> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/business-logic/failed-state-machine-workaround.md).

# 失败的状态机绕过方案

### 通过有缺陷的状态机绕过身份验证

本实验基于对身份验证过程中步骤顺序的错误假设。通过利用这个设计不良的状态机，可以绕过身份验证，访问管理界面并删除用户 **carlos**.

提供的标识符：

* **用户：** wiener
* **密码：** peter

**主要观察**

连接流程被分成若干连续步骤，其中包括一个中间角色选择步骤。

应用程序假定所有步骤都按顺序执行，并且在进入下一步之前，每个请求都已正确验证。

**操作步骤**

1. 使用有效 `wiener:peter` 凭据连接。
2. 登录后，应用程序会提供一个 **角色选择**.

<figure><img src="/files/79355e6057920d489fbde4278377c55265d2d42f" alt=""><figcaption></figcaption></figure>

* 点击前进以继续。
* 在发送 GET 请求到 **角色选择器**时，拦截该请求。

<figure><img src="/files/bf748a6a87af516f96e3b7d330b18152666ade4b" alt=""><figcaption></figcaption></figure>

**不要让请求继续**：阻止或删除它（drop）。

* 正是在这个阶段进行角色验证。

<figure><img src="/files/c4183003aa04cc915ac2cbefdbd5e063b925ba9d" alt=""><figcaption></figcaption></figure>

在没有此验证的情况下继续流程。

**结果**

应用程序错误地认为所有步骤都已正确验证。/ 用户可直接访问 \*\*管理面板\*\*，而无需选择或验证合法角色。

然后就可以删除用户 **carlos** 并完成实验。

<figure><img src="/files/241085787ab12b633bb31dce7bfa6427f83c47c6" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/business-logic/failed-state-machine-workaround.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.