> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/access-control/multi-step-process-without-access-control.md).
# 无访问控制的多步骤流程
无访问控制的多步骤流程，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 单步缺少访问控制的多步骤流程
实验室提供了一个管理面板，其中有一个用于更改用户角色的多步骤流程。该流程存在一个缺陷：其中一步没有应用访问控制。/ 要进行练习，可以先查看带有 **administrator:admin** 凭据。/ 要解决该实验室，你需要使用 **wiener:peter** 并利用存在漏洞的步骤将你自己的角色提升到管理员级别。
### 流程分析
角色更改发生在两个独立的请求中：
#### **第一步：升级请求**
```bash
username=carlos&action=upgrade
```
使用 wiener 会话时，此请求被拒绝：/ 服务器提示该用户不被允许。
#### **第二步：操作确认**
```bash
action=upgrade&confirmed=true&username=carlos
```
第二阶段不包含 **访问控制**。/ 通过使用 wiener 的会话 cookie 发送此请求：
服务器响应 **OK**，尽管 wiener 本不应拥有必要的权限
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/access-control/multi-step-process-without-access-control.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
