mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
62 lines
2.1 KiB
Markdown
62 lines
2.1 KiB
Markdown
# API Reference: Web Cache Poisoning Attack Agent
|
|
|
|
## Overview
|
|
|
|
Tests web applications for cache poisoning vulnerabilities by identifying CDN infrastructure, testing unkeyed headers for reflection and caching, and checking for cache deception paths.
|
|
|
|
## Dependencies
|
|
|
|
| Package | Version | Purpose |
|
|
|---------|---------|---------|
|
|
| requests | >= 2.28 | HTTP requests with custom headers |
|
|
|
|
## Core Functions
|
|
|
|
### `identify_cache_layer(target_url)`
|
|
Detects caching infrastructure (Cloudflare, Varnish, Akamai, Fastly, CloudFront) from response headers.
|
|
- **Returns**: `dict` with `cdn_detected`, cache headers
|
|
|
|
### `test_cache_hit_miss(target_url)`
|
|
Sends 3 sequential requests with cache buster to observe HIT/MISS progression.
|
|
- **Returns**: `dict` with per-request cache status
|
|
|
|
### `test_unkeyed_headers(target_url)`
|
|
Tests 10 common unkeyed headers (X-Forwarded-Host, X-Original-URL, etc.) for reflection and cache poisoning.
|
|
- **Process**: Send header -> check reflection -> re-request without header -> verify cached poison
|
|
- **Returns**: `list[dict]` with `reflected`, `cached_poison`, `risk`
|
|
|
|
### `test_cache_key_normalization(target_url)`
|
|
Tests cache key handling for extra parameters, fragments, and trailing slashes.
|
|
- **Returns**: `list[dict]` - variation test results
|
|
|
|
### `test_cache_deception(target_url)`
|
|
Tests web cache deception by requesting authenticated pages with static file extensions (.css, .js, .png).
|
|
- **Returns**: `list[dict]` - cached sensitive endpoints
|
|
|
|
### `run_assessment(target_url)`
|
|
Full assessment pipeline with summary statistics.
|
|
|
|
## Unkeyed Headers Tested
|
|
|
|
| Header | Attack Vector |
|
|
|--------|--------------|
|
|
| X-Forwarded-Host | Host override for poisoning links/redirects |
|
|
| X-Forwarded-Scheme | HTTPS downgrade to HTTP |
|
|
| X-Original-URL | Path override (Nginx/IIS) |
|
|
| X-Rewrite-URL | Path override |
|
|
| X-Host | Alternative host injection |
|
|
| X-Forwarded-Port | Port injection |
|
|
|
|
## Risk Levels
|
|
|
|
| Level | Criteria |
|
|
|-------|----------|
|
|
| CRITICAL | Header reflected AND cached (full cache poison) |
|
|
| HIGH | Header reflected but not confirmed cached |
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
python agent.py https://target.example.com
|
|
```
|