https://www.leobenchoi.com/tags/csrf/御衡的笔记Hugo 0.166.0 & FixIt v0.4.5zh-CNTue, 07 Apr 2026 00:00:00 +0000https://www.leobenchoi.com/posts/2026/juice-shop-csrf/Tue, 07 Apr 2026 00:00:00 +0000https://www.leobenchoi.com/posts/2026/juice-shop-csrf/安全<h1 class="heading-element" id="juice-shop-csrf跨站请求伪造修改用户名"><span>【juice-shop】★★★ CSRF：跨站请求伪造修改用户名</span> <a href="#juice-shop-csrf%e8%b7%a8%e7%ab%99%e8%af%b7%e6%b1%82%e4%bc%aa%e9%80%a0%e4%bf%ae%e6%94%b9%e7%94%a8%e6%88%b7%e5%90%8d" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h1><h2 class="heading-element" id="0x01-任务简报"><span>0x01 任务简报</span> <a href="#0x01-%e4%bb%bb%e5%8a%a1%e7%ae%80%e6%8a%a5" class="heading-mark"> <svg class="octicon octicon-link" viewBox="0 0 16 16" version="1.1" width="16" height="16" aria-hidden="true"><path d="m7.775 3.275 1.25-1.25a3.5 3.5 0 1 1 4.95 4.95l-2.5 2.5a3.5 3.5 0 0 1-4.95 0 .751.751 0 0 1 .018-1.042.751.751 0 0 1 1.042-.018 1.998 1.998 0 0 0 2.83 0l2.5-2.5a2.002 2.002 0 0 0-2.83-2.83l-1.25 1.25a.751.751 0 0 1-1.042-.018.751.751 0 0 1-.018-1.042Zm-4.69 9.64a1.998 1.998 0 0 0 2.83 0l1.25-1.25a.751.751 0 0 1 1.042.018.751.751 0 0 1 .018 1.042l-1.25 1.25a3.5 3.5 0 1 1-4.95-4.95l2.5-2.5a3.5 3.5 0 0 1 4.95 0 .751.751 0 0 1-.018 1.042.751.751 0 0 1-1.042.018 1.998 1.998 0 0 0-2.83 0l-2.5 2.5a1.998 1.998 0 0 0 0 2.83Z"></path></svg> </a> </h2><blockquote style="border-left: 5px solid #6f42c1; background-color: #f5f3ff; padding: 20px; margin: 1.5rem 0; color: #5521b5; line-height: 1.8; border-radius: 0 5px 5px 0;"> <div style="font-weight: bold; font-size: 1.1rem; margin-bottom: 10px; display: flex; align-items: center;"> <span style="margin-right: 8px;">💡</span> 提示 (Hints) </div> 1. 查找更新用户名的表单，在 HTML 在线编辑器中构建恶意页面。可能需要旧版浏览器。<br> 2. 看看在个人资料页面更改用户名时会发生什么。<br> 3. 搜索有关 CSRF 攻击的信息，寻找可应用于本挑战的示例。<br> 4. 在 http://htmledit.squarefree.com 中编写 CSRF 攻击代码，验证是否更改了用户名。 </blockquote> <blockquote> <p><strong>注意：</strong> 本题需要旧版浏览器（新版浏览器会因 SameSite Cookie 保护而拒绝跨站脚本自动携带 Cookie）。</p>