> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/client-side-desync.md).
# 客户端去同步
### 客户端侧不同步
该实验室易受客户端侧不同步攻击，因为服务器会忽略某些端点的 Content-Length 头。这个弱点会让受害者的浏览器泄露其会话 cookie。/ 实验目标：
1. 使用 Burp 找到一个客户端侧不同步向量，然后确认它能在浏览器中复现。
2. 找到一个应用元素用于注入或存储文本。
3. 将两者结合，强制受害者的浏览器发送一系列跨域请求，从而泄露其 cookie。
4. 使用这个 cookie 访问受害者的账户。
#### **服务器行为分析**
通过发送一个故意膨胀的 Content-Length 请求，服务器会忽略它，而是将后续内容视为一个新的请求：
```http
POST / HTTP/1.1
Host: 0a69005a041eb75c828761ef00630000.h1-web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 100
GET /error HTTP/1.1
测试：hello
```
这一响应证实了客户端侧不同步的存在。
#### **演示不同步**
通过在 Burp 中配置两个请求（一个模拟客户端，另一个用于攻击），并按顺序发送它们，攻击者的错误响应会被发送给合法客户端。
这表明服务器使 HTTP 流不同步。
#### **受害者 cookie 的外泄**
为了强制受害者的浏览器泄露其会话 cookie，我们针对评论功能，因为它允许你在应用中存储文本。
发送一个 Content-Length 膨胀的评论请求：
```http
POST /en/post/comment HTTP/1.1
Host: 0a69005a041eb75c828761ef00630000.h1-web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 118
csrf=5eEtViEnAhAKWZz68JwV8leC2rJYFIAf&postId=1&comment=tst&name=tst&email=tst%40test.com&website=http%3A%2F%2Ftest.com
```
```http
csrf=5eEtViEnAhAKWZz68JwV8leC2rJYFIAf&postId=1&name=tst&email=tst%40test.com&website=http%3A%2F%2Ftest.com&comment=tst
```
通过增加这个字段（例如设为 500），发布的评论随后会泄露已连接账户的会话 cookie。
#### **通过 JavaScript 脚本实现自动化**
为了将攻击变成受害者可用的利用脚本，构建了一个封装在脚本中的走私请求：
```javascript
```
这个 payload 会导致受害者的浏览器自动发送被走私的请求。
被盗的会话 cookie 随后会出现在评论区。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/client-side-desync.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.