> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/business-logic/bypassing-flawed-state-machine.md).

# 通过有缺陷的状态机绕过

### 通过有缺陷的状态机绕过身份验证

该实验基于对身份验证流程步骤顺序的错误假设。利用这个设计不佳的状态机，可以绕过身份验证、访问管理界面并删除用户 **carlos**.

提供的标识符：

* **用户：** wiener
* **密码：** peter

**主要观察**

连接流程被分成几个连续步骤，其中包括一个中间的角色选择步骤。

应用程序假定所有步骤都会按顺序执行，并且在进入下一步之前，每个请求都已被正确验证。

**操作阶段**

1. 使用有效凭据连接 `wiener:peter` 凭据。
2. 登录后，应用程序会提供一个步骤 **角色选择**.

<figure><img src="/files/79355e6057920d489fbde4278377c55265d2d42f" alt=""><figcaption></figcaption></figure>

* 点击前进以继续。
* 在对 **角色选择器**发起 GET 请求时，拦截该请求。

<figure><img src="/files/bf748a6a87af516f96e3b7d330b18152666ade4b" alt=""><figcaption></figcaption></figure>

**不要让该请求通过**：阻止或删除它（drop）。

* 角色验证就是在这个阶段进行的。

<figure><img src="/files/c4183003aa04cc915ac2cbefdbd5e063b925ba9d" alt=""><figcaption></figcaption></figure>

在没有进行此验证的情况下继续流程。

**结果**

应用程序错误地认为所有步骤都已正确验证。/ 用户直接访问 \*\* 管理面板\*\*，而没有选择或验证合法角色。

从那里可以删除用户 **carlos** 并完成实验。

<figure><img src="/files/241085787ab12b633bb31dce7bfa6427f83c47c6" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/business-logic/bypassing-flawed-state-machine.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.