web-cache-vulnerability-scanner

wcvs automates the detection of web cache vulnerabilities by sending crafted HTTP requests with injected headers and parameters that should not be part of the cache key. If a poisoned response is cached and served to subsequent requests, the cache is considered vulnerable. It supports testing for both cache poisoning (attacker injects malicious content into cached responses) and cache deception (sensitive responses are incorrectly cached). The tool integrates with Burp Suite and supports custom header injection wordlists.

wcvs sends a baseline request to establish a cache hit fingerprint, then injects candidate headers and query parameters one at a time. If an injected value appears in the response and the subsequent cache-hit request also reflects it, the parameter or header is flagged as a cache oracle. The tool then confirms exploitability by checking whether the poisoned entry is served to a clean request. Results are categorised by severity and technique.