how to spoof http referer

Question

Hi

As of current, are there still any methods to spoof http referer?

thank you.

Answer 1

Yes, the HTTP referer header can be spoofed.

A common way to play with HTTP headers is to use a tool like cURL:

Sending headers using cURL: http://stackoverflow.com/questions/356705/how-to-send-a-header-using-a-http-request-through-a-curl-call

or

The cURL docs: http://curl.haxx.se/docs/

Answer 2

Yes of course. Browser can avoid to send it, and it can be also "spoofed". There's an addon for firefox (I haven't tried it myself) and likely you can use also something like privoxy (but it is harder to make it dynamically changing). Using other tools like wget, is as easy as setting the proper option.

Answer 3

Yes.

The HTTP_REFERER is data passed by the client. Any data passed by the client can be spoofed/forged. This includes HTTP_USER_AGENT and even REMOTE_ADDR.

If you wrote the web browser, you're setting and sending the HTTP Referer and User-Agent headers on the GET, POST, etc.

You can also use middle ware such as a web proxy to alter these. Fiddler lets you control these values.

With proper rights on the OS, you can even change the source IP Address in the packet, which affects REMOTE_ADDR.

If you want to redirect a visitor to another website and set their browser's referer to any value you desire, you'll need to develop a web browser-plugin or some other type of application that runs on their computer. Otherwise, you cannot set the referer on the visitor's browser. It will show the page from your site that linked to it.

What might be a valid solution in your case would be for you to load the third party page on the visitor's behalf, using whatever referer is necessary, then display the page to the user from your server.

Answer 4

Yes, I know we can spoof it from our side. What I mean is

1- A visitor visits to my web site 2- my web site redirects him to another site 3- the another site is now seeing my site as http referer

In this case, how can I spoof it? I know that leaving as blank http referer is possible. I only want to know how http referer can be changed in visitor's browser using some plugins or some hacks.