> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-token-tied-to-non-session-cookie.md).
# 令牌绑定 Cookie 但未绑定会话的 CSRF
令牌绑定 Cookie 但未绑定会话的 CSRF 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复 contex
### 令牌绑定到非会话 Cookie 的 CSRF
更改电子邮件功能存在 CSRF 漏洞。它使用 chips，但它们并未完全集成到会话机制中。提供的账户： `wiener:peter` 和 `carlos:montoya`.
### 关键思路
* 有一个 `csrfKey` cookie 和一个 `CSRF` 用于更改电子邮件的查询参数。两个值是“同步”的，但是 **与会话无关**.
* 通过复制这对（`csrfKey`, `CSRF`）从一个账户到另一个账户，可以更改一个受害者的电子邮件 **而无需** 将其与会话关联起来。
* 搜索字段会将上一次搜索保存在会话 cookie（`上次 searchTerm`).
#### 技术细节（通过研究进行 CRLF 注入）
* 可以 **注入请求头** 通过搜索来强制浏览器设置任意 cookie。
像下面这样的简单字符串 `hello csrfKey=aZCI...` 不会被解析。
```
hello csrfKey=aZCI65XauInHYlpP2MXHzMAssSvvyn74
```
另一方面，配合 **回车 + 换行** (`\r` = `%0d`, `\n` = `%0a`):
```
man ascii
```
工作示例：
```
hello%0d%0aSet-Cookie:%20csrfKey=a
```
→ 被解释为一个 **Set-Cookie** 在响应端。
对于跨站上下文，请指定 `SameSite=none` 以便 cookie 在利用时随后的请求中被携带。
示例（在地址/搜索请求栏中）：
{% code overflow="wrap" %}
```
hello%0d%0aSet-Cookie:%20csrfKey%3dGI0PraUBw0m976F6vn51dbYYzh6EtwvZ%3b%20SameSite%3dnone
hello
Set-Cookie: csrfKey=GI0PraUBw0m976F6vn51dbYYzh6EtwvZ; SameSite=none
```
{% endcode %}
### 托管操作员
1. **强制设置** 该 `csrfKey` 通过向搜索页面发起图片请求，在受害者中设置 cookie（该页面会重写头部）：
```html
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-token-tied-to-non-session-cookie.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
