> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-token-tied-to-non-session-cookie.md).
# 令牌绑定到 Cookie 但未绑定到会话的 CSRF
### 令牌绑定到非会话 Cookie 的 CSRF
电子邮件更改功能存在 CSRF 漏洞。它使用 chips，但它们并未完全集成到会话机制中。提供的账户： `wiener:peter` 和 `carlos:montoya`.
### 关键思路
* 有一个 `csrfKey` cookie 和一个 `CSRF` 用于更改电子邮件的查询参数。两个值是“同步”的，但 **与会话无关**.
* 通过复制这对（`csrfKey`, `CSRF`）从一个账户到另一个账户，可以更改某个受害者的电子邮件 **而无需** 使其与对应会话关联。
* 搜索字段会将上一次搜索保存在会话 cookie 中（`最后搜索词`).
#### 技术（通过研究进行 CRLF 注入）
* 可以 **注入头部** ，通过搜索强制浏览器设置任意 cookie。
像这样的简单字符串 `hello csrfKey=aZCI...` 不会被解释。
```
hello csrfKey=aZCI65XauInHYlpP2MXHzMAssSvvyn74
```
另一方面，使用 **回车 + 换行** (`/r` = `%0d`, `/n` = `%0a`):
```
man ascii
```
工作示例：
```
hello%0d%0aSet-Cookie:%20csrfKey=a
```
→ 被解释为一个 **Set-Cookie** 在响应端。
对于跨站上下文，请指定 `SameSite=none` 以便 cookie 在利用时随后的下一次请求中被携带。
示例（在地址/搜索请求栏中）：
{% code overflow="wrap" %}
```
hello%0d%0aSet-Cookie:%20csrfKey%3dGI0PraUBw0m976F6vn51dbYYzh6EtwvZ%3b%20SameSite%3dnone
hello
Set-Cookie: csrfKey=GI0PraUBw0m976F6vn51dbYYzh6EtwvZ; SameSite=none
```
{% endcode %}
### 托管操作员
1. **强制** 该 `csrfKey` 通过向搜索页面发送图像请求，在受害者中设置 cookie（该页面会重写头部）：
```html
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-token-tied-to-non-session-cookie.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.