> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/information-disclosure/authentication-bypass-via-information-disclosure.md).
# 通过信息泄露绕过身份验证
通过信息泄露绕过身份验证，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 通过信息泄露绕过身份验证
应用程序的管理界面包含一种身份验证绕过机制。它基于前端使用的一个自定义 HTTP 头，但事先未知。/ 要完成该实验，你需要识别这个头的名称，利用它绕过身份验证，访问管理界面并删除用户 **carlos**.
**访问管理界面的初始入口**
尝试通过以下方式直接访问管理员页面 `/admin` 路由返回以下消息：
> *管理界面仅对本地用户开放*
这表明访问仅限于来自本地主机的请求。
**通过 TRACE 方法泄露信息**
通过发送带有以下内容的 HTTP 请求 `TRACE` 方法到 `/admin`，服务器返回了比需要更多的头信息。
```bash
TRACE /admin
```
在这些信息中，泄露了一个自定义头：
```bash
X-Custom-Ip-Authorization
```
前端使用该头来判断请求是否来自本地用户。
**绕过身份验证**
在请求中添加以下头： `/admin`:
```bash
X-Custom-Ip-Authorization: 127.0.0.1
```
服务器会将该请求视为本地请求。/ 随后，无需额外身份验证即可访问管理界面。
**最终利用**
一旦连接到管理面板，就可以通过访问以下 URL 删除目标用户：
```bash
/admin/delete?username=carlos
```
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/information-disclosure/authentication-bypass-via-information-disclosure.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
.png?alt=media)
.png?alt=media)
.png?alt=media)