https://www.leobenchoi.com/tags/broken-access-control/御衡的笔记Hugo 0.166.0 & FixIt v0.4.5zh-CNWed, 08 Apr 2026 17:30:00 +0000https://www.leobenchoi.com/posts/2026/juice-shop-forged-review/Wed, 08 Apr 2026 17:30:00 +0000https://www.leobenchoi.com/posts/2026/juice-shop-forged-review/安全<h1 class="heading-element" id="juice-shop-forged-review伪造他人商品评论"><span>【juice-shop】★★★ Forged Review：伪造他人商品评论</span> <a href="#juice-shop-forged-review%e4%bc%aa%e9%80%a0%e4%bb%96%e4%ba%ba%e5%95%86%e5%93%81%e8%af%84%e8%ae%ba" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><h2 class="heading-element" id="0x01-任务简报"><span>0x01 任务简报</span> <a href="#0x01-%e4%bb%bb%e5%8a%a1%e7%ae%80%e6%8a%a5" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><p>以另一个用户名义发布商品评论或编辑已有的用户评论。</p>https://www.leobenchoi.com/posts/2026/juice-shop-deluxe-fraud/Wed, 08 Apr 2026 04:00:00 +0000https://www.leobenchoi.com/posts/2026/juice-shop-deluxe-fraud/安全<h1 class="heading-element" id="juice-shop-deluxe-fraud免费获得高级会员资格"><span>【juice-shop】★★★ Deluxe Fraud：免费获得高级会员资格</span> <a href="#juice-shop-deluxe-fraud%e5%85%8d%e8%b4%b9%e8%8e%b7%e5%be%97%e9%ab%98%e7%ba%a7%e4%bc%9a%e5%91%98%e8%b5%84%e6%a0%bc" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><h2 class="heading-element" id="0x01-任务简报"><span>0x01 任务简报</span> <a href="#0x01-%e4%bb%bb%e5%8a%a1%e7%ae%80%e6%8a%a5" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><blockquote style="border-left: 5px solid #6f42c1; background-color: #f5f3ff; padding: 20px; margin: 1.5rem 0; color: #5521b5; line-height: 1.8; border-radius: 0 5px 5px 0;"> <div style="font-weight: bold; font-size: 1.1rem; margin-bottom: 10px; display: flex; align-items: center;"> <span style="margin-right: 8px;">💡</span> 提示 (Hints) </div> 1. 仔细观察当你试图升级账户时会发生什么。<br> 2. 前往豪华会员的支付页面，尝试通过不同方式进行支付。<br> 3. 尝试使用浏览器的开发者工具检查这些方法各自发出的请求。<br> 4. 也许通过调整这些请求中的参数，能发现一些有趣的东西。 </blockquote> <blockquote> <p><strong>前置条件：</strong> 需要登录账户。</p>https://www.leobenchoi.com/posts/2026/juice-shop-captcha-bypass/Tue, 07 Apr 2026 17:55:00 +0000https://www.leobenchoi.com/posts/2026/juice-shop-captcha-bypass/安全<h1 class="heading-element" id="juice-shop-captcha-bypass绕过验证码批量提交反馈"><span>【juice-shop】★★★ CAPTCHA Bypass：绕过验证码批量提交反馈</span> <a href="#juice-shop-captcha-bypass%e7%bb%95%e8%bf%87%e9%aa%8c%e8%af%81%e7%a0%81%e6%89%b9%e9%87%8f%e6%8f%90%e4%ba%a4%e5%8f%8d%e9%a6%88" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><h2 class="heading-element" id="0x01-任务简报"><span>0x01 任务简报</span> <a href="#0x01-%e4%bb%bb%e5%8a%a1%e7%ae%80%e6%8a%a5" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><blockquote style="border-left: 5px solid #6f42c1; background-color: #f5f3ff; padding: 20px; margin: 1.5rem 0; color: #5521b5; line-height: 1.8; border-radius: 0 5px 5px 0;"> <div style="font-weight: bold; font-size: 1.1rem; margin-bottom: 10px; display: flex; align-items: center;"> <span style="margin-right: 8px;">💡</span> 提示 (Hints) </div> 1. 绕过验证码后，编写脚本自动提交，或打开多个标签页快速提交。<br> 2. 可以准备 10 个浏览器标签页，逐个破解验证码并填写表单，在 20 秒内快速切换提交。<br> 3. 若要求改为 60 秒内提交 100 条以上，标签页切换策略将难以应对。<br> 4. 深入研究验证码机制的工作原理，尝试寻找绕过方法或自动化动态破解方案。<br> 5. 将操作封装成脚本，重复执行 10 次。 </blockquote> <hr> <h2 class="heading-element" id="0x02-实战复现漏洞"><span>0x02 实战：复现漏洞</span> <a href="#0x02-%e5%ae%9e%e6%88%98%e5%a4%8d%e7%8e%b0%e6%bc%8f%e6%b4%9e" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><h3 class="heading-element" id="-第一步抓包分析验证码机制"><span>🔍 第一步：抓包分析验证码机制</span> <a href="#-%e7%ac%ac%e4%b8%80%e6%ad%a5%e6%8a%93%e5%8c%85%e5%88%86%e6%9e%90%e9%aa%8c%e8%af%81%e7%a0%81%e6%9c%ba%e5%88%b6" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h3><p>打开 Burp Suite，访问 <code>http://127.0.0.1:3000/#/contact</code>，分析请求包。