PHP falsified source Http_referer Examples of methods, forged http_referer_php Tutorials

PHP Forged Source Http_referer Examples of methods, forged Http_referer

This paper describes the method of PHP forgery source http_referer. Share to everyone for your reference. The specific analysis is as follows:

Today, the Internet is very popular forum automatic post machine, automatic top-mount machine, to many forums to bring a large number of spam information, many sites simply used to judge the value of Http_referer to filter the machine post, but the page http_referer information can be forged. Everything is a double-edged blade, as long as you are good at using it has its existence value.

Long ago, download software such as FlashGet, Thunderbolt, etc. can forge the antecedents of information, and these software forgery Http_referer mostly based on the underlying sock to construct false HTTP header information to achieve the purpose. This article is purely from a technical point of view, PHP language forgery Http_referer method, in order to let everyone understand the process, better defense.

Environment: apache/2.2.8 + php/5.2.5 + Windows XP system, local testing.
First, create 1.php and 2.php two files in the Web site virtual root directory.
The contents of the 1.php file are as follows:

<?php$host = ' 127.0.0.1 '; $target = '/2.php '; $referer = ' http://www.bkjia.com '; Forged Http_referer Address $fp = Fsockopen ($host, $errno, $ERRSTR, +), if (! $fp) {echo "$errstr ($errno)
\ n ";} else{$out = "GET $target http/1.1host: $hostReferer: $refererConnection: close\r\n\r\n"; fwrite ($fp, $out); while (!feof ( $FP) {echo fgets ($FP, 1024);} Fclose ($FP);}? >

Another 2.php file is simple, just write a line to read the current Http_referer server value code, as follows:

<?phpecho "
 
  "Echo $_server[" Http_referer "];? >

Execute 1.php file, open http://localhost/1.php, page return information as follows:

http/1.1 OK Date:fri, APR 16:07:54 GMT server:apache/2.2.8 (Win32) php/5.2.5 x-powered-by:php/5.2.5 Content -length:27 Connection:close content-type:text/html; charset=gb2312

See the results, fake source http_referer information successfully. So, if your site is just to Judge Http_referer, is not safe, others can construct such a source, the simple defense method is to verify the page with a verification code, you can also combine IP judgment method.

Add: The code for the forged source under ASP is as follows:

<%dim http Set Http=server.createobject ("MSXML2. XMLHTTP ") '//msxml2.serverxmlhttp can also http.open" GET ", Url,false http.setrequestheader" Referer ","/HTTP/ www.bkjia.com/"Http.send ()%>

If you are a conscientious, please do not malicious use of these methods, after all, bad things long, the effect is more than enough; For example, you send a lot of junk posts, may give you a lot of external links in the short term, but such a black hat means sooner or later to be discovered by search engines, And the links that have been sent are like spilled water, and the evidence is not something you can control.

I hope this article is helpful to everyone's PHP programming.

http://www.bkjia.com/PHPjc/1027496.html www.bkjia.com true http://www.bkjia.com/PHPjc/1027496.html techarticle PHP Forgery Source Http_referer method examples, forged http_referer This article describes the PHP forgery source Http_referer method. Share to everyone for your reference. The specific analysis is as follows: ...

