PHP page Jump and cross-site submission of forged Referer Address Source

This article introduces two methods of using php to implement page Jump and cross-site submission to forge Referer address sources. The methods mainly use fsockopen and curl functions, for more information, see.

1. URL redirection method tried

The Code is as follows:	Copy code
Echo '<meta http-equiv = "refresh" content = "0; URL ='. $ url. '"> '; Echo '<scr required pt language = "Javascr required pt"> window. location. href = "'. $ url. '"; </scr required pt> '; Echo '<script language = "CR Cr ī pt"> window. location. replace = "'. $ url. '"; </script> ';

None of the above three methods can pass the REFERER address.

Ii. Use the PHP Socket function to forge a REFER
The following section describes the php referer forgery code. After testing, the REFERER address can be transferred, where $ url is the input address.

The Code is as follows:

Copy code

$ Uinfo = parse_url ($ url); // parse the URL address, such as the http://php100.com/archives/1.html If ($ uinfo ['path']) // $ Data = $ uinfo ['path']; // get/archives/1.html Else $ Data = '/'; // Default Root If (! $ Fsp = @ fsockopen ($ uinfo ['host'], ($ uinfo ['Port'])? $ Uinfo ['Port']: "80"), $ errno, $ errstr, 12 )){ Echo "sorry, the recipient's website cannot be opened at the moment. Please visit later:". $ uinfo ['host']; exit; } Else { Fputs ($ fsp, "GET". $ data. "HTTP/1.0rn"); // if it is a cross-site POST submission, you can use the POST Method Fputs ($ fsp, "Host:". $ uinfo ['host']. "rn "); Fputs ($ fsp, "Referer: php100.comrn"); // counterfeit REFERER address Fputs ($ fsp, "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) rnrn "); $ Res = ''; While (! Feof ($ fsp )){ $ Res. = fgets ($ fsp, 128 ); If (strstr ($ res, "200 OK ")){ Header ("Location: $ url"); exit; } } } // If the status code is 301 or 302, you can continue to process the code. // Return URL approximate form: HTTP/1.1 301 Moved PermanentlynContent-Length: 164nContent-Type: text/htmlnLocation: http://php100.com/ $ Arr = explode ("n", $ res ); $ Arr = explode (":", $ arr [3]); // The Location is followed by a real redirection address. Header ("location:". $ arr [0]); // jump to the target address Exit;

Use another method curl) to forge HTTP_REFERER

The Code is as follows:

Copy code

// PHP (provided that curl is installed ): $ Ch = curl_init (); Curl_setopt ($ ch, CURLOPT_URL, "http://www.bkjia.com /"); Curl_setopt ($ ch, CURLOPT_REFERER, "http://www.bkjia.com /"); Curl_exec ($ ch ); Curl_close ($ ch ); // PHP (do not install curl with sock) $ Server = 'blog. qita. in '; $ Host = 'blog. qita. in '; $ Target = '/xxx. asp '; $ Referer = 'HTTP: // www.baidu.com/'; // Referer $ Port = 80; $ Fp = fsockopen ($ server, $ port, $ errno, $ errstr, 30 ); If (! $ Fp) { Echo "$ errstr ($ errno) <br/> n "; } Else { $ Out = "GET $ target HTTP/1.1rn "; $ Out. = "Host: $ hostrn "; $ Out. = "Cookie: ASPSESSIONIDSQTBQSDA = DFCAPKLBBFICDAFMHNKIGKEGrn "; $ Out. = "Referer: $ refererrn "; $ Out. = "Connection: Closernrn "; Fwrite ($ fp, $ out ); While (! Feof ($ fp )) { Echo fgets ($ fp, 128 ); } Fclose ($ fp ); }