PHP page jump and cross-site submission forged Referer address source_PHP tutorial

This article will introduce to you two specific implementations of page jumps and cross-site submission of forged Referer address sources using PHP. The method mainly uses two functions: fsockopen and curl. Friends who need to know more can refer to it.

1. Tried URL jump methods

The code is as follows Copy code 代码如下 复制代码 echo ' ';

echo ' window.location.href="'.$url.'"; ';

echo ' window.