- Further Flags

Background Information

License

Features

Support for 10 web cache poisoning techniques:

1. Unkeyed header poisoning
2. Unkeyed parameter poisoning
3. Parameter cloaking
4. Fat GET
5. HTTP response splitting
6. HTTP request smuggling
7. HTTP header o (HHO)
8. HTTP meta character (HMC)
9. HTTP method o (HMO)
10. Parameter pollution

Support for multiple web cache deception techniques:

1. Path Parameter
2. Path Tra (.css file, /static directory and /robots.txt)
3. Appended special characters (both encoded and not encoded)

Analyzing a web cache before testing and adapting to it for more efficient testing

Generating a report in JSON format

Crawling websites for further URLs to scan

Routing traffic through a proxy (e.g., Burp Suite)

Limiting requests per second to bypass rate limiting

Installation

Option 1: Pre-built Binary

Prebuilt binaries of WCVS are provided on the releases page.

Option 2: Kali Linux / BlackArch Repository

Kali Linux: apt install web-cache-

BlackArch: pacman -S wcvs

Option 3: Install Using Go

The repository can be installed using Go.

go1.21 and higher

Option 4: Docker

1. Clone repository or download the latest source code release

2. Build image (the wordlists folder will also be copied)

3. Run wcvs

Usage

WCVS is highly customizable using its flags. Many of the flags can either contain a value directly or the path to a file.

The only mandatory flag is -u/--url to provide the target URL which should be tested for web cache poisoning/deception. The target URL can be provided in different formats,

WC two wordlists in order to test for the first 5 techniques - one wordlist with header names and one with parameter names. The wordlists can either be present in the same directory WCVS is executed from or specified using the --headerwordlist/-hw and --parameterwordlist/-pw flags.

Examples:

Specify Headers, Parameters, Cookies, and More

--cacheheader/-ch specifies a custom cache header which will be checked for cache hits and misses

--setcookies/-sc specifies cookies which shall be added to the request

--setheaders/-sh specifies headers which shall be added to the request

--setparameters/-sp specifies parameters which shall be added to the request. While it is also possible to simply add them to the URL, it might be more useful in some cases to add them via this flag.

--post/-post changes the HTTP method from GET to POST

--setbody/-sb specifies the body which shall be added to the request

--contenttype/-ct specifies the value of the Content-Type header

--useragentchrome/-uac changes the User-Agent from WebCache } to Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36. While the same can be achieved with e.g. -sh "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ..., this flag provides a quicker way.

--cacheheader/-ch specify a custom cache header (case-insensitive)

#### If you want to specify more than 1 cookie, parameter or header you need to specify a file which contains them. Take a look at the a templates.

Examples:

Generate a JSON Report

A JSON report is generated and updated after each scanned URL if the flag --generatereport/-gr is set.
The report is written, just like a log file, into the same directory WCVS is executed from. In order to change the directory for all output files use --generatepath/-gp.
If HTML special chars shall be encoded in the report, use --escapejson/-ej.

Examples:

Crawl for URLs

In order to crawl for URLs, --recursivity/-r needs to be set. It specifies how deep the crawler shall go recursion-wise.
By default WCVS only crawls for URLs of the same domain. To also crawl for other domains, --recdomains/red can be used.
To only crawl URLs which inherit a specific string, --recinclude/-rin can be used.
--reclimit/-rl limits how many URLs are crawled for each recursion depth.
Also, a list with URLs which shall not be crawled can be specified with --recexclude/-rex. --generatecompleted/-gc can, for example, be used to generate a list with all already tested URLs. If a scan is repeated, but WC not crawl and test again the same URLs, this list can be used for --recexclude/-rex.

Examples:

Use a Proxy

To use a proxy, specify --useproxy/-up. If you are using Burp, make sure to uncheck *"Settings > Network > HTTP > HTTP/2 > Default to HTTP/2 if the ser it"*. Otherwise some techniques, which rely on non-RFC-compliant headers, will not work.
The default URL for the proxy is . In order to change it, use --proxyurl/-purl.

Examples:

Throttle or Accelerate

The number of maximum allowed requests per second can be set with --reqrate/-rr. By default, this number is unrestricted.
Contrary, the number of requests per second can be increased potentially, if --threads/-t is used to increase the number of concurrent threads WC. The default value is 20.

Examples:

Further Flags

WC even more than the beforehand mentioned flags and options. --help/-h provides a list of each flag, its meaning, and how to use it.

Example:

Background Information

A short series of blog posts giving more information about web cache poisoning and WCVS can be found here:

1. Is Your Application to Web Cache Poisoning?
2. Web Cache Scanner (WCVS) - Free, Customizable, Easy-To-Use

The first of Web Cache Scanner (WCVS) was de as a part of a bachelor's thesis by Maximilian Hildebrand.

License

WCVS is de by Hackmanit and Maximilian Hildebrand and licensed under the Apache License, 2.0.

<a href=" src=" width="30%"></a>

项目信息

开发语言：Go

Star 数：1206

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH ().展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。