search

PortSwigger / param-miner

https://portswigger.net/blog/practical-web-cache-poisoning
Other
1.2k stars 163 forks source link

Ability to use custom headers as cache busters. #56

Closed kinguardo closed 6 days ago

kinguardo commented 3 years ago

Some caches do not include any GET parameters nor the headers that get modified automatically by ParamMiner in their keyed input. Instead they only see some particular headers as a keyed input that aren't accounted for by the current functionality. Therefore it would be convenient to have an option to add custom headers as a cache buster.

One example could be some configurations of CloudFlare that disable keyed input in GET parameters or any headers except for x-http-method-override which is always considered a keyed input by the CloudFlare and requests containing it are guaranteed to be passed to the back-end for further processing.

m0pam commented 1 year ago

Bump for this one....

albinowax commented 6 days ago

Done!