Web Cache Vulnerability Scanner (WCVS) is a fast and versatile CLI scanner for web cache poisoning and web cache deception developed by Hackmanit and Maximilian Hildebrand.

The scanner supports many different web cache poisoning and web cache deception techniques, includes a crawler to identify further URLs to test, and can adapt to a specific web cache for more efficient testing. It is highly customizable and can be easily integrated into existing CI/CD pipelines.

• Features
• Installation
  • Option 1: Pre-built Binary
  • Option 2: Kali Linux / BlackArch Repository
  • Option 3: Install Using Go
  • Option 4: Docker
• Usage
  • Specify Headers, Parameters, Cookies, and More
  • Generate a JSON Report
  • Crawl for URLs
  • Use a Proxy
  • Throttle or Accelerate
  • Further Flags
• Background Information
• License

Features

• Support for 10 web cache poisoning techniques:
  1. Unkeyed header poisoning
  2. Unkeyed parameter poisoning
  3. Parameter cloaking
  4. Fat GET
  5. HTTP response splitting
  6. HTTP request smuggling
  7. HTTP header oversize (HHO)
  8. HTTP meta character (HMC)
  9. HTTP method override (HMO)
  10. Parameter pollution
• Support for multiple web cache deception techniques:
  1. Path Parameter
  2. Path Traversal (.css file, /static directory and /robots.txt)
  3. Appended special characters (both encoded and not encoded)
• Analyzing a web cache before testing and adapting to it for more efficient testing
• Generating a report in JSON format
• Crawling websites for further URLs to scan
• Routing traffic through a proxy (e.g., Burp Suite)
• Limiting requests per second to bypass rate limiting

Installation

Option 1: Pre-built Binary

Prebuilt binaries of WCVS are provided on the releases page.

Option 2: Kali Linux / BlackArch Repository

• Kali Linux: apt install web-cache-vulnerability-scanner
• BlackArch: pacman -S wcvs

Option 3: Install Using Go

The repository can be installed using Go.

go1.21 and higher

go install -v github.com/Hackmanit/Web-Cache-Vulnerability-Scanner@latest

Option 4: Docker

1. Clone repository or download the latest source code release

2. Build image (the wordlists folder will also be copied)

$ docker build .
Sending build context to Docker daemon  29.54MB
Step 1/10 : FROM golang:latest AS builder
 ---> 05c8f6d2538a
Step 2/10 : WORKDIR /go/src/app
 ---> Using cache
 ---> f591f24be8cf
Step 3/10 : COPY . .
 ---> 38b358dd3472
Step 4/10 : RUN go get -d -v ./...
 ---> Running in 41f53de436c5
....
Removing intermediate container 9e2e84d14ff3
 ---> 1668edcf6ee3
Successfully built 1668edcf6ee3

3. Run wcvs

$ docker run -it 1668edcf6ee3 /wcvs --help
https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner
version 1.0.0

Usage

WCVS is highly customizable using its flags. Many of the flags can either contain a value directly or the path to a file.

The only mandatory flag is -u/--url to provide the target URL which should be tested for web cache poisoning/deception. The target URL can be provided in different formats,

WCVS needs two wordlists in order to test for the first 5 techniques - one wordlist with header names and one with parameter names. The wordlists can either be present in the same directory WCVS is executed from or specified using the --headerwordlist/-hw and --parameterwordlist/-pw flags.

Examples:

wcvs -u 127.0.0.1
wcvs -u http://127.0.0.1
wcvs -u https://example.com
wcvs -u file:path/to/url_list

wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt"
wcvs -u https://example.com -pw "file:/home/user/Documents/wordlist-parameter.txt"
wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt" -pw "file:/home/user/Documents/wordlist-parameter.txt"

Specify Headers, Parameters, Cookies, and More

• --cacheheader/-ch specifies a custom cache header which will be checked for cache hits and misses
• --setcookies/-sc specifies cookies which shall be added to the request
• --setheaders/-sh specifies headers which shall be added to the request
• --setparameters/-sp specifies parameters which shall be added to the request. While it is also possible to simply add them to the URL, it might be more useful in some cases to add them via this flag.
• --post/-post changes the HTTP method from GET to POST
• --setbody/-sb specifies the body which shall be added to the request
• --contenttype/-ct specifies the value of the Content-Type header
• --useragentchrome/-uac changes the User-Agent from WebCacheVulnerabilityScanner v{Version-Number} to Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36. While the same can be achieved with e.g. -sh "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ..., this flag provides a quicker way.
• --cacheheader/-ch specify a custom cache header (case-insensitive)

If you want to specify more than 1 cookie, parameter or header you need to specify a file which contains them. Take a look at the available templates.

Examples:

wcvs -u https://example.com -ch "X-Custom-Header-ABC"

wcvs -u https://example.com -sc "PHPSESSID=123"
wcvs -u https://example.com -sc "file:/home/user/Documents/cookies.txt"

wcvs -u https://example.com -sh "Referer: localhost"
wcvs -u https://example.com -sh "file:/home/user/Documents/headers.txt"

wcvs -u https://example.com -sp "admin=true"
wcvs -u https://example.com -sp "file:/home/user/Documents/parameters.txt"

wcvs -u https://example.com -post -sb "admin=true"
wcvs -u https://example.com -post -sb "file:/home/user/Documents/body.txt"

wcvs -u https://example.com -post -sb "{}" -ct "application/json"

wcvs -u https://example.com -uac

wcvs -u https://example.com -ch "X-Custom-Cache-Header"

Generate a JSON Report

A JSON report is generated and updated after each scanned URL if the flag --generatereport/-gr is set. The report is written, just like a log file, into the same directory WCVS is executed from. In order to change the directory for all output files use --generatepath/-gp. If HTML special chars shall be encoded in the report, use --escapejson/-ej.

Examples:

wcvs -u https://example.com -gr
wcvs -u https://example.com -gr -ej
wcvs -u https://example.com -gr -gp /home/user/Documents
wcvs -u https://example.com -gr -gp /home/user/Documents -ej