[TUT and CODE] How to Fake your Referer, Fake Referer Any Offer, Fake Referrer Script

[raybes]

Edit- Posted in the wrong thread... too many tabs open. The post was about making crazy's content gateway pop-up onClick...

 

[cyadron]

Hi.
First thing I would like to thank you for this code. Great work.
What I can say is that unfortunately this code also leaks. I was using CPA-R v1, it leaked, v2 - it leaked, v4 - it leaked. And now also this leaks. It happens very rare (1 at 5000 unique) but it happens. I do not have more information for now, just that it is happening from a mobile device, also could be from linux (not sure yet). If I find out more info I will post here.
Stay safe.

 

[soull]

Thanks you for share. I use CURL for make this.

 

[cyadron]

Maybe you can add a function that will check if the referer is still like ****(customizable), then it will fall back to google for example. Something like you did here: http://www.blackhatworld.com/blackh...erer-blanker-johnsondaniels-latest-share.html
Thank you again for your work.

 

[purewealthinc]

Awesome code! This is what i am looking for!

 

[JohnsonDaniel]

Hi.
First thing I would like to thank you for this code. Great work.
What I can say is that unfortunately this code also leaks. I was using CPA-R v1, it leaked, v2 - it leaked, v4 - it leaked. And now also this leaks. It happens very rare (1 at 5000 unique) but it happens. I do not have more information for now, just that it is happening from a mobile device, also could be from linux (not sure yet). If I find out more info I will post here.
Stay safe.

What leaks? The website the link was placed on (the original referer), or the handler domain?

There's a very important difference, if it leaks the handler domain, make sure the domain you use as a handler is either a purely WH domain, or, even, is the same domain as one of your spoofed referers.

If it's the original site that's getting leaked (and it shouldn't, ever), then let me know, and I'll look into reworking the code to implement greater protection.

Maybe you can add a function that will check if the referer is still like ****(customizable), then it will fall back to google for example. Something like you did here: http://www.blackhatworld.com/blackh...erer-blanker-johnsondaniels-latest-share.html
Thank you again for your work.

Yep, you could post again, implementing a referer check, prior to performing the final redirection, and dumping traffic which didn't have the correct referer for that second post. It's complex, though, and, imo, unnecessary provided it's only the handler domain which leaks.

 

[cyadron]

I know I did not specified but, it is the original referer. I would not be so worried if it was only the handler. I can provide more information in private because I do not wont to divulge my source.

 

[JohnsonDaniel]

I know I did not specified but, it is the original referer. I would not be so worried if it was only the handler. I can provide more information in private because I do not wont to divulge my source.

Please PM me

 

[hellohellosharp]

Great script johnson...

Hey in your example you used the link

http://handler.com/?url=myCPAnetwork.com?oid=12345&pid=6789&sid=yy7456&referer=myfavewpsite.com/post-with-ads

What if I iframed that? Let's say i have iframe.com and the index has an iframe with an src pointing to that link. Will the referer be "myfavewpsite.com/post-with-ads" or would it be iframe.com ?

Thanks

 

[hellohellosharp]

it's work now, the error because some security protection from hostgator, so it's not because wrong install it
thanks for the script, rep+ added !!!

How did you fix it? I am getting the same error....and I am with hostgator as well. How do you set permissions?

 

[cyadron]

Hi, I have more info about the leaks:
[Safari 3.0 with plugins flash enabled] [SymbianOS, 320x240 (mobile)]
[Chrome 5.0 with plugins pdf, flash, java, windowsmedia, gears enabled] [Windows XP, 1280x800 (wide)]
[Safari 3.0 with plugins flash enabled] [SymbianOS, 240x320 (mobile)]

So I guess it would be better to do a referer blanking before the spoofing.

 

[JohnsonDaniel]

Hi, I have more info about the leaks:
[Safari 3.0 with plugins flash enabled] [SymbianOS, 320x240 (mobile)]
[Chrome 5.0 with plugins pdf, flash, java, windowsmedia, gears enabled] [Windows XP, 1280x800 (wide)]
[Safari 3.0 with plugins flash enabled] [SymbianOS, 240x320 (mobile)]

So I guess it would be better to do a referer blanking before the spoofing.

Yep, I'd highly recommend blanking prior to spoofing.

 

[JohnsonDaniel]

How did you fix it? I am getting the same error....and I am with hostgator as well. How do you set permissions?

Hi,

You need to ask HG to set a mod_security exception rule to allow php redirections from your account.

 

[Jaykub]

hey johnsondaniel, great thread..i am actually dealing with this kinda stuff on my own but i'm at a point where i don't know what to do..so maybe u r kind enough to help me

the thing is: let's say i'm iframing something and it goes like this:

a) framed.php
b) landing.html

the framed.php has the iframe src google.com
and the framed.php is iframed in landing.html

how can i fake the referrer here? coz no matter hwo much i fake the referrer pointing to landing html, framed.php is always the referrer to the iframe of google.com

how can i solve this problem?

 

[JohnsonDaniel]

hey johnsondaniel, great thread..i am actually dealing with this kinda stuff on my own but i'm at a point where i don't know what to do..so maybe u r kind enough to help me

the thing is: let's say i'm iframing something and it goes like this:

a) framed.php
b) landing.html

the framed.php has the iframe src google.com
and the framed.php is iframed in landing.html

how can i fake the referrer here? coz no matter hwo much i fake the referrer pointing to landing html, framed.php is always the referrer to the iframe of google.com

how can i solve this problem?

In framed.php, the iframe code should be:

<iframe src="http://handler.com/?url=http://google.com&referer=http://YourWHreferer></iframe>

and in landing.html (and make sure that php is parsed on your html page), the iframe should be:

<iframe src="http://handler.com/?url=http://framed.php&referer=http://YourWHreferer></iframe>

Try to set up like that and let us know how it goes

 

[Jaykub]

oh DAMNED why didn't i came to this idea ?! brilliant johnson, i'm going to try that out the next days and let you gyus know how it goes

 

[amoore89]

Thanks for this. Putitn to use now

 

[JohnsonDaniel]

oh DAMNED why didn't i came to this idea ?! brilliant johnson, i'm going to try that out the next days and let you gyus know how it goes

Please re-check my post just above yours.
Initially I gave you code as it would be used by the blanker, but, having re-read, I realise you're spoofing, so I've amended it as it would be used when spoofing (just the url construction).

Also, on the new urls, you need to make sure that you have placed the required code on this page/site:

http://YourWHreferer

 

[passionplux]

Hey Daniels . Will this be safe G00gle Ad$en$ ?? Has anyone tried it with Ad$en$?

 

[Jaykub]

ummm the thing is, i don't MY white hat page to be the referer but a page like let's say google !! is this possible in any way regarding to iframes?