mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00

Consolidate 22 sibling repos into layered organism structure

Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c

2026-06-10 06:53:01 +00:00

2.1 KiB

Raw Blame History

API Reference: Web Cache Poisoning Attack Agent

Overview

Tests web applications for cache poisoning vulnerabilities by identifying CDN infrastructure, testing unkeyed headers for reflection and caching, and checking for cache deception paths.

Dependencies

Package	Version	Purpose
requests	>= 2.28	HTTP requests with custom headers

Core Functions

`identify_cache_layer(target_url)`

Detects caching infrastructure (Cloudflare, Varnish, Akamai, Fastly, CloudFront) from response headers.

Returns: dict with cdn_detected, cache headers

`test_cache_hit_miss(target_url)`

Sends 3 sequential requests with cache buster to observe HIT/MISS progression.

Returns: dict with per-request cache status

`test_unkeyed_headers(target_url)`

Tests 10 common unkeyed headers (X-Forwarded-Host, X-Original-URL, etc.) for reflection and cache poisoning.

Process: Send header -> check reflection -> re-request without header -> verify cached poison
Returns: list[dict] with reflected, cached_poison, risk

`test_cache_key_normalization(target_url)`

Tests cache key handling for extra parameters, fragments, and trailing slashes.

Returns: list[dict] - variation test results

`test_cache_deception(target_url)`

Tests web cache deception by requesting authenticated pages with static file extensions (.css, .js, .png).

Returns: list[dict] - cached sensitive endpoints

`run_assessment(target_url)`

Full assessment pipeline with summary statistics.

Unkeyed Headers Tested

Header	Attack Vector
X-Forwarded-Host	Host override for poisoning links/redirects
X-Forwarded-Scheme	HTTPS downgrade to HTTP
X-Original-URL	Path override (Nginx/IIS)
X-Rewrite-URL	Path override
X-Host	Alternative host injection
X-Forwarded-Port	Port injection

Risk Levels

Level	Criteria
CRITICAL	Header reflected AND cached (full cache poison)
HIGH	Header reflected but not confirmed cached

Usage

python agent.py https://target.example.com

2.1 KiB Raw Blame History