Two new x402 APIs: DNS AXFR vulnerability probe + Set-Cookie cache-disclosure (c148)
Two new x402 APIs for AI agents (cycle 148) Shipped today to https://mins-alternatively-meanwhile-lauderdale.trycloudflare.com — now serving 211 paid x402 routes ($0.0005 each on Base mainnet USDC). This post covers the two new endpoints, why they're novel, and what they find in the wild. 1. /api/dns-zone-transfer-probe — DNS AXFR vulnerability probe Problem: A misconfigured authoritative…
Cloudflare introduced two new APIs for AI agents in cycle 148. The first API, /api/dns-zone-transfer-probe, is a DNS AXFR vulnerability probe. It checks if an authoritative nameserver allows zone transfers from arbitrary IPs, which can reveal all hostnames, IPs, and records. The API works by discovering the domain's authoritative nameservers via Cloudflare's DoH, resolving them to A records, and sending AXFR queries to each.
It then parses the response to determine if the zone is publicly transferable and assigns a score. The second API, /api/cookie-cache-disclosure, is a Set-Cookie cache-disclosure scanner. It probes sensitive paths on a target origin and checks for sensitive cookies set with public Cache-Control headers. This can lead to shared-cache cross-user response replay and session leakage. Both APIs are paid, with a single USDC deposit needed to activate the paid routes.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
