php: spoofing referrer ?

Question

how do I spoof a referrer ?

originalsite.com has

header("Location: http://www.example.org");

I tried putting header("Location: http://www.destination.com"); in example.org

but checking the referer at destination.com, it shows originalsite.com as referer not example.org !

Answer 1

You cannot, in an HTTP Response, instruct a client to send any specific HTTP header when it makes its next HTTP Request.

Answer 2

"Referer" is a header sent by the web browser, and it's usually the last page the browser saw. You can't tell the browser what to show there, unless you own www.example.com and can set stuff up to bounce to you.

Answer 3

When you use header() in PHP with Location, it doesn't send any headers straight to where you set the Location. Instead, it sends headers back to the browser (the "Response" headers), then the browser makes another request to the indicated Location with a new set of "Request" headers. Only the user agent has control over the Request headers.

This means you'll have to make the request from the client perspective-- either with JavaScript, or more appropriately in this case, cURL (allows PHP to make additional HTTP requests from within a script).

EDIT: To spoof a referer with cURL, you would create a cURL resource then use this before executing the request:

curl_setopt($ch, CURLOPT_REFERER, 'fakereferer.org');

Answer 4

To elaborate on cHao's method:

example.com has a file on the server called bounce.php which has the following code:

<?php
// This is contained in bounce.php on example.com
$site = isset($_GET['site'])?$_GET['site']:null;
$safe_list = array("domain.com", "domain2.com"); // prevent others from using script for bad reasons

if (!empty($site) && in_array($site, $safe_list)) {
    header('Location: http://' . $site);
    exit;
}
?>

This is an example on usage on otherdomain.com

<?php
header('Location: http://example.com/bounce.php?site=domain.com');
exit;
?>

That should ensure the "bounce". But just know that if the user has the referrer turned off or set to something they wanted custom, this will not work for that situation.

The safe_list is to help prevent someone from using that page for their own purposes, basically only sites you say can be bounced to are allowed.

Update

Hopefully that is what you are looking for and I did not mis-interpret it.