> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/business-logic/bypassing-access-controls-by-inconsistent-parsing-of-email-addresses.md). # 通过对电子邮件地址的不一致解析绕过访问控制通过对电子邮件地址的不一致解析绕过访问控制，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修 ### 利用电子邮件地址解析差异绕过访问控制 #### 实验描述本实验实现了电子邮件地址验证，以防止使用未授权域进行注册。 / 但是，应用端的验证逻辑与实际用于解析电子邮件地址的库之间存在不一致。利用这种解析差异，可以在绕过授权域限制的同时使用外部电子邮件地址注册，然后访问管理员功能并删除用户 **carlos**.

#### 注册限制当尝试使用如下经典地址注册时： ``` test@jord4n.pro ``` 应用程序拒绝注册，并提示只有属于以下域的地址才被允许： ``` ginandjuice.shop ```

使用该域进行合法注册后会触发一封确认邮件： ``` 请检查您的邮箱以获取账户注册链接 ```

因此，需要收到这封邮件才能完成注册。 #### 漏洞来源

该缺陷基于使用了一个 **编码字** （RFC 2047），其格式如下： ```bash =????= ``` 该机制允许对电子邮件地址的某些部分进行编码。应用程序的验证器会拒绝某些编码，而最终的邮件解析器却能正确解释它们。 #### 初始阻止一个使用 UTF-8（quoted-printable）的简单编码尝试被 WAF 阻止： ```bash =?utf-8?q?=61=62=63?=@ginandjuice.shop ``` 答案 ```bash 出于安全原因，注册已被阻止 ```

#### 绕过技巧为了绕过该过滤， **使用 Base64 的 UTF-7 编码** 被使用。原理： * 将一个字符编码为 UTF-16

* 将此结果转换为 Base64

* 在 UTF-7 编码字中使用字符编码示例 `一个`: * UTF-16 → Base64： `AGE=` 最小可用负载： ```bash =?utf-7?&AGE-=?=@ginandjuice.shop ``` 该值会被验证逻辑接受。

#### 使用受控地址的完整操作攻击者地址： ```bash attacker@exploit-0ad8006c04c7300d8050fcb8013600a0.exploit-server.net ``` 负载构造： * `&AEA-` 表示 `@` * `&ACA-` 表示一个空格，从而避免对最终域进行严格解释

注册时使用的最终负载：

=?utf-7?q?jordan&AEA-exploit-0ad8006c04c7300d8050fcb8013600a0.exploit-server.net&ACA-?=@ginandjuice.shop

邮件服务器实际解析的地址： ```bash jordan@exploit-0ad8006c04c7300d8050fcb8013600a0.exploit-server.net @ginandjuice.shop ```

#### 结果 * 应用程序会验证该地址，因为它以 `@ginandjuice.shop`

* 邮件服务器将邮件发送到攻击者控制的地址 * 已收到确认链接 * 注册成功完成 * 已获得对应用程序的访问权限 * 可以执行管理操作，包括删除用户 **carlos**

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/web/business-logic/bypassing-access-controls-by-inconsistent-parsing-of-email-addresses.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.