# Web Cache Vulnerability Scanner | A Go-based CLI Tool For Testing For Web Cache Poisoning **URL:** \ **Category:** Tools & Scripts\ **Tags:** learning, tools, hacking\ **Created:** [January 4, 2022, 9:06am UTC](https://onehack.st/t/web-cache-vulnerability-scanner-a-go-based-cli-tool-for-testing-for-web-cache-poisoning/211234 "2022-01-04T09:06:24Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\ **Post date:** [January 4, 2022, 9:06am UTC](https://onehack.st/t/web-cache-vulnerability-scanner-a-go-based-cli-tool-for-testing-for-web-cache-poisoning/211234/1 "2022-01-04T09:06:24Z")
![image](https://onehack.st/uploads/default/original/3X/e/7/e78bbe5ae972bc0324ffe80e25ed53234b908382.png) [![GitHub go.mod Go version](https://camo.githubusercontent.com/c33b1104955d2716229721b09078ba7b6a503cb8299ef2ced9638ef1dd2d2fc7/68747470733a2f2f696d672e736869656c64732e696f2f6769746875622f676f2d6d6f642f676f2d76657273696f6e2f4861636b6d616e69742f5765622d43616368652d56756c6e65726162696c6974792d5363616e6e6572)](https://golang.org/) [![License](https://camo.githubusercontent.com/2a2157c971b7ae1deb8eb095799440551c33dcf61ea3d965d86b496a5a65df55/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f4c6963656e73652d417061636865253230322e302d626c75652e737667)](https://www.apache.org/licenses/LICENSE-2.0) Web Cache Vulnerability Scanner (WCVS) is a fast and versatile CLI scanner for [web cache poisoning](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#background-information) developed by [Hackmanit](https://hackmanit.de/). The scanner supports many different web cache poisoning techniques, includes a crawler to identify further URLs to test, and can adapt to a specific web cache for more efficient testing. It is highly customizable and can be easily integrated into existing CI/CD pipelines. - [Features](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#features) - [Installation](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#installation) - [Option 1: Pre-built Binary (Recommended)](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#option-1-pre-built-binary-recommended) - [Option 2: Fetch Repository Using Go](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#option-2-fetch-repository-using-go) - [Usage](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#usage) - [Specify Headers, Parameters, Cookies, and More](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#specify-headers-parameters-cookies-and-more) - [Generate a JSON Report](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#generate-a-json-report) - [Crawl for URLs](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#crawl-for-urls) - [Use a Proxy](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#use-a-proxy) - [Throttle or Accelerate](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#throttle-or-accelerate) - [Further Flags](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#further-flags) - [Background Information](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#background-information) - [License](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner#license) # Features - Support for 9 web cache poisoning techniques: 1. Unkeyed header poisoning 2. Unkeyed parameter poisoning 3. Parameter cloaking 4. Fat GET 5. HTTP response splitting 6. HTTP request smuggling 7. HTTP header oversize (HHO) 8. HTTP meta character (HMC) 9. HTTP method override (HMO) - Analyzing a web cache before testing and adapting to it for more efficient testing - Generating a report in JSON format - Crawling websites for further URLs to scan - Routing traffic through a proxy (e.g., Burp Suite) - Limiting requests per second to bypass rate limiting # Installation ## Option 1: Pre-built Binary (Recommended) Prebuilt binaries of WCVS are provided on the [releases page](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases). These releases include 2 default wordlists, as well. ## Option 2: Fetch Repository Using Go The repository can be fetched using Go. ```auto go get -u https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner ``` # Usage WCVS is highly customizable using its flags. Many of the flags can either contain a value directly or the path to a file. The only mandatory flag is `-u/--url` to provide the target URL which should be tested for web cache poisoning. The target URL can be provided in different formats, WCVS needs two wordlists in order to test for the first 5 techniques - one wordlist with header names and one with parameter names. The wordlists can either be present in the same directory WCVS is executed from or specified using the `--headerwordlist/-hw` and `--parameterwordlist/-pw` flags. ### Examples: ```auto wcvs -u 127.0.0.1 wcvs -u http://127.0.0.1 wcvs -u https://example.com wcvs -u file:path/to/url_list wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt" wcvs -u https://example.com -pw "file:/home/user/Documents/wordlist-parameter.txt" wcvs -u https://example.com -hw "file:/home/user/Documents/wordlist-header.txt" -pw "file:/home/user/Documents/wordlist-parameter.txt" ``` ## Specify Headers, Parameters, Cookies, and More - `--setcookies/-sc` specifies cookies which shall be added to the request - `--setheaders/-sh` specifies headers which shall be added to the request - `--setparameters/-sp` specifies parameters which shall be added to the request. While it is also possible to simply add them to the URL, it might be more useful in some cases to add them via this flag. - `--post/-post` changes the HTTP method from GET to POST - `--setbody/-sb` specifies the body which shall be added to the request - `--contenttype/-ct` specifies the value of the Content-Type header - `--useragentchrome/-uac` changes the User-Agent from `WebCacheVulnerabilityScanner v{Version-Number}` to `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36`. While the same can be achieved with e.g. `-sh "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...