{"id":37097054,"url":"https://github.com/ayuxsec/cachex","last_synced_at":"2026-01-14T11:56:18.933Z","repository":{"id":329036415,"uuid":"1117527595","full_name":"ayuxsec/cachex","owner":"ayuxsec","description":"A high-accuracy, behavioral cache poisoning scanner for modern Web APIs ","archived":false,"fork":false,"pushed_at":"2025-12-20T13:46:21.000Z","size":9076,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2025-12-20T13:58:13.942Z","etag":null,"topics":["bugbounty","cache-poisoning","hacking","security-tools"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ayuxsec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-12-16T12:45:46.000Z","updated_at":"2025-12-20T13:46:25.000Z","dependencies_parsed_at":"2025-12-20T14:01:32.662Z","dependency_job_id":null,"html_url":"https://github.com/ayuxsec/cachex","commit_stats":null,"previous_names":["ayuxsec/cachex"],"tags_count":9,"template":false,"template_full_name":null,"purl":"pkg:github/ayuxsec/cachex","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ayuxsec%2Fcachex","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ayuxsec%2Fcachex/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ayuxsec%2Fcachex/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ayuxsec%2Fcachex/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ayuxsec","download_url":"https://codeload.github.com/ayuxsec/cachex/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ayuxsec%2Fcachex/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28419272,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-14T10:47:48.104Z","status":"ssl_error","status_checked_at":"2026-01-14T10:46:19.031Z","response_time":107,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.6:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["bugbounty","cache-poisoning","hacking","security-tools"],"created_at":"2026-01-14T11:56:18.201Z","updated_at":"2026-01-14T11:56:18.925Z","avatar_url":"https://github.com/ayuxsec.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003e\r\n  \u003cimg src=\"images/cachex-logo.png\" alt=\"cachex\" width=\"100px\"\u003e\r\n  \u003cbr\u003e\r\n\u003c/h1\u003e\r\n\r\n\u003ch3 align=\"center\"\u003eA high-accuracy, behavioral cache poisoning scanner for modern Web APIs\u003c/h3\u003e\r\n\r\n\u003cp align=\"center\"\u003e\r\n  \u003cimg src=\"https://img.shields.io/badge/cacheX-blueviolet?style=flat-square\"\u003e\r\n  \u003cimg src=\"https://img.shields.io/github/go-mod/go-version/ayuxsec/cachex?style=flat-square\"\u003e\r\n  \u003cimg src=\"https://img.shields.io/github/license/ayuxsec/cachex?style=flat-square\"\u003e\r\n\u003c/p\u003e\r\n\r\n\r\n## 🌟 Why CacheX?\r\n\r\nMost cache poisoning scanners only check:\r\n\r\n* whether a response changes with certain headers\r\n* or whether cache-related headers exist\r\n\r\nThis produces **tons of false positives** and rarely confirms a real exploit.\r\n\r\n**CacheX is different.**\r\n\r\nIt performs **behavioral diffing**, **multi-threaded poisoning**, and **persistence verification**, confirming only real, weaponizable cache poisoning.\r\n\r\n[![demo](https://asciinema.org/a/0t6ga94iTdGmMuCP99KQsAZDs.svg)](https://asciinema.org/a/0t6ga94iTdGmMuCP99KQsAZDs)\r\n\r\n## 🔥 Features\r\n\r\n* ⚡ **High-speed multi-threaded scanning**\r\n* 🎯 **Zero-FP design with behavioral diffing**\r\n* 🔁 **Real-time cache poisoning attempts**\r\n* 🧪 **Persistence confirmation for true vulnerabilities**\r\n* 🔍 **Single and multi-header scan modes**\r\n* 🧩 **YAML-based payload configuration**\r\n* 📤 **JSON or pretty output formats**\r\n* 📁 **Optional file-based export**\r\n* 🏷 **Tentative vs confirmed vuln tagging**\r\n\r\n## 🔧 Installation\r\n\r\n```bash\r\ngo install