How to Blank Referrer over HTTPS

F

filipe3x

Registered Member
Joined
Jan 14, 2012
Messages
52
Reaction score
5
Heres what i want to do:

Website 1 -> Website 2 (with https) -> Affiliate link (with no referer field sent)
Click to expand...

I have the following code in the Website 1 (notice it is redirecting over a SSL connection)

PHP: 
<?php 
header("Location: https://redirect/to/website2");
?>

and this in the Website 2 (the "referer" header should be dropped, because it is redirecting from a HTTP Secure to a Non-secure HTTP)

PHP: 
<?php 
header("Location: http://affiliate/link");
?>

BUT everytime i run the script, the referrer from "Website 1" keeps getting leaked!

Can you guys help me?

I am testing the script with the help of this this tool http://www.stardrifter.org/cgi-bin/ref.cgi

thanks
 
Last edited:
Advertise on BHW
Did you try not passing the "S" in the initial site, so it's http -> http instead of https -> http ?
 
Yes! Any other solution for this problem?
 
Last edited:
It wont work, cause the initial request was from a non https website, so the ref value is saved across all 301 redirects. For https to blank the referrer, you need to direct visiting it, and then redirect from it forward. That is, the initial visit of a user must be to a https website, then redirect to the offer, or some website in between.
 
mrblackjack i know its possible to do like i am doing. I see a lot of people doing it. The problem is the 302 redirect i made doesn't go thro the encrypted SSL connection hence the referrer gets leaked every f*cking time.

How can I force Apache to do so?

GET redirect1.php HTTP/1.0
Accept: */*
Accept-Language: en-US
Referer: http://fuckin/referer
x-flash-version: 10,3,183,7
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; ...)
Host: host.com
Connection: Keep-Alive

HTTP/1.1 302 Moved Temporarily
Date: Wed, 02 May 2012 19:56:59 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: PHPSESSID=174272468a2**4e0; path=/
Location: https://redirect2.php
Content-Length: 0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

-*

GET redirect2.php HTTP/1.1
Accept: text/html, application/xhtml+xml, */*
Accept-Language: en-US
Referer: http://fuckin/referer
User-Agent: ...
Accept-Encoding: gzip, deflate
Host: host.com
Connection: Keep-Alive*

HTTP/1.1 302 Moved Temporarily
Date: ...
Server: Apache
X-Powered-By: PHP/5.2.17
Location: http://[B]redirect3.php[/B]
Content-Length: 0
Connection: close
Content-Type: text/html*

-*

GET redirect3.php HTTP/1.0
Accept: */*
Accept-Language: en-US
Referer: http://fuckin/referer
x-flash-version: 10,3,183,7
User-Agent: Mozilla/4.0 (compatible; ...)
Connection: Keep-Alive Host: host.com
Cookie: PHPSESSID=174272468****56e4e0*

HTTP/1.1 302 Moved Temporarily
Date: Wed, 02 May 2012 19:56:59 GMT
Server: Apache
X-Powered-By: PHP/5.2.17
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: http://affiliate/link
Content-Length: 0
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html
Click to expand...
 
Last edited:
No, you dont need the initial request to be made from a https website... You just have to add the https request between the redirects, once the redirect go thro the SSL, the referer gets automatically killed. At least, thats what the theory says.

I just dont understand why it isn't working for me!
 
oh godammit

Looks like you're right. At least partially right. My script is working at 100% in IE, but fails at chrome or firefox. The reason being - like you said - if the initial request was from a non https website (non secure connection) the referer always gets leaked. But if i do a request from a https the referer gets blanked, and everything is good :D

Thanks for the help
 
Last edited:
filipe3x said:
oh godammit

Looks like you're right. At least partially right. My script is working at 100% in IE, but fails at chrome or firefox. The reason being - like you said - if the initial request was from a non https website (non secure connection) the referer always gets leaked. But if i do a request from a https the referer gets blanked, and everything is good :D

Thanks for the help
Click to expand...

blankrefer has been cross browser tested and saves people from the headache of scripting.
 
Who is the owner of that site ? Can you trust him ? What if he is logging sites and redirects for some reason ?
Whatever you can do alone, don't let to 3rd party "free" sites/services do for you.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top