> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-with-duplicated-token-in-a-double-submit-cookie.md). # 双提交 Cookie 中令牌重复的 CSRF 双提交 Cookie 中令牌重复的 CSRF 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。 ### Cookie 中令牌重复的 CSRF #### 描述 此实验室的邮箱更改功能存在 CSRF 攻击漏洞。该站点试图使用脆弱的 **“双重提交”**：同一个 CSRF 令牌同时存在于表单字段和 cookie 中。如果攻击者能够伪造一个跨站查询并发送一个 `CSRF` 包含相同值的字段。 #### 目标 在你的 **服务器** 上托管一个 HTML 页面，当访客打开时，它会自动提交一个 POST 请求来更改其邮箱地址（完成该实验室）。 #### 访问（凭据） 你可以使用以下方式连接： `wiener: peter` #### 测试中的重要观察 * 表单中的 CSRF 令牌值与 cookie 值相同。
#### CRLF 注入示例（在 `search` 地址栏或参数中）
``` hello%0d%0aSet-Cookie:%20csrfKey=qzAd1Kd7ItFul6Ix3H1S3LSXicK8KCfO ```
* 为了强制在跨站上下文中发送 cookie，最好将 `SameSite=None` 设置在该 cookie 上。 ``` hello Set-Cookie: csrfKey=qzAd1Kd7ItFul6Ix3H1S3LSXicK8KCfO; SameSite=none hello%0d%0aSet-Cookie:%20csrfKey%3dqzAd1Kd7ItFul6Ix3H1S3LSXicK8KCfO%3b%20SameSite%3dnone ``` #### 要放到利用服务器上的利用 HTML 下面是一个示例页面，它将 CSRF 令牌值放入 `CSRF` 字段中，指定目标邮箱，然后利用图片查询自动提交表单（该查询会触发通过搜索写入 cookie 的尝试）： ```html
``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/web/csrf/csrf-with-duplicated-token-in-a-double-submit-cookie.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.