`, this flag provides a quicker way. ### Examples: ```auto wcvs -u https://example.com -sc "PHPSESSID=123" wcvs -u https://example.com -sc "file:/home/user/Documents/cookies.txt" wcvs -u https://example.com -sh "Referer: localhost" wcvs -u https://example.com -sh "file:/home/user/Documents/headers.txt" wcvs -u https://example.com -sp "admin=true" wcvs -u https://example.com -sp "file:/home/user/Documents/parameters.txt" wcvs -u https://example.com -post -sb "admin=true" wcvs -u https://example.com -post -sb "file:/home/user/Documents/body.txt" wcvs -u https://example.com -post -sb "{}" -ct "application/json" wcvs -u https://example.com -uac ``` ## Generate a JSON Report A JSON report is generated and updated after each scanned URL if the flag `--generatereport/-gr` is set. The report is written, just like a log file, into the same directory WCVS is executed from. In order to change the directory for all output files use `--generatepath/-gp`. If HTML special chars shall be encoded in the report, use `--escapejson/-ej`. ### Examples: ```auto wcvs -u https://example.com -gr wcvs -u https://example.com -gr -ej wcvs -u https://example.com -gr -gp /home/user/Documents wcvs -u https://example.com -gr -gp /home/user/Documents -ej ``` ## Crawl for URLs In order to crawl for URLs, `--recursivity/-r` needs to be set. It specifies how deep the crawler shall go recursion-wise. By default WCVS only crawls for URLs of the same domain. To also crawl for other domains, `--recdomains/red` can be used. To only crawl URLs which inherit a specific string, `--recinclude/-rin` can be used. `--reclimit/-rl` limits how many URLs are crawled for each recursion depth. Also, a list with URLs which shall not be crawled can be specified with `--recexclude/-rex`. `--generatecompleted/-gc` can, for example, be used to generate a list with all already tested URLs. If a scan is repeated, but WCVS shall not crawl and test again the same URLs, this list can be used for `--recexclude/-rex`. ### Examples: ```auto wcvs -u https://example.com -r 5 wcvs -u https://example.com -r 5 -red /home/user/Documents/mydomains.txt wcvs -u https://example.com -r 5 -rl 2 wcvs -u https://example.com -r 5 -rex /home/user/Documents/donttest.txt ``` ## Use a Proxy To use a proxy, a CA certificate of the proxy in PEM format is needed. Burp Suite certificates are provided in DER format, for example. To convert them, the following command can be used: `openssl x509 -inform DER -outform PEM -text -in cacert.der -out cacert.pem`. The path to the certificate can be specified with `--proxycertpath/-ppath`. The default URL for the proxy is `http://127.0.0.1:8080`. In order to change it, use `--proxyurl/-purl`. ### Examples: ```auto wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem wcvs -u https://example.com -ppath /home/user/Documents/cacert.pem -purl http://127.0.0.1:8081 ``` ## Throttle or Accelerate The number of maximum allowed requests per second can be set with `--reqrate/-rr`. By default, this number is unrestricted. Contrary, the number of requests per second can be increased potentially, if `--threads/-t` is used to increase the number of concurrent threads WCVS utilizes. The default value is 20. ### Examples: ```auto wcvs -u https://example.com -rr 10 wcvs -u https://example.com -rr 1 wcvs -u https://example.com -rr 0.5 wcvs -u https://example.com -t 50 ``` ## Further Flags WCVS provides even more than the beforehand mentioned flags and options. `--help/-h` provides a list of each flag, its meaning, and how to use it. ### Example: ```auto wcvs -h ``` ## Background Information A short series of blog posts giving more information about web cache poisoning and WCVS can be found here: 1. [Is Your Application Vulnerable to Web Cache Poisoning?](https://www.hackmanit.de/en/blog-en/142-is-your-application-vulnerable-to-web-cache-poisoning) 2. [Web Cache Vulnerability Scanner (WCVS) - Free, Customizable, Easy-To-Use](https://www.hackmanit.de/en/blog-en/145-web-cache-vulnerability-scanner-wcvs-free-customizable-easy-to-use) ## License WCVS is developed by [Hackmanit](https://hackmanit.de/) and licensed under the [Apache License, Version 2.0](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/blob/master/license.txt). ## GitHub: > **[GitHub - Hackmanit/Web-Cache-Vulnerability-Scanner: Web Cache Vulnerability Scanner is a Go-based CLI...](https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner)** > > Web Cache Vulnerability Scanner is a Go-based CLI tool for testing for web cache poisoning. It is developed by Hackmanit GmbH (http://hackmanit.de/).