Is There A 100% Effective Refferal Spoofing Method?

Des_cartes said:

Not 100% effective because it's impossible but here is my way (that I have posted a bunch of times btw)

WARNING: This code contain a fail safe, if the referer can't be changed the traffic will not be redirected! This is for education only, use it at your own risk!

PHP:

<?php
if(isset($_GET['redir']) && !empty($_GET['redir'])) {
    $redir_url = substr($_SERVER["REQUEST_URI"], strpos($_SERVER["REQUEST_URI"], "redir=") + 6);
    $uri = preg_split("/.redir.*/i", $_SERVER["REQUEST_URI"]);
    $refresh_url = 'http://' . $_SERVER['HTTP_HOST'] . $uri[0];
    setcookie("redir", $redir_url, time()+5);
    exit(header('Location: ' . $refresh_url));
}
elseif(isset($_COOKIE['redir']) && !empty($_COOKIE['redir'])) {
    $referer = $_SERVER['HTTP_REFERER'];
    $domain = $_SERVER['HTTP_HOST']; 
    if (strpos($referer, $domain) === false)  {
        echo '<form action="" method="get"></form>';
        echo '<script>document.forms[0].submit();</script>';
    }else {
        $redir_url = urldecode($_COOKIE['redir']);
        setcookie("redir", "", time()-5);
        exit(header('Location: ' . $redir_url));
    }
}
?>

Send traffic to 'http://mydomain.com?redir=http://redirdomain.com' (where 'http://redirdomain.com' is the url where you want to send traffic to and 'http://mydomain.com/' the referer you want to display).

Tested and working with the following browsers:
- IE 7+
- Chrome 29+
- FF 14+
- Opera 12
- Edge
- Safari 7+
- Chrome Mobile (Android 4.4+)
- Safari Mobile (IOS 7.1+)

Click to expand...

fatbap said:

Thanks for this, but where does the code go? Is it index.php or something? Thanks

Click to expand...

Des_cartes said:

Depends on your site, if you are using Wordpress you could copy/past this in your header.php files but it doesn't really matter as long as the code is on the page you want to use for the fake referrer however it will speed up the redirection if it's the first code to be executed.

Click to expand...

fatbap said:

I'm going to use this, is there a way to check it's working? Thanks for you help

Click to expand...

Des_cartes said:

Yes make the redirection goes to site like https://www.whatismyreferer.com/ or https://referer.rustybrick.com

Click to expand...

fatbap said:

Hi, I replaced all the code in header.php for my site's active wp theme. Then used the link you told me to send the traffic to, using my own url and whatismyreferer.com. The first result from the test showed the referrer was successfully hidden. However every try after then shows my URL. Is there anything you can suggest as to why this is?

Click to expand...