https://cybertoolchain.io/tools/web-cache-vulnerability-scanner New releases and features in web-cache-vulnerability-scanner, tracked by The Cyber Toolchain. en Sun, 24 Aug 2025 14:13:35 GMT https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/2.0.0 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/2.0.0 Sun, 24 Aug 2025 14:13:35 GMT WCVS 2.0 rewrites HTTP client with fasthttp, adds NextJS DoS techniques, new cache indicators, and RFC-violating request support. • Replaces `net/http` with `fasthttp`, enabling RFC-violating requests that can surface web cache poisoning vulnerabilities previously unreachable. • Adds cache indicator support for `eo-cache-status`, Netlify, `x-kinsta-cache`, and `x-ac` headers, broadening cache-hit detection coverage. • Introduces a new parameter encoding technique for detecting cache poisoning via unkeyed parameters. • Adds status code analysis as an indicator for identifying impactful or unkeyed parameters. • Expands UTM parameter list with `gad_campaignid` for broader parameter fuzzing. • Adds multiple new cache-based DoS testing techniques, including NextJS-specific methods. • Adds enhanced DoS headers with metacharacters and streamlines Host Header Override (HHO) DoS testing. • Supports setting multiple host headers for host header poisoning tests. • Introduces `X-Original-URL` redirect-based testing method. • Adds support for testing with non-RFC-compliant headers. • New flag for selecting specific reason types to target during testing. • Adds rate limiting (limiter) for deception testing. • Defaults logging to off, reducing noise unless explicitly enabled. • Limits CSS poisoning checks to HTTP 200 responses to reduce false positives. • Enhances reporting with reflection context, counts for body and header reflections, and improved file naming. Breaking changes: • Logging is now off by default; setups relying on automatic log generation will no longer produce logs without explicitly overriding this setting. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/web-cache-vulnerability-scanner https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.4.0 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.4.0 Thu, 17 Apr 2025 15:55:07 GMT WCVS 1.4.0 adds parameter pollution detection, hardcoded default wordlists, and new `--skipwordlistcachbuster` / `--nolog` flags. • Adds parameter pollution as a new web-cache poisoning detection technique. • Hardcodes default parameter and header wordlists into the binary — no `--wordlist` flag required for standard scans. • New `--skipwordlistcachbuster` flag skips wordlist-based cachebuster discovery, useful when you already know the cachebuster parameter. • New `--nolog` flag suppresses log-file creation for cleaner CI or ephemeral-environment runs. • Cachebuster values now carry a `cb` prefix and poison values a `p` prefix, making the two easier to distinguish in output — especially when the cachebuster parameter is itself vulnerable to parameter pollution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/web-cache-vulnerability-scanner https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.3.0 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.3.0 Wed, 06 Nov 2024 13:15:00 GMT WCVS 1.3.0 adds new web cache deception techniques, a time-based detection skip flag, and Kali Linux repo availability. • Adds multiple new detection techniques for web cache deception vulnerabilities. • Now checks for web cache deception even when no cache indicator is spotted beforehand, expanding coverage. • New `-skiptimebased`/`--stime` flag disables time-based cache guessing to reduce false positives and unnecessary test runs. • WCVS is now available natively in the Kali Linux (and BlackArch) package repository. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/web-cache-vulnerability-scanner https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.2.1 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.2.1 Wed, 20 Mar 2024 08:17:24 GMT Adds `--ignorestatus` / `-is` flag to WCVS to ignore specific HTTP response codes and reduce false positives. • Adds the `--ignorestatus` (`-is`) flag to allow ignoring specific HTTP status codes during scanning. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/web-cache-vulnerability-scanner https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.2.0 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.2.0 Fri, 09 Feb 2024 14:00:35 GMT Web Cache-Vulnerability-Scanner 1.2.0 adds Web Cache Deception detection with support for additional cache headers • Adds `Web Cache Deception` detection capability to the scanner Full history on Cyber Toolchain: https://cybertoolchain.io/tools/web-cache-vulnerability-scanner https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.1.1 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.1.1 Wed, 06 Dec 2023 10:46:10 GMT web-cache-vulnerability-scanner v1.1.1 adds automatic curl command generation for identified cache poisoning attacks • Converts identified web cache poisoning requests to a `curl` command printed to stdout and included in the report. • Adds custom cache header example to README Full history on Cyber Toolchain: https://cybertoolchain.io/tools/web-cache-vulnerability-scanner https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.0.1 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.0.1 Thu, 13 Jan 2022 11:52:41 GMT Adds docker install option and new DOS detection variants to web-cache-vulnerability-scanner • added install option 3 - docker • added new DOS variant: X-Forward-Scheme • added new DOS variant: Set User-Agent to a probable blacklisted security scanner Full history on Cyber Toolchain: https://cybertoolchain.io/tools/web-cache-vulnerability-scanner https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.0.0 https://github.com/Hackmanit/Web-Cache-Vulnerability-Scanner/releases/tag/1.0.0 Wed, 27 Oct 2021 09:18:45 GMT Adds `--time-diff` flag to configure the time difference between cache hits and misses • Added `--time-diff` CLI argument to configure the time difference between cache hits and misses Full history on Cyber Toolchain: https://cybertoolchain.io/tools/web-cache-vulnerability-scanner