Web Cache
Last updated
Was this helpful?
Last updated
Was this helpful?
X-Cache: HIT
Generic caches (Varnish, Squid)
Response served from the server or proxy cache.
CF-Cache-Status: HIT
Cloudflare (CDN)
Response served from Cloudflare's cache.
X-Cache: HIT or CF-Cache-Status: HIT (depending on the cache used)
Cache-Control: public -> That means anyone could potentially retrieve this response.
Response :
This page should not be put in cache
Try adding .jpg / .js / .css
Normal Request
The response is
Try to add cacheable extension (For example .js / .css / .jpg, etc.)
The response is
If the Cf-Cache-Status / X-Cache response the request with HIT not MISS or Error. And then try to open the url in incognito mode
Add ; before the extension (For example ;.js / ;.css / ;.jpg, etc.)
The response is
If the Cf-Cache-Status / X-Cache response the request with HIT not MISS or Error. And then try to open the url in incognito mode
www.example.com/profile.php/.js
www.example.com/profile.php/.css
www.example.com/profile.php/test.js
www.example.com/profile.php/../test.js
www.example.com/profile.php/%2e%2e/test.js
Use lesser known extensions such as .avif
Look for evil and X-Cache: HIT / CF-Cache-Status: HIT in the response
Look for evil.com in the response
If the response contains X-Cache: HIT / CF-Cache-Status: HIT and the returned page is malicious or incorrect, it means the cache has been poisoned.
If the server sends a response with X-Cache: HIT / CF-Cache-Status: HIT and the page corresponds to a malicious page (e.g., an error page or an admin page), it is possible that the cache has been poisoned with an incorrect response.
Right-click on a request that you want to investigate and click "Guess headers"
