Referrer Spoofing

sycorakX said:

Can I fake it as facebook by using that script...

Click to expand...

<?php

    echo geturl('http://some-url', 'http://referring-url');

    function geturl($url, $referer) { 

        $headers[] = 'Accept: image/gif, image/x-bitmap, image/jpeg, image/pjpeg,text/html,application/xhtml+xml'; 
        $headers[] = 'Connection: Keep-Alive'; 
        $headers[] = 'Content-type: application/x-www-form-urlencoded;charset=UTF-8'; 
        $useragent = 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)'; 

        $process = curl_init($url); 
        curl_setopt($process, CURLOPT_HTTPHEADER, $headers); 
        curl_setopt($process, CURLOPT_HEADER, 0); 
        curl_setopt($process, CURLOPT_USERAGENT, $useragent);
        curl_setopt($process, CURLOPT_REFERER, $referer);
        curl_setopt($process, CURLOPT_TIMEOUT, 30); 
        curl_setopt($process, CURLOPT_RETURNTRANSFER, 1); 
        curl_setopt($process, CURLOPT_FOLLOWLOCATION, 1); 

        $return = curl_exec($process); 
        curl_close($process); 

        return $return; 
    } 

?>

Gogol said:

No, not unless you own facebook lol. The referrer is sent by the browser, not on the server side. So you can't actually modify it using php or javascript. You can send blank referrer / spoof referrer ( from a server that you own), but can't randomly put any domain as referrer.

Actually fb had a vulnerability some time ago which allowed to use it as referrer, but it most probably has been patched by now.


However, if you want to fetch a page's content and display it on your domain, you can fake the referrer. Here's a script to do that:

Code:

<?php

    echo geturl('http://some-url', 'http://referring-url');

    function geturl($url, $referer) {

        $headers[] = 'Accept: image/gif, image/x-bitmap, image/jpeg, image/pjpeg,text/html,application/xhtml+xml';
        $headers[] = 'Connection: Keep-Alive';
        $headers[] = 'Content-type: application/x-www-form-urlencoded;charset=UTF-8';
        $useragent = 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0)';

        $process = curl_init($url);
        curl_setopt($process, CURLOPT_HTTPHEADER, $headers);
        curl_setopt($process, CURLOPT_HEADER, 0);
        curl_setopt($process, CURLOPT_USERAGENT, $useragent);
        curl_setopt($process, CURLOPT_REFERER, $referer);
        curl_setopt($process, CURLOPT_TIMEOUT, 30);
        curl_setopt($process, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($process, CURLOPT_FOLLOWLOCATION, 1);

        $return = curl_exec($process);
        curl_close($process);

        return $return;
    }

?>

Click to expand...