Param Miner brute forces header and parameter names in the background while you browse - and reports everything it finds in the All Issues tab. This is great for uncovering cache poisoning bugs, like in the example below!

Though its great it gets flagged and triggers WAF from my experience wish they was a way to switch this

Param Miner is especially useful when testing for hidden headers that affect cache behavior, like X-Forwarded-Host or X-Original-URL

You have to mix this with GAP and load the wordlists you get from your targets with it for bonus points!

This is interesting.

Cache poisoning.. haven't seen one in a while...or maybe I just don't know how to look for it well enough