PHP Forgery Source Http_referer Method Example detailed _php skill

This article illustrates the method of Http_referer a source in PHP. Share to everyone for your reference. The specific analysis is as follows:

Today the network is very popular forum automatic posting machine, automatic top-mount machine, etc., to many forums to bring a lot of spam information, many sites are simply used to judge the value of Http_referer to filter the machine post, but the Web page http_referer routing information can be forged. Everything is a double-edged blade, as long as you are good at using it has its existence value.

A long time ago, download software such as FlashGet, thunder and so can forge routing information, and these software forgery Http_referer mostly based on the underlying sock to construct false HTTP header information to achieve the goal. This article purely from the technical point of view, the PHP language of the forgery Http_referer method, in order to let everyone understand the process, better defense.

Environment: apache/2.2.8 + php/5.2.5 + Windows XP system, local test.
First, create 1.php and 2.php two files in the Web site virtual root directory.
The contents of 1.php files are as follows:

<?php
$host = ' 127.0.0.1 ';
$target = '/2.php ';
$referer = ' http://www.jb51.net '; Forged Http_referer address
$fp = Fsockopen ($host, $errno, $errstr,);
if (! $fp) {
echo $errstr ($errno) <br/>\n ";
} 
else{
$out = "Get
$target http/1.1
Host: $host
Referer: $referer
connection:close\r\n\r\n";
fwrite ($fp, $out);
while (!feof ($fp)) {
echo fgets ($FP, 1024);
}
Fclose ($FP);
>

Another 2.php file is simple, just write a line to read the current Http_referer server value of the code can be as follows:

<?php
echo " 
 

Execute 1.php file, open http://localhost/1.php, page return information as follows:

http/1.1 OK Date:fri, APR 2008 16:07:54 GMT server:apache/2.2.8 (Win32) php/5.2.5 x-powered-by:php/5.2.5 Content -length:27 Connection:close content-type:text/html; charset=gb2312

See the results, fake source http_referer information success. So, if your site is just judge Http_referer, not safe, other people can construct such a source, simple defense method is to verify the page with the verification code, but also can be combined with IP judgment method.

Add: The code for forgery sources under ASP is as follows:

<%
Dim http 
Set Http=server.createobject ("MSXML2.") XMLHTTP ") '//msxml2.serverxmlhttp can also
http.open" get ", Url,false 
Http.setrequestheader" Referer "," http:// www.jb51.net/" 
http.send ()
%>

If you are a conscientious, please do not maliciously use these methods, after all, bad things do long, the effect is too much; for example, you send a lot of junk posts, may soon bring you a lot of external links, but such a black hat means sooner or later to be found by search engines, And the links that have been sent are as if they were poured out of water, and the evidence is not in your control.

I hope this article will help you with your PHP program design.