cdhound - This tool is an efficient scanner designed to dete

项目说明

cdhound

A tool for testing web cache deception by exploiting discrepancies in how web servers and CDN caches handle URL paths, delimiters, static resources, and request headers. It automates detection and exploitation of these mismatches, making it easier for security researchers and penetration testers to assess the caching layer of web applications.

Requests use randomized parameters (?<rand>) so each test produces unique cache keys — a pollution of the li and keeping test impact on legitimate traffic minimal.

Features

---

Installation

1. Clone the repository to your local machine:

2. Na to the project directory:

3. Install the required dependencies:

---

Options

Example Commands

1. Basic Test with Default Settings:

2. Test with Custom Delimiters and Extensions:

3. Test with Specific Technique (OSN):

4. Path Header O against a sensiti:

5. Test with Proxy and Output:

6. Wildcard cache rule (OSN) against a sensiti:

Techniques Explained

Path Delimiter Testing (pd)

This technique tests for discrepancies in how delimiters (e.g., ;, ,, #) are interpreted by the origin server and the cache. If the origin ser a character as a delimiter but the cache does not, it may be possible to craft a URL that is interpreted differently by each, leading to cache deception.

Origin Ser (osn)

OSN exploits discrepancies in how the origin ser URL paths compared to the cache. For example, if the origin ser path tra sequences (e.g., /static/..%2fprofile) but the cache does not, an attacker can craft a URL that returns sensiti from the origin server, which is then cached and served to other users.

Static prefixes are auto-discovered, but when a cacheable prefix is a dynamic application route go by a wildcard rule (e.g. /share/*) it won't be found by crawling — pass it explicitly with --cache-dirs /share. cdhound then crafts {prefix}/<tra><sensitive> across several tra encodings (..%2f, %2f..%2f, %2e%2e%2f, %2f%2e%2e%2f), co the ChatGPT/Harel /share/%2f..%2fapi/auth/session payload.

Cache Ser (csn)

CSN is the inverse of OSN. It exploits cases where the cache normalizes URL paths but the origin server does not. By crafting a URL that the cache interprets differently than the origin server, an attacker can cause the cache to store and ser information.

File Name Cache Rules (fncr)

This technique targets cache rules that are based on specific file names (e.g., robots.txt, index.html). By appending these file names to dynamic URLs, an attacker can cause the cache to store and ser content as if it were a static file.

Path Header O (pho)

PHO tests middleware/frameworks that rewrite the internal request path based on headers like X-Original-URL, X-Rewrite-URL or X-Forwarded-URI. When the origin honours such a header, the CDN keys the cache on the (static-looking) path while the origin ser from the header-specified path — allowing an attacker to cache authenticated responses under attacker-controlled URLs.

---

Labs

You can test the tool in these labs:

---

For more information on web cache poisoning and deception, refer to the PortSwigger Web Security Academy and Gotta Cache 'em all — bending the rules of web cache exploitation.

项目信息

开发语言：Python

Star 数：39

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕This tool is an efficient scanner designed to detect Cache Deception vulnerabilities in web servers. It automates the process of testing URLs by using customizable delimiters and extensions, with multi-threading support for improved speed.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。