E-WEB
Web Cache Vulnerability Scanner
Standalone Go CLI scanner from Hackmanit that tests for web cache poisoning and web cache deception across multiple techniques.
OVERVIEW
Web Cache Vulnerability Scanner (WCVS), developed by Hackmanit and distributed as a single Go binary (github.com/Hackmanit/Web-Cache-Vulnerability-Scanner), automates checking a URL for the techniques covered manually with tools like Burp Param Miner and HTTP Request Smuggler elsewhere on this site: it supports 9 web cache poisoning techniques (unkeyed header/parameter poisoning, parameter cloaking, fat GET, response splitting, request smuggling, and more) and 3 web cache deception techniques (path parameter, path traversal, and delimiter-based).
Its built-in crawler can expand a single starting URL into a larger list of in-scope endpoints to test, and because it's a plain CLI binary rather than a Burp extension it drops straight into a CI/CD pipeline or a headless scanning workflow instead of needing a running Burp Suite session.
USE CASES
Practical use cases
- 01
Batch-scanning a list of URLs behind a shared CDN/cache for unkeyed-input poisoning vectors.
- 02
Checking for web cache deception on endpoints that reflect authenticated, per-user content.
- 03
Running cache-poisoning checks as an automated CI/CD step against a staging environment before release.
- 04
Using the built-in crawler to expand a single scoped URL into a broader set of endpoints worth testing.
QUICK START
Once URLs are enumerated behind a caching layer (CDN, reverse proxy), to systematically check each one for poisoning and deception techniques.
- Confirm the target URLs sit behind a caching layer and that automated scanning traffic at volume is within scope.
- Install WCVS with Go (go install) or download a prebuilt binary from the GitHub releases page.
- Provide the header and parameter wordlists WCVS expects in its working directory (or point to custom ones with -hw/-pw).
- Run a scan against the target URL, optionally enabling the crawler to expand coverage.
- Review flagged responses and manually confirm each one in a browser or Repeater before reporting it as exploitable.
wcvs -u https://target.example.com -hw headers.txt -pw params.txtBEFORE YOU RUN IT
What to check before running it
A full scan with the crawler enabled and both wordlists loaded generates a large number of requests — confirm the client's caching infrastructure and rate limits can absorb it before running against production.
Poisoning findings affect every visitor sharing the cache, not just the tester — verify and demonstrate the impact carefully rather than leaving a live poisoned entry in a shared cache.
Like any automated cache-poisoning scanner, a positive result should be manually replayed and confirmed; cache behavior can be inconsistent across nodes in a distributed CDN, producing flaky results.