> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/essential-skills/analyzing-non-standard-data-structures.md). # 对非标准数据结构的分析对非标准数据结构的分析，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。 ### 扫描非标准数据结构 **实验背景** 这个实验包含一个难以手动识别的漏洞，因为它位于一个 **非标准数据结构中**。 / 目标是使用 **Burp Scanner**，特别是 **扫描所选插入点** 功能来检测漏洞，然后手动利用它来 **删除用户 `carlos`**. 提供的标识符： * **用户**: wiener * **密码**: peter **步骤 1 – 身份验证** 使用提供的凭据通过登录页面连接到应用程序。

**步骤 2 – 在插入点进行定向扫描** 不执行全局扫描，而是进行一次高度定向的扫描： * 拦截一条已认证请求。 * 仅 **会话 Cookie 值** 被选中。

* 我们启动 **Burp Scanner → 扫描所选插入点** 上的这个特定元素。这种极简扫描可以分析一个很少被手动测试的区域：cookie 的内部结构。

**步骤 3 – 漏洞检测** Burp Scanner 识别出一种以下类型的漏洞： * **存储型跨站脚本（XSS）** 检测到的载荷会直接注入到会话 Cookie 中。

检测到的初始载荷示例： {% code overflow="wrap" %} ```bash Cookie: session='">

**步骤 5 – 恢复并解码管理员 cookie** Collaborator 服务器收到一个包含以 Base64 编码的 cookie 的请求： ```bash GET /c2Vzc2lvbj1hZG1pbmlzdHJhdG9yJTNhelJETWFQTzlaZHhiMGdvZ1NMOTJFMVFOeFFncVQ1dHY7IHNlY3JldD1TTjhvd081cHQ3d2Zsb2IxVkhSWG11U2E1YmI4MmlHWDsgc2Vzc2lvbj1hZG1pbmlzdHJhdG9yJTNhelJETWFQTzlaZHhiMGdvZ1NMOTJFMVFOeFFncVQ1dHY= ``` 解码后，我们得到： ```bash session=administrator%3azRDMaPO9Zdxb0gogSL92E1QNxQgqT5tv; secret=SN8owO5pt7wflob1VHRXmuSa5bb82iGX; session=administrator%3azRDMaPO9Zdxb0gogSL92E1QNxQgqT5tv ```

**步骤 6 – 管理员访问和最终操作** 使用管理员会话 cookie： * 界面 **admin** 被访问。 * 的一个内部页面 **日志** 可访问。 * 此页面未经过滤地显示了 cookie，这解释了 **存储型 XSS**. * 的持续存在。随后可以删除用户 **carlos** 并验证实验。

--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/web/essential-skills/analyzing-non-standard-data-structures.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.