Powerful php spoofing IP header, cookies, reference ......

<?
$ Fp = fsockopen ("passport.baidu.com", 80,
$ Errno, $ errstr, 30 );
If (! $ FP ){
Echo "$ errstr
($ Errno) <br>/N ";
} Else {
$ MSG = "Get
/? Login & username = lapiaotuan22 & Password = oyhz123456
HTTP/1.0/R/N ";
$ Msg. = "Host: passport.baidu.com/R/N ";
$ Msg. = "Referer:
Http://passport.baidu.com // R/N ";

$ Msg. = "client-IP:
202.101.201.11/R/N ";
$ Msg. = "X-forwarded-for: 202.101.201.11/R/N ";
// The IP address is constructed here.
$ Msg. = "connection: Close/R/n/R/N ";
Fputs ($ FP,
$ MSG );
While (! Feof ($ FP )){
Echo fgets ($ FP, 1024 );
}
Fclose
($ FP );
}
?>

HTTP-REFERER this variable has become increasingly unreliable, completely can be forged out of the east.
Here are the forgery methods:
PHP (provided that curl is installed ):

PHP code
$ CH = curl_init ();
Curl_setopt ($ ch, curlopt_url, "http://www.dc9.cn/xxx.asp
");

Curl_setopt ($ ch, curlopt_referer, "http://www.dc9.cn/
");
Curl_exec ($ ch );

Curl_close ($ ch );
PHP (use sock instead of curl)
PHP code
$ Server = 'www .dc9.cn ';

$ Host = 'www .dc9.cn ';
$ Target = '/xxx. asp ';
$ Referer =
'Http: // www.dc9.cn/'; // Referer
$ Port = 80;
$ Fp = fsockopen ($ server,
$ Port, $ errno, $ errstr, 30 );
If (! $ FP)
{
Echo "$ errstr
($ Errno) <br/>/N ";
}
Else
{
$ Out = "get $ Target
HTTP/1.1/R/N ";
$ Out. = "Host: $ host/R/N ";
$ Out. = "Cookie:
Aspsessionidsqtbqsda = dfcapklbbficdafmhnkigkeg/R/N ";
$ Out. = "Referer:
$ Referer/R/N ";
$ Out. = "connection: Close/R/n/R/N ";
Fwrite ($ FP, $ out );

While (! Feof ($ FP ))
{
Echo fgets ($ FP, 128 );
}
Fclose ($ FP );

}

The IP address can also be forged.

$ Fp = fsockopen ("192.168.0.128", 80, $ errno, $ errstr, 30 );
If (! $ FP)
{
Echo "$ errstr ($ errno) <br>/N ";
} Else {
$ MSG = "Get/003.php
HTTP/1.0/R/N ";
$ Msg. = "Host: 192.168.0.128/R/N ";
$ Msg. = "Referer: http://www.baidu.com/r/n
";

$ Msg. = "client-IP: 1.1.1.1/R/N ";
$ Msg. = "X-forwarded-for: 1.1.1.1/R/N ";
// The IP address is constructed here.
$ Msg. = "connection: Close/R/n/R/N ";
Fputs ($ FP,
$ MSG );
While (! Feof ($ FP )){
Echo fgets ($ FP, 1024 );
}
Fclose
($ FP );
}

Remember that when using fsockopen, the command must end with/R/n/R/N, otherwise it will time out.

In fact, you can use $ _ server ['remote _ ADDR '] to get the correct IP address, but in order to get the proxy access IP address, the IP address acquisition method is often not $ _ server ['remote _ ADDR '], which provides us with an opportunity.

Note that the above is not very useful in reality, because it seems to be useless for third-party statistics, but it is currently used by third-party statistics.