> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-lax-bypass-via-method-override.md).
# 通过方法覆盖绕过 SameSite Lax
通过方法覆盖绕过 SameSite Lax 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 通过方法覆盖绕过 SameSite Lax
该实验室的电子邮件地址修改功能存在 CSRF 攻击漏洞。该站点使用 SameSite=Lax，但可以通过 d-override 参数强制将 POST 方法查询（`&_method=POST`）添加到 URL 中，从而绕过这一保护。
\*\* 目标\*\*/ 在漏洞利用服务器上托管一个载荷（已利用），发起请求将电子邮件地址更改为受害者的姓名，以完成实验。
**凭据（测试账户）**/ `wiener: peter`
* 向电子邮件修改端点发送 GET 请求会返回方法不被允许。
* 添加 `&_method=POST` URL 中的参数会使请求被接受（该站点接受该覆盖，将请求视为 POST），从而即使存在 SameSite=Lax 也能执行该操作。
```
&_method=POST
```
#### **漏洞利用服务器载荷**
以下脚本通过包含覆盖参数强制使用 POST，将受害者重定向到电子邮件修改 URL：
```javascript
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-lax-bypass-via-method-override.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