github.com/ayuxsec/cachex/cmd/cachex@latest\r\n```\r\n\r\nOr build manually:\r\n\r\n```bash\r\ngit clone --depth=1 https://github.com/ayuxsec/cachex\r\ncd cachex\r\ngo build -o cachex \"cmd/cachex/main.go\"\r\n./cachex -h\r\n```\r\n\r\n## 🚀 Usage\r\n\r\n### ▶️ Scan a single URL\r\n\r\n```bash\r\ncachex -u https://example.com\r\n```\r\n\r\n### ▶️ Scan multiple targets\r\n\r\n```bash\r\ncachex -l urls.txt\r\n```\r\n\r\n### ▶️ Scan URLs via pipeline\r\n\r\n```bash\r\necho \"https://example.com\" | cachex\r\n```\r\n\r\nor:\r\n\r\n```bash\r\ncat urls.txt | cachex\r\n```\r\n\r\n---\r\n\r\n## 📌 All CLI Flags\r\n\r\n| Category          | Flag              | Description                 |\r\n| ----------------- | ----------------- | --------------------------- |\r\n| Input             | `-u, --url`       | URL to scan                 |\r\n|                   | `-l, --list`      | File with list of URLs      |\r\n| Concurrency       | `-t, --threads`   | Number of scanning threads  |\r\n|                   | `-m, --scan-mode` | `single` or `multi`         |\r\n| HTTP Client       | `--timeout`       | Total request timeout       |\r\n|                   | `--proxy`         | Proxy URL                   |\r\n| Persistence Check | `--no-chk-prst`   | Disable persistence checker |\r\n|                   | `--prst-requests` | Poisoning requests          |\r\n|                   | `--prst-threads`  | Threads for poisoning       |\r\n| Output            | `-o, --output`    | Output file                 |\r\n|                   | `-j, --json`      | JSON output                 |\r\n| Payloads          | `--pcf`           | Custom payload config file  |\r\n\r\n\r\n## 💡 Example\r\n\r\n```bash\r\ncachex -l targets.txt -t 50 --pcf payloads.yaml --json -o results.json\r\n```\r\n\r\n## ⚙️ Configuration\r\n\r\nCacheX automatically loads:\r\n\r\n```\r\n~/.config/cachex/config.yaml\r\n~/.config/cachex/payloads.yaml\r\n```\r\n\r\nYou can configure:\r\n\r\n* Payload headers\r\n* Default request headers\r\n* Timeouts \u0026 concurrency\r\n* Logging mode\r\n* Proxy settings\r\n* Persistence checker behavior\r\n\r\n## 📝 Output Formats\r\n\r\n### Pretty Output\r\n\r\n```\r\n[vuln] [https://target.com] [Location Poisoning] [header: X-Forwarded-Host: evil.com] [poc: https://target.com?cache=XYZ]\r\n```\r\n\r\n### JSON Output\r\n\r\n```json\r\n{\r\n  \"URL\": \"https://target.com/\",\r\n  \"IsVulnerable\": true,\r\n  \"IsResponseManipulable\": true,\r\n  \"ManipulationType\": \"ChangedBody\",\r\n  \"RequestHeaders\": {\r\n    \"Accept\": \"*/*\",\r\n    \"User-Agent\": \"Mozilla/5.0\"\r\n  },\r\n  \"PayloadHeaders\": {\r\n    \"X-Forwarded-Host\": \"evil.com\"\r\n  },\r\n  \"OriginalResponse\": {\r\n    \"StatusCode\": 200,\r\n    \"Headers\": {\r\n      \"...\": \"...\"\r\n    },\r\n    \"Body\": \"...\",\r\n    \"Location\": \"\"\r\n  },\r\n  \"ModifiedResponse\": {\r\n    \"StatusCode\": 200,\r\n    \"Headers\": {\r\n      \"...\": \"...\"\r\n    },\r\n    \"Body\": \"...\",\r\n    \"Location\": \"\"\r\n  },\r\n  \"PersistenceCheckResult\": {\r\n    \"IsPersistent\": true,\r\n    \"PoCLink\": \"https://target.example.com/?cache=XYZ\",\r\n    \"FinalResponse\": {\r\n      \"StatusCode\": 200,\r\n      \"Headers\": {\r\n        \"...\": \"...\"\r\n      },\r\n      \"Body\": \"...\",\r\n      \"Location\": \"\"\r\n    }\r\n  }\r\n}\r\n```\r\n\r\n## 🎛 Scan Modes\r\n\r\n* `single`: precise, tests each header independently\r\n* `multi`: fast, tests all payload headers together\r\n\r\n## 🧩 Payload Headers\r\n\r\nDefined in:\r\n\r\n```\r\n~/.config/cachex/payloads.yaml\r\n```\r\n\r\nExample:\r\n\r\n```yaml\r\npayload_headers:\r\n    X-Forwarded-Host: evil.com\r\n    X-Forwarded-For: 127.0.0.1\r\n    X-Original-URL: /evilpath\r\n    X-Client-IP: 127.0.0.1\r\n```\r\n\r\n## 📁 Configuration File Example (`config.yaml`)\r\n\r\n```yaml\r\nscan_mode: single\r\nthreads: 25\r\n\r\nrequest_headers:\r\n  Accept: '*/*'\r\n  User-Agent: Mozilla/5.0 (...)\r\n\r\nclient:\r\n  dial_timeout: 5\r\n  handshake_timeout: 5\r\n  response_timeout: 10\r\n  proxy_url: \"\"\r\n\r\npersistence_checker:\r\n  enabled: true\r\n  num_requests_to_send: 10\r\n  threads: 5\r\n\r\nlogger:\r\n  log_error: false\r\n  log_mode: pretty\r\n  debug: false\r\n  output_file: \"\"\r\n  skip_tentative: true\r\n```\r\n\r\n## 🧠 How CacheX Works\r\n\r\n1. Fetches baseline response\r\n2. Injects payload headers\r\n3. Detects response manipulation (body, code, redirect)\r\n4. If changed → launches concurrent poisoning attempts\r\n5. Fetches clean requests\r\n6. If poisoned response persists → confirmed vulnerability\r\n7. Outputs PoC link\r\n\r\n## 📁 Project Structure\r\n\r\n```console\r\ncachex/\r\n├── cmd/\r\n│   └── cachex/\r\n│       └── main.go                # CLI entrypoint\r\n│\r\n├── internal/\r\n│   ├── app/\r\n│   │   └── cachex/\r\n│   │       └── cmd/\r\n│   │           ├── banner.go      # ASCII banner\r\n│   │           ├── flags.go       # CLI flags + config binding\r\n│   │           ├── helper.go      # Help message builder\r\n│           ├── root.go        # Main CLI logic \u0026 runner\r\n│           └── utils.go           # File helpers\r\n│\r\n│   ├── pkg/\r\n│   │   ├── client/\r\n│   │   │   ├── client.go          # Custom HTTP client \u0026 transport\r\n│   │   │   └── request.go         # Fetch + send raw requests\r\n│   │   ├── config/\r\n│   │   │   └── config.go          # Legacy internal config\r\n│   │   └── logger/\r\n│   │       ├── colors.go          # Color themes\r\n│   │       └── logger.go          # Pretty logger (info/warn/debug/vuln)\r\n│\r\n│   └── scanner/\r\n│       ├── core.go                # Core poisoning test logic\r\n│       ├── detector.go            # Behavioral response diffing\r\n│       ├── logger.go              # Pretty + JSON output formatter\r\n│       ├── output.go              # JSON serialization helpers\r\n│       ├── persistchk.go          # Persistence checker (real-time poisoning)\r\n│       ├── scanner.go             # Scan controller (single/multi mode)\r\n│       ├── types.go               # All scanner structs \u0026 enums\r\n│       └── utils.go               # Cache buster, merging maps, helpers\r\n│\r\n├── pkg/\r\n│   └── cachex/\r\n│       ├── scanner.go             # Public API wrapper for internal scanner\r\n│       ├── utils.go               # Config mappers (log mode, scan mode)\r\n│       └── validate.go            # Config validation\r\n│\r\n│   └── config/\r\n│       ├── config.go              # YAML config schema\r\n│       ├── default.go             # Default paths + default config\r\n│       └── payloads.go            # Default payload headers\r\n│\r\n├── .github/workflows/\r\n│   └── release.yml                # Automated builds via GoReleaser\r\n│\r\n├── images/\r\n│   ├── cachex-logo.png            # Logo\r\n│   └── cachex-demo.gif            # Showcase GIF\r\n│\r\n├── .goreleaser.yaml               # Multi-platform binary releases\r\n├── .gitignore\r\n├── go.mod\r\n├── go.sum\r\n├── LICENSE\r\n└── Makefile                       # Build / install helpers\r\n```\r\n\r\n## 🤝 Contribute\r\n\r\nSure, PRs are welcome!\r\n\r\n## 📜 License\r\n\r\nMIT © [@ayuxsec](https://github.com/ayuxsec)\r\n\r\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fayuxsec%2Fcachex","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fayuxsec%2Fcachex","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fayuxsec%2Fcachex/lists"}