</p>https://www.leobenchoi.com/posts/2026/juice-shop-admin-registration/Tue, 07 Apr 2026 16:12:00 +0000https://www.leobenchoi.com/posts/2026/juice-shop-admin-registration/安全<h1 class="heading-element" id="juice-shop-admin-registration注册管理员权限账户"><span>【juice-shop】★★★ Admin Registration：注册管理员权限账户</span> <a href="#juice-shop-admin-registration%e6%b3%a8%e5%86%8c%e7%ae%a1%e7%90%86%e5%91%98%e6%9d%83%e9%99%90%e8%b4%a6%e6%88%b7" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><h2 class="heading-element" id="0x01-任务简报"><span>0x01 任务简报</span> <a href="#0x01-%e4%bb%bb%e5%8a%a1%e7%ae%80%e6%8a%a5" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><blockquote style="border-left: 5px solid #6f42c1; background-color: #f5f3ff; padding: 20px; margin: 1.5rem 0; color: #5521b5; line-height: 1.8; border-radius: 0 5px 5px 0;"> <div style="font-weight: bold; font-size: 1.1rem; margin-bottom: 10px; display: flex; align-items: center;"> <span style="margin-right: 8px;">💡</span> 提示 (Hints) </div> 1. 必须得到一个无法通过正常途径分配的权限。<br> 2. 注册为普通用户，了解此用例涉及哪些 API 接口。<br> 3. 设想区分普通用户与管理员的最简单实现方式。 </blockquote> <hr> <h2 class="heading-element" id="0x02-实战复现漏洞"><span>0x02 实战：复现漏洞</span> <a href="#0x02-%e5%ae%9e%e6%88%98%e5%a4%8d%e7%8e%b0%e6%bc%8f%e6%b4%9e" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><h3 class="heading-element" id="-第一步注册普通用户并抓包"><span>🔍 第一步：注册普通用户并抓包</span> <a href="#-%e7%ac%ac%e4%b8%80%e6%ad%a5%e6%b3%a8%e5%86%8c%e6%99%ae%e9%80%9a%e7%94%a8%e6%88%b7%e5%b9%b6%e6%8a%93%e5%8c%85" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h3><p>提示其实无所谓，在实际操作的时候我大概只与第三点有关……</p>https://www.leobenchoi.com/posts/2026/juice-shop-forged-feedback/Mon, 06 Apr 2026 02:34:00 +0000https://www.leobenchoi.com/posts/2026/juice-shop-forged-feedback/安全<h1 class="heading-element" id="juice-shop-forged-feedback伪造他人反馈"><span>【juice-shop】★★★ Forged Feedback：伪造他人反馈</span> <a href="#juice-shop-forged-feedback%e4%bc%aa%e9%80%a0%e4%bb%96%e4%ba%ba%e5%8f%8d%e9%a6%88" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><h2 class="heading-element" id="0x01-任务简报"><span>0x01 任务简报</span> <a href="#0x01-%e4%bb%bb%e5%8a%a1%e7%ae%80%e6%8a%a5" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><blockquote style="border-left: 5px solid #6f42c1; background-color: #f5f3ff; padding: 20px; margin: 1.5rem 0; color: #5521b5; line-height: 1.8; border-radius: 0 5px 5px 0;"> <div style="font-weight: bold; font-size: 1.1rem; margin-bottom: 10px; display: flex; align-items: center;"> <span style="margin-right: 8px;">💡</span> 提示 (Hints) </div> 1. 可以通过篡改用户界面或拦截 RESTful 后端通信来解决此问题。<br> 2. 要找到客户端的杠杆点，需仔细分析用于反馈提交的 HTML 表单。<br> 3. 后端侧的杠杆点类似于 Juice Shop 中某些 XSS 挑战的利用方式。 </blockquote> <hr> <h2 class="heading-element" id="0x02-实战复现漏洞"><span>0x02 实战：复现漏洞</span> <a href="#0x02-%e5%ae%9e%e6%88%98%e5%a4%8d%e7%8e%b0%e6%bc%8f%e6%b4%9e" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><h3 class="heading-element" id="-第一步进入客户反馈页面"><span>🔍 第一步：进入客户反馈页面</span> <a href="#-%e7%ac%ac%e4%b8%80%e6%ad%a5%e8%bf%9b%e5%85%a5%e5%ae%a2%e6%88%b7%e5%8f%8d%e9%a6%88%e9%a1%b5%e9%9d%a2" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h3><p>导航至客户反馈页面，打开浏览器 DevTools，切换到 <strong>Elements（元素）</strong> 面板，仔细审查反馈表单的 HTML 结构。</p>