Referer Spoofing?

Status
Not open for further replies.
N

natekapi

New member
Dec 27, 2006
457
1
0
South Beach
www.spoofcard.com
Do a lot of people do http referer spoofing to hide where their clicks are really coming from? I've been toying with the idea of this for a while, but I haven't been able to successfully program something that works and I haven't found anything that looks like it does what I want it to do on google.

This seems pretty grey area/black hat, so I figured this was the right forum to ask on ;)
 


The basic way is to just set up a landing page with a 302 redirect. It will replace the incoming referrer with the url of the landing page.

Get firefox and the LiveHttpHeaders plugin to verify everything is working correctly while you're working out your solution.
 
Not sure why you'd bother. If you do not wish to let the webmaster know how you got to their page, you could turn off Referrer Logging in your browser. This way their log will not show how you got to their site.
 
shaggz said:
The basic way is to just set up a landing page with a 302 redirect. It will replace the incoming referrer with the url of the landing page.

Get firefox and the LiveHttpHeaders plugin to verify everything is working correctly while you're working out your solution.
Click to expand...

Every time I tested 302's the referer wasn't replaced. I was using FF and LiveHttpHeaders. This is what I was doing:

I setup a test page, say www.example.com/index.html. I click a link on this index.html page, which links to www.site.com/refer. www.site.com/refer has an htaccess file with a 302, redirecting it to www.affiliate.com/refer-123.

LiveHttpHeaders shows the referal link as www.example.com/index.html when it goes to www.affiliate.com/refer-123

So, say www.example.com/index.html is bulletin.myspace.com. Don't you think it would be bad if your affiliates see your referal coming in from bulletin.myspace.com, meaning your probably spamming bulletins on myspace?

I'm not spamming myspace or trying to, it's just the easiest example I can think of off the top of my head.
 
natekapi said:
Every time I tested 302's the referer wasn't replaced. I was using FF and LiveHttpHeaders. This is what I was doing:

I setup a test page, say www.example.com/index.html. I click a link on this index.html page, which links to www.site.com/refer. www.site.com/refer has an htaccess file with a 302, redirecting it to www.affiliate.com/refer-123.

LiveHttpHeaders shows the referal link as www.example.com/index.html when it goes to www.affiliate.com/refer-123

So, say www.example.com/index.html is bulletin.myspace.com. Don't you think it would be bad if your affiliates see your referal coming in from bulletin.myspace.com, meaning your probably spamming bulletins on myspace?

I'm not spamming myspace or trying to, it's just the easiest example I can think of off the top of my head.
Click to expand...

You're right, Nate. I got mixed up with another process i was doing. As you said, the straight 302 won't replace the referrer. What you can do is 1 of two things......

a) put a javascript redirect or a metaRefresh in the landing page. This will replace the referrer

b) put an iframe on the landing page and set the source of the lFrame to be your affiliate link.
 
I just played around with the meta refresh method and noticed a downside. Theres no referer string sent in the headers, so it looks kinda weird, like someone typed your affiliate link in directly to their browser...and how often does that actually happen?..

I'm sure you can send the http headers with php, it's just that I dunno how to do that yet.
 
Neil Patel said:
I have never done it, but yea I would classify it as a "gray" technique.
Click to expand...
Way to add to the conversation

Found this referrer spoofing script. You could just modify it so that instead of sending the data from the form you just input it yourself and use the backend when referring
 
natekapi said:
I just played around with the meta refresh method and noticed a downside. Theres no referer string sent in the headers, so it looks kinda weird, like someone typed your affiliate link in directly to their browser...and how often does that actually happen?..

I'm sure you can send the http headers with php, it's just that I dunno how to do that yet.
Click to expand...

If you want to rewrite the headers, then you're acting more as a proxy.....i.e., the users request is going through you, and you're rewriting their headers and forwarding to the destination domain. I'm sure there's something out there that can do that, but that's getting a bit complicated.

If you use the iframe technique, the referrer will be populated correctly as you need it. That's probably the *easiest* solution for your requirement.
 
What I can remember neither 302 redirects, meta refresh nor javascript redirection send any referer at all.

But do like shaggz said "Get firefox and the LiveHttpHeaders plugin to verify everything is working correctly while you're working out your solution."
 
Status
Not open for further replies.
Top Bottom