hello amazing hackers :-) Most hunters skip cache bugs. They see cache poisoning and think too complicated, not for me, and move on to the next IDOR. Mistake - one poisoned response can hit EVERY visitor to a page, not just your own session. No auth needed, no social engineering, just a header nobody thought to key the cache on. Here's the do-this-today version: 1. Confirm there IS a cache. curl -i the target twice, diff the headers. Look for X-Cache, CF-Cache-Status, Age, Cache-Control: s-maxage. Age going up between requests means you're talking to a cache, not the app. 2. Hunt unkeyed inputs - headers or params that change the RESPONSE but are NOT part of the cache KEY, so your input gets baked into a page that then gets served to everyone else. Classic candidates: X-Forwarded-Host, X-Forwarded-Scheme, X-Original-URL, User-Agent. Don't guess by hand, Param Miner (Burp extension) automates it: portswigger.net/bappstore/17… 3. Poison it. Find where that unkeyed input gets reflected (canonical link tag, redirect, JS include), inject your own host, add a cache-buster query param so you're not hitting real users while testing, confirm the poisoned response gets cached. 4. Prove it's shared, not just you. Open an incognito window, drop the cache-buster, hit the exact same URL with none of your headers. If your host is still sitting in that canonical tag or redirect, that's a live poison hitting real visitors right now. 5. Deception is the sneaky cousin - append a fake static extension to a PRIVATE endpoint like /account/settings/x.css. Some cache layers cache by extension even though the response underneath is someone's authenticated data. Log out, request that exact crafted URL again. Get the victim's data back and that's cache deception, brutal in reports because it needs zero victim interaction. 6. Report on IMPACT, not existence. Screenshot the cache HIT/Age headers, show before vs after, spell out the blast radius - every visitor to this URL for the next N seconds gets this. That sentence turns a won't-fix into a real payout. Go run this on a target this week. Practice for free first at labs.hackxpert.com/ before touching a live program. Want the full methodology behind bugs like this - recon, cache tricks, business logic, structured start to finish? That's basically 912 Uncle Rat's Pentesting Paradise. a discount applies via the link: thexssrat.podia.com/912-uncl… PoC || GTFO :-)