Web Cache Deception Scanner
Summary: PortSwigger's BApp Store lists a Burp extension, version 1.1, that tests applications for the Web Cache Deception vulnerability by adding a new Active Scanner check and a context menu item for targeted testing. The extension, authored by Johan Snyman of Trustwave and last updated 23 November 2017, traces the attack vector to researcher Omer Gil, who unveiled Web Cache Deception in February 2017 as a simple-to-execute attack that depends on a very specific set of circumstances to make an application vulnerable.
What you should know: Web Cache Deception has been a known attack vector since Omer Gil described it in February 2017, yet this scanner extension was last updated in November 2017 - a security leader should ask whether the tooling watching for it has kept pace with the applications it now protects.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026