> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-with-broken-referer-validation.md).
# Referer 验证失效的 CSRF
### Referer 验证失效的 CSRF
网站的邮箱更改功能试图通过检查 **Referer** 请求头来阻止跨域请求，但检测逻辑可以被绕过。该实验的目标：在服务器上托管一个 HTML 页面，发起 CSRF 来更改访问者的邮箱地址。
### 要使用的账户
* **用户**: `wiener`
* **密码**: `peter`
如果 `Referer` 如果它来自不同域，请求将被拒绝。
如果 `Referer` 请求头缺失时，检查也会失败（请求将被拒绝）。
* 验证在寻找一个 **匹配项** ，其中包含某个字符串的 `Referer`。因此它接受一个 `Referer` 其中 **包含** 该字符串，即使周围还有额外文本。
* 检测到的可接受字符串示例：/ `https://JORD4N.PRO0aa7004f039e530680480331005c00f0.web-security-academy.net`
#### 观察到的绕过方法
* 与其从 `/exploit`，则 `Referer` 发送请求，不如让其包含该可接受字符串（例如通过构造一个包含该字符串的 URL）。
/0aa7004f039e530680480331005c00f0.web-security-academy.net
* 浏览器会施加安全限制，阻止任意发送某些形式的 `Referer`。要强制发送完整的 `Referer` 从利用页面发送，请在 ``:
```html
```
中添加以下元指令。该指令会告诉浏览器将完整原始页面的 URL 作为 `Referer` 发送，即使在跨源浏览时也是如此（不安全行为）。
```html
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-with-broken-referer-validation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.