Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to spoof http referer

Tags:

http

As of current, are there still any methods to spoof HTTP referer?

like image 344
jack Avatar asked Jun 23 '10 19:06

jack


People also ask

Can HTTP referrer be spoofed?

In HTTP networking, typically on the World Wide Web, referer spoofing (based on a canonised misspelling of "referrer") sends incorrect referer information in an HTTP request in order to prevent a website from obtaining accurate data on the identity of the web page previously visited by the user.

How do I change HTTP referrer?

If you want to change the referer (url) header that will be sent to the server when a user clicks an anchor or iframe is opened, you can do it without any hacks. Simply do history. replaceState, you will change the url as it will appear in the browser bar and also the referer that will be send to the server.

How do I turn off referer spoofing?

Can be disabled via menu Tools > Preferences > Advanced > Network, and uncheck "Send referrer information".


2 Answers

Yes, the HTTP referer header can be spoofed.

A common way to play with HTTP headers is to use a tool like cURL:

Sending headers using cURL: How to send a header using a HTTP request through a curl call?

or

The cURL docs: http://curl.haxx.se/docs/

like image 44
labratmatt Avatar answered Sep 20 '22 01:09

labratmatt


Yes.

The HTTP_REFERER is data passed by the client. Any data passed by the client can be spoofed/forged. This includes HTTP_USER_AGENT.

If you wrote the web browser, you're setting and sending the HTTP Referrer and User-Agent headers on the GET, POST, etc.

You can also use middleware such as a web proxy to alter these. Fiddler lets you control these values.

If you want to redirect a visitor to another website and set their browser's referrer to any value you desire, you'll need to develop a web browser-plugin or some other type of application that runs on their computer. Otherwise, you cannot set the referrer on the visitor's browser. It will show the page from your site that linked to it.

What might be a valid solution in your case would be for you to load the third party page on the visitor's behalf, using whatever referrer is necessary, then display the page to the user from your server.

like image 156
Marcus Adams Avatar answered Sep 21 '22 01:09

Marcus Adams