靶子 http://localhost:20098 POST_REQUIRED 解析到 45 条 ① 超管 GET 全部 45 个 → 被拒 45/45 ✔ ② 大写 URL 绕过 → 被拒 5/5 ✔ ③ JSON 端点拒绝形态 ✔ ④ 只读页守卫 ✔ ⑤ POST 穿闸 ✔ ⑥ 权限闸优先 ✔ === PASS=78 FAIL=0 ===