> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/url-normalization.md).

# URL 规范化

### URL 标准化

本实验包含一个 **XSS** 一个无法直接利用的漏洞，因为浏览器会自动应用 **dURL** 编码。/ 因此， **缓存 URL 标准化过程** 必须用于利用此漏洞。

目标是注入一个会运行的载荷 `alert(1)` 到受害者的浏览器中，然后向其提供恶意 URL。

<figure><img src="/files/cee221037bd2ade9cf5ca2848cb7858b54a2bc7e" alt=""><figcaption></figcaption></figure>

#### 1）注入点识别

当你访问一个不存在的页面时（例如 `/test`），网站会返回一个 **错误页面** 在 HTML 响应中重复使用所请求的路径。

如果一个 HTML 标签被闭合并注入脚本，它会被解释为：

```javascript
/test</p><script>alert(1)</script>
```

<figure><img src="/files/df8991ddae5135eba7646bdfc7802358832e1078" alt=""><figcaption></figcaption></figure>

#### 2）遇到的问题

如果直接在浏览器中输入此 URL，载荷 **n 不会执行**。/ 原因是浏览器 **会自动编码** 特殊字符（`<`, `>`, `/`，等等），从而阻止脚本执行。

<figure><img src="/files/0b7ffd794778230f8ea10f96ccffa94a9670ec77" alt=""><figcaption></figcaption></figure>

#### 3）通过缓存标准化进行操作

为了绕过这种保护， **缓存** 会使用：

* 恶意请求通过 **Burp Suite**，而不经过浏览器地址栏发送。
* 缓存 **标准化** URL，并存储相关响应。
* 缓存的响应随后包含载荷 **未编码的**.

#### （4）触发 XSS

一旦响应被污染到缓存中：

* 将该 URL 提供给受害者。
* 缓存返回页面的标准版本。
* 脚本被解释并 `alert(1)` 在受害者的浏览器中运行。

<figure><img src="/files/0f90efe9462732a408075b0b9e4f54e07a372e83" alt="" width="507"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/cache-poisoning/url-normalization.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.