> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/host-header/password-reset-poisoning-via-dangling-markup.md).
# 通过悬空标记进行密码重置投毒
通过悬空标记进行密码重置投毒，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过悬空标记进行密码重置投毒
**实验描述**
这个实验室存在一个 **通过悬空标记进行密码重置投毒**. / 通过在重置邮件中使用错误的 HTML 处理方式，可以将发送给用户的链接重定向，并获取其新密码。
**目标：** 登录到 **carlos 账户**.
**提供的凭据：**
* 用户： `wiener`
* 密码： `peter`
你好！
请 点击此处 使用你的新密码登录：AGSoZyzfot
谢谢，
此电子邮件已由 MacCarthy 邮件安全服务扫描
```
{% endcode %}
连接链接是动态构建自 **主机** 请求头。
**行为分析**
如果你将 Host 头更改为包含任意端口：
```http
Host: 0a2e00ee040867fe812cd4f900e700cb.web-security-academy.net:1234
```
邮件中正确反映了该端口。/ 这证实了 **主机** 的值在邮件的 HTML 中未经严格验证就被嵌入了。
` 标签而没有正确闭合它来利用，因此电子邮件其余内容（包括密码）会被解释为 URL 的一部分：
```http
Host: 0a2e00ee040867fe812cd4f900e700cb.web-security-academy.net:1234' &goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
