How to spoof http referer

Question

As of current, are there still any methods to spoof HTTP referer?

The client has *full control* over the request. Both the headers and the body. — BalusC, Jun 23 '10 at 19:25
The ability to spoof the referer and other header variables will always be apart of http. — rook, Jun 23 '10 at 19:34
Well, you can't spoof the Request URL header unless you hack the DNS because it will just go to a different server. Anything else can be trivially spoofed. — Peter Kionga-Kamau, Jul 28 '19 at 19:55

Marcus Adams · Answer 1 · 2014-10-29T13:17:51.183

Yes.

The HTTP_REFERER is data passed by the client. Any data passed by the client can be spoofed/forged. This includes HTTP_USER_AGENT.

If you wrote the web browser, you're setting and sending the HTTP Referrer and User-Agent headers on the GET, POST, etc.

You can also use middleware such as a web proxy to alter these. Fiddler lets you control these values.

If you want to redirect a visitor to another website and set their browser's referrer to any value you desire, you'll need to develop a web browser-plugin or some other type of application that runs on their computer. Otherwise, you cannot set the referrer on the visitor's browser. It will show the page from your site that linked to it.

What might be a valid solution in your case would be for you to load the third party page on the visitor's behalf, using whatever referrer is necessary, then display the page to the user from your server.

changing REMOTE_ADDR requires a lot more than root on the client's OS. It requires control over (or being on the same network segment as) the IP address you're attempting to spoof, as this is TCP, and you have to have two-way communication for it to work. — Yuliy, Nov 13 '10 at 21:05
Is it possible to do it without a proxy ? Like, can we set the header in the HTML/Javascript code so that the referef is changed ? — Jason Krs, May 21 '19 at 15:51

score 7 · Answer 2 · edited May 23 '17 at 11:46

7

Yes, the HTTP referer header can be spoofed.

A common way to play with HTTP headers is to use a tool like cURL:

Sending headers using cURL: How to send a header using a HTTP request through a curl call?

or

The cURL docs: http://curl.haxx.se/docs/

edited May 23 '17 at 11:46

Community

1
1

answered Jun 23 '10 at 19:03

labratmatt

1,821
2
20
21

adding this not works for me curl_setopt($ch, CURLOPT_REFERER, 'http://www.example.com/1'); – Kamal Kumar Oct 26 '16 at 06:03
can you provide some example code. – Rajeev Ranjan Sharma Jan 06 '22 at 07:12

score 3 · Answer 3 · answered Jun 23 '10 at 19:05

Yes of course. Browser can avoid to send it, and it can be also "spoofed". There's an addon for firefox (I haven't tried it myself) and likely you can use also something like privoxy (but it is harder to make it dynamically changing). Using other tools like wget, is as easy as setting the proper option.

How to spoof http referer

3 Answers3

Linked

Related