All DDoS Definitions
DDoS Testing Definition

Cache-Busting Attack

A cache-busting attack works by making every request look unique to a CDN, rather than by hammering the edge with raw volume. It is a Layer 7 attack vector that a thorough DDoS test exercises against the caching layer, and its whole trick is defeating the cache that a CDN relies on to shield the origin. By appending a unique, random query string to every URL, for example ?x=8f3a1c, the attacker guarantees that no two requests match the same cached object.

Cache-busting: unique URL every time, always a miss Attacker GET /p?x=8f3a1c GET /p?x=b7c209 GET /p?x=41de6a unique query string on every request CDN edge cache normal traffic: HIT served from edge, origin idle every busted URL: MISS no cached object matches, forward to origin 100% forwarded Origin server CDN becomes a pass-through full request rate lands here CPU + backend DB saturated Test drives cache-hit ratio toward zero to measure real origin exposure, and checks whether edge rules normalize query strings or rate-limit misses. BlackNeuron™
Cache-busting attack: each request carries a unique random query string, so every one is a CDN cache miss and gets forwarded to the origin instead of served from the edge

Why a unique query string defeats the edge

A CDN absorbs load by answering repeat requests from its edge cache, so the origin only ever sees the first request for a given object. That absorption is entirely a function of the cache-hit ratio. Cache-busting is engineered to drive that ratio to zero: because the cache key includes the query string by default, /logo.png?x=1 and /logo.png?x=2 are two different objects to the cache even though they return identical bytes. Every request is a miss, every miss is forwarded, and the CDN becomes a pass-through that adds latency without removing any origin load.

The traffic is cheap to generate and hard to separate from real users. Each request is individually well-formed and low-rate; what marks it is a population-level statistic, that every URL is unique, which no single request reveals.

Cache-busting: every URL is a cache miss ?x=rand requests CDN edge cache serves repeat objects from memory Normal traffic absorbed here Unique query string on every request: cache miss, forwarded to origin Origin + backend Takes the full request rate The cache is healthy; cache-busting simply never lets it hit BlackNeuron™
Cache-busting attack in motion: the CDN cache stays healthy and absorbs normal traffic, but requests carrying a unique query string are all cache misses and fall straight through to the origin and its backend.

Why it matters under attack

A CDN's headline absorption number assumes a healthy hit ratio, and cache-busting invalidates that assumption without touching the edge's capacity. This is a bypass of the cache rather than of the CDN: the edge stays healthy and the origin drowns, the same shape as origin IP exposure reached by a different route. The origin was sized on the assumption that the edge would carry most of the read load, and that assumption is exactly what the attack removes.

What a DDoS test measures

A test generates cache-busting requests and watches three numbers move together: the cache-hit ratio, the origin request rate, and origin resource saturation. The point is to measure the origin's real exposure once the cache is subtracted, which is the load it would actually take in this attack, not the load a datasheet hit ratio implies.

It then checks whether the edge controls meant for this hold under load: cache-key normalization that ignores unknown query parameters, rules that strip or reject requests carrying junk parameters, and rate limiting keyed on cache misses rather than on total requests. Each is confirmed to actually fire, because a rule that exists in config but never triggers under the attack is not a defense. How edge caching and origin protection interact across providers is worked through in AWS Shield versus Cloudflare.