Is There A 100% Effective Refferal Spoofing Method?

[fatbap]

Is there a 100% effective way to either change or blank the refferrer? Anyone experienced with this?

thanks

 

[Des_cartes]

Not 100% effective because it's impossible but here is my way (that I have posted a bunch of times btw)

WARNING: This code contain a fail safe, if the referer can't be changed the traffic will not be redirected! This is for education only, use it at your own risk!

<?php
if(isset($_GET['redir']) && !empty($_GET['redir'])) {
    $redir_url = substr($_SERVER["REQUEST_URI"], strpos($_SERVER["REQUEST_URI"], "redir=") + 6);
    $uri = preg_split("/.redir.*/i", $_SERVER["REQUEST_URI"]);
    $refresh_url = 'http://' . $_SERVER['HTTP_HOST'] . $uri[0];
    setcookie("redir", $redir_url, time()+5);
    exit(header('Location: ' . $refresh_url));
}
elseif(isset($_COOKIE['redir']) && !empty($_COOKIE['redir'])) {
    $referer = $_SERVER['HTTP_REFERER'];
    $domain = $_SERVER['HTTP_HOST']; 
    if (strpos($referer, $domain) === false)  {
        echo '<form action="" method="get"></form>';
        echo '<script>document.forms[0].submit();</script>';
    }else {
        $redir_url = urldecode($_COOKIE['redir']);
        setcookie("redir", "", time()-5);
        exit(header('Location: ' . $redir_url));
    }
}
?>

Send traffic to 'http://mydomain.com?redir=http://redirdomain.com' (where 'http://redirdomain.com' is the url where you want to send traffic to and 'http://mydomain.com/' the referer you want to display).

Tested and working with the following browsers:
- IE 7+
- Chrome 29+
- FF 14+
- Opera 12
- Edge
- Safari 7+
- Chrome Mobile (Android 4.4+)
- Safari Mobile (IOS 7.1+)

 

[renzuken]

depends on what are you trying to do..
if its php, curl can do that well..but your server ip cannot be spoof.

if just a simple redirect using html javascript make the page secure , any referer are always blank.

 

[fatbap]

Not 100% effective because it's impossible but here is my way (that I have posted a bunch of times btw)

WARNING: This code contain a fail safe, if the referer can't be changed the traffic will not be redirected! This is for education only, use it at your own risk!

<?php
if(isset($_GET['redir']) && !empty($_GET['redir'])) {
    $redir_url = substr($_SERVER["REQUEST_URI"], strpos($_SERVER["REQUEST_URI"], "redir=") + 6);
    $uri = preg_split("/.redir.*/i", $_SERVER["REQUEST_URI"]);
    $refresh_url = 'http://' . $_SERVER['HTTP_HOST'] . $uri[0];
    setcookie("redir", $redir_url, time()+5);
    exit(header('Location: ' . $refresh_url));
}
elseif(isset($_COOKIE['redir']) && !empty($_COOKIE['redir'])) {
    $referer = $_SERVER['HTTP_REFERER'];
    $domain = $_SERVER['HTTP_HOST']; 
    if (strpos($referer, $domain) === false)  {
        echo '<form action="" method="get"></form>';
        echo '<script>document.forms[0].submit();</script>';
    }else {
        $redir_url = urldecode($_COOKIE['redir']);
        setcookie("redir", "", time()-5);
        exit(header('Location: ' . $redir_url));
    }
}
?>

Send traffic to 'http://mydomain.com?redir=http://redirdomain.com' (where 'http://redirdomain.com' is the url where you want to send traffic to and 'http://mydomain.com/' the referer you want to display).

Tested and working with the following browsers:
- IE 7+
- Chrome 29+
- FF 14+
- Opera 12
- Edge
- Safari 7+
- Chrome Mobile (Android 4.4+)
- Safari Mobile (IOS 7.1+)

Thanks for this, but where does the code go? Is it index.php or something? Thanks

 

[Des_cartes]

Thanks for this, but where does the code go? Is it index.php or something? Thanks

Depends on your site, if you are using Wordpress you could copy/past this in your header.php files but it doesn't really matter as long as the code is on the page you want to use for the fake referrer however it will speed up the redirection if it's the first code to be executed.

 

[fatbap]

Depends on your site, if you are using Wordpress you could copy/past this in your header.php files but it doesn't really matter as long as the code is on the page you want to use for the fake referrer however it will speed up the redirection if it's the first code to be executed.

I'm going to use this, is there a way to check it's working? Thanks for you help

 

[Des_cartes]

I'm going to use this, is there a way to check it's working? Thanks for you help

Yes make the redirection goes to site like https://www.whatismyreferer.com/ or https://referer.rustybrick.com

 

[fatbap]

Yes make the redirection goes to site like https://www.whatismyreferer.com/ or https://referer.rustybrick.com

Hi, I replaced all the code in header.php for my site's active wp theme. Then used the link you told me to send the traffic to, using my own url and whatismyreferer.com. The first result from the test showed the referrer was successfully hidden. However every try after then shows my URL. Is there anything you can suggest as to why this is?

 

[Des_cartes]

Hi, I replaced all the code in header.php for my site's active wp theme. Then used the link you told me to send the traffic to, using my own url and whatismyreferer.com. The first result from the test showed the referrer was successfully hidden. However every try after then shows my URL. Is there anything you can suggest as to why this is?

It's weired that it only worked once, what browser did you used? PM me your Skype if you want

 

[renzuken]

i dont quite understand what your trying to do


if its your trying to null the referer from your outgoing links??


try playing with META refferer tag

works both on latest crome and FF

if your looking on more complex answer..

explain more