web cache deception detect
Follow these steps to install wcDetect:
-
Clone the repository to your local machine:
git clone https://github.com/c0dejump/wcDetect.git
-
Change Directory
cd wcDetect -
Install the required dependencies:
pip install -r requirements.txt
-
Ensure wcDetect is running correctly:
./wcdetect.py -h # OR python3 wcdetect.py -h
usage: wcdetect.py [-h] [-u URL] [-f URL_FILE] [-H CUSTOM_HEADERS] [-p KNOWN_PATH] [-k KEYWORD] [-t THREADS]
[-hu HUMAN] [-ua UA_FORCE]
options:
-h, --help show this help message and exit
-u URL, --url URL URL to test [required]
-f URL_FILE, --file URL_FILE
File of URLs
-r REQUEST_FILE, --request REQUEST_FILE
Load a raw HTTP request from a file (Burp "Copy to file" style).
Extracts the URL (Host + path), method, headers and body.
Scheme defaults to https; use --http to force http.
--http With -r/--request, use http:// instead of the default https://
-H CUSTOM_HEADERS, --header CUSTOM_HEADERS
Add a custom HTTP Header
-p KNOWN_PATH, --path KNOWN_PATH
If you know the path, Ex: -p my-account
-k KEYWORD, --keyword KEYWORD
If a keyword must be present in the poisoned response, Ex: -k codejump
-c, --crawl Auto-crawl mode: discover all pages of the site then run WCD tests on each. When combined with -k, only pages where the keyword is found (body or header) are tested.
--max-pages MAX_PAGES
Maximum number of pages to crawl in auto-crawl mode (default: 100)
-t THREADS, --threads THREADS
Number of concurrent workers for WCD checks (default: 10). Forced to 1 when -hu/--human delay is active.
-hu HUMAN, --human HUMAN
Performs a timesleep to reproduce human behavior (Default: 0s) value: 'r' or 'random'
-ua UA_FORCE, --ua UA_FORCE
If need a specific user-agent (Default: random)
# With multiple headers
» ./wcdetect.py -u https://0a4f00ae0447a9ce801a03a500ea0097.web-security-academy.net/ -H "Cookie: session=OocpsiwqB6XOUkBkBDuqEHUb2BxYEvbC" -H "x-forwarded-host: toto"
# With specific keyword and path
» ./wcdetect.py -u https://0a4f00ae0447a9ce801a03a500ea0097.web-security-academy.net/ -H "Cookie: session=OocpsiwqB6XOUkBkBDuqEHUb2BxYEvbC" -p my-account -k wiener
# From a raw request file (Burp "Copy to file"), reusing its headers/cookies/UA
» ./wcdetect.py -r request.txt -k wiener
- Path traversal confusion
- WCD Formatting (?format, ?query...)
- WCD tracking param (?utm_source...)
- Testing multiple payloads and extensions (modules/payloads.py)
If you want to test the script:
To retrieve the session cookie quickly and easily:
If you want to add payloads or other items
- modules/payloads.py