PHP uses CURL to forge source IP addresses and URLs

Test1.php? Phpob_start (); $ chcurl_init (); curl_setopt ($ ch, CURLOPT_URL, www. xxx. cntesttest2.php); curl_setopt ($ ch, CURLOPT_HTTPHEADER, array (X-FORWARDED-FOR: 1.1.1.1, CLIENT-IP: 2.2.2.2); counterfeit IPcurl_setopt ($ ch, CURLOPT_REFE

Test1.php? Phpob_start (); $ ch = curl_init (); curl_setopt ($ ch, CURLOPT_URL, "http://www.xxx.cn/test/test2.php"); curl_setopt ($ ch, CURLOPT_HTTPHEADER, array ('x-FORWARDED-: 1.1.1.1 ', 'client-IP: 2.2.2.2'); // counterfeit IPcurl_setopt ($ ch, CURLOPT_REFE

Test1.php

Test2.php

Execution result:

HTTP/1.1 200 OKServer: DWS/01.03Z33Date: Mon, 09 Jun 2014 09:27:09 GMTContent-Type: text/htmlTransfer-Encoding: chunkedConnection: keep-aliveVary: Accept-EncodingIP: 2.2.2.2  HTTP_CLIENT_IP-: 2.2.2.2    HTTP_X_FORWARDED_FOR-: 1.1.1.1    REMOTE_ADDR-: 127.0.0.1   referer: http://www.oicto.com/

However, it is not possible to forge a scam:

$ _ SERVER ["REMOTE_ADDR"].

Therefore, we recommend that you use $ _ SERVER ["REMOTE_ADDR"] to record IP addresses.

Original article address: PHP uses CURL to forge the source IP address and website address. Thank you for sharing it with the original author.