> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/access-control/bypassing-access-control-based-on-http-method.md).

# 基于 HTTP 方法绕过访问控制

### 基于方法的访问控制可以被绕过

在这个实验中，访问控制部分取决于所使用的 HTTP 方法。使用 *administrator:admin* 凭证登录后，可以自由查看管理面板。

目标是使用 *wiener:peter* 凭证登录，并利用控制实现上的错误将角色设为管理员。

<figure><img src="/files/3a469fe452da3852e6d82fdc3cf0b262154e1279" alt=""><figcaption></figcaption></figure>

以管理员身份登录后，我们发现了提升或降低用户权限的界面。/ 通过拦截修改时发送的请求：

```http
POST /admin-roles
username=carlos&action=upgrade
```

此操作在以 **POST**.

然而，当尝试使用 wiener 会话复现该请求时，应用程序返回一条拒绝访问消息。

<figure><img src="/files/eb0e5bdcf19df0014fafda6526e3144ae34179f7" alt=""><figcaption></figcaption></figure>

然而，如果将 POST 方法替换为 **GET**，控制失效：

```http
GET /admin-roles?username=wiener&action=upgrade
```

该请求通过并返回一个 **200 OK**，这使得可以将 wiener 的权限提升到管理员级别。

<figure><img src="/files/e51ded7b7f5be259956502fd91978394495b427b" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/access-control/bypassing-access-control-based-on-http-method.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.