【Hackthebox 中英 Write-Up】通过 POST 请求绕过前端限制：基于 Cookie 的认证与数据提取实操指南

Bypassing Frontend Restrictions with POST Requests: A Practical Guide to Cookie-Based Authentication and Data Extraction

通过 POST 请求绕过前端限制

Objective | 目标

The purpose of this exercise is to understand how POST requests work and how to authenticate and extract data directly from a web application using cookies and JSON-based POST requests.

本次任务的目的是理解 POST 请求的工作原理，并通过 Cookie 和基于 JSON 的 POST 请求直接从 Web 应用中认证并提取数据。

Steps | 操作步骤

Step 1: Log In to the Web Application | 登录 Web 应用

Open the browser and visit the URL:
打开浏览器并访问以下 URL：
```
http://94.237.62.184:50777/
```
Use the credentials to log in:
使用以下凭据登录：
```
Username: admin  
Password: admin
```
Open Developer Tools (Ctrl+Shift+I or Cmd+Option+I) and go to the Network tab.
打开 开发者工具，进入 Network 标签。
Clear previous network requests and log in again. Observe the POST request sent during login. You will see something like this:
清除旧的网络请求记录，再次登录。观察发送的 POST 请求，你会看到类似以下的数据：
```
POST / HTTP/1.1
Content-Type: application/x-www-form-urlencoded
username=admin&password=admin
```

Step 2: Authenticate with cURL and Extract the Session Cookie | 使用 cURL 认证并提取会话 Cookie

Open the terminal and run the following cURL command to log in: 在终端中运行以下 cURL 命令进行登录：
```
curl -X POST -d 'username=admin&password=admin' http://94.237.62.184:50777/ -i
```
Look for the Set-Cookie header in the response. For example:
在响应中找到 Set-Cookie 头，例如：
```
Set-Cookie: PHPSESSID=gg799jqsgbl84sa9mgpr01q2qo; path=/
```
Copy the session ID (PHPSESSID=gg799jqsgbl84sa9mgpr01q2qo). This will be used in subsequent requests for authentication.
复制会话 ID (PHPSESSID=gg799jqsgbl84sa9mgpr01q2qo)，后续请求中将使用它进行认证。

Step 3: Search for the Flag Using a JSON POST Request | 使用 JSON POST 请求搜索 Flag

Construct a JSON POST request to interact with the search function and retrieve the flag:
构造一个 JSON POST 请求，与搜索功能交互并提取 flag：
```
curl -X POST -d '{"search":"flag"}' -b 'PHPSESSID=gg799jqsgbl84sa9mgpr01q2qo' -H 'Content-Type: application/json' http://94.237.62.184:50777/search.php
```
Explanation | 解释:
- -X POST: Specifies this is a POST request.
  指定这是一个 POST 请求。
- -d '{"search":"flag"}': Sends the search term flag in JSON format.
  以 JSON 格式发送搜索词 flag。
- -b 'PHPSESSID=...': Adds the session cookie for authentication.
  添加会话 Cookie 用于认证。
- -H 'Content-Type: application/json': Specifies the request body is JSON.
  指定请求体为 JSON 格式。
The server will respond with the flag. For example:
服务器会返回包含 flag 的响应，例如：
```
["flag: HTB{p0$t_r3p34t3r}"]
```

Purpose of the Test | 测试目的

Understand POST Requests | 理解 POST 请求
- POST requests are commonly used for sensitive data transmission, such as login credentials or search queries. This exercise demonstrates how POST requests work and how they differ from GET requests.
  
  POST 请求常用于传输敏感数据，如登录凭据或搜索查询。本练习展示了 POST 请求的工作原理及其与 GET 请求的不同。
Simulating Backend Interactions | 模拟后端交互
- By bypassing the frontend, we directly interact with the backend API, which is a crucial skill for penetration testing and bug bounty hunting.
  
  通过绕过前端，我们直接与后端 API 交互，这是渗透测试和漏洞赏金挖掘的重要技能。
Exploiting Weak Authentication | 利用弱认证机制
- Demonstrates how session cookies can be used to persist authentication and how improper handling can lead to vulnerabilities.
  
  演示了如何使用会话 Cookie 维持认证，以及不当处理如何导致漏洞。
Real-World Application | 现实应用
- This technique can uncover weaknesses in authentication systems, helping secure web applications against unauthorized access or data breaches.
  
  该技术可发现认证系统中的弱点，帮助保护 Web 应用免受未授权访问或数据泄露。

Summary | 总结

Steps Recap | 操作回顾

Log in and capture the POST request: Observed login data in the browser’s network tab.

登录并捕获 POST 请求：在浏览器的网络标签中观察到登录数据。
Authenticate with cURL and extract the session cookie: Logged in via cURL and retrieved the session ID.

使用 cURL 认证并提取会话 Cookie：通过 cURL 登录并提取会话 ID。
Send a JSON POST request with the cookie: Used the session ID to send a POST request to /search.php and retrieve the flag.

使用 Cookie 发送 JSON POST 请求：用会话 ID 向 /search.php 发送 POST 请求并获取 flag。

Flag | Flag

HTB{p0$t_r3p34t3r}

How to Prevent This Vulnerability | 如何防范此类漏洞

Secure Session Management | 加强会话管理
- Use short session lifetimes and enforce reauthentication for sensitive actions.
  
  缩短会话有效期，并在敏感操作中强制重新认证。
Implement Strong Authentication | 实施强认证机制
- Enforce multi-factor authentication (MFA) to prevent unauthorized access.
  
  强制多因素认证 (MFA)，防止未授权访问。
Sanitize Inputs and Validate Headers | 清理输入并验证请求头
- Validate the Content-Type header and sanitize input data to prevent malicious requests.
  
  验证 Content-Type 头并清理输入数据，防止恶意请求。
Use HTTPS | 使用 HTTPS
- Encrypt all communications to prevent session hijacking or man-in-the-middle attacks.
  
  加密所有通信以防止会话劫持或中间人攻击。