> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-with-broken-referer-validation.md).
# Referer 验证失效的 CSRF
Referer 验证失效的 CSRF 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### Referer 验证失效的 CSRF
网站的更改电子邮件功能会通过检查以下内容来尝试阻止跨域请求： **Referer** 头部，但其检测逻辑可以绕过。实验目标：在服务器上托管一个 HTML 页面，该页面会创建一个 CSRF 来更改访问者的电子邮件地址。
### 要使用的账户
* **用户**: `wiener`
* **密码**: `peter`
如果 `Referer` 来自不同域时，请求会被拒绝。
如果 `Referer` 头部缺失，则检查也会失败（请求会被拒绝）。
* 验证正在查找一个 **匹配** ，其中包含某个字符串 `Referer`。因此它接受一个 `Referer` 其中 **包含** 该字符串，即使周围还有额外文本。
* 检测到的可接受字符串示例：/ `https://JORD4N.PRO0aa7004f039e530680480331005c00f0.web-security-academy.net`
#### 已观察到绕过
* 不要从 `/exploit`，则 `Referer` 可以被构造成包含该可接受字符串（例如，通过构建一个包含该字符串的 URL）。
/0aa7004f039e530680480331005c00f0.web-security-academy.net
* 浏览器施加安全限制，阻止任意发送某些形式的 `Referer`。要强制完整的 `Referer` 从利用页面发送，请在以下位置添加如下 meta 指令： ``:
```html
```
该指令会告诉浏览器将完整原始页面的 URL 作为 `Referer` 发送，即使在跨域浏览时也是如此（不安全行为）。
```html
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-with-broken-referer-validation.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)
.png?alt=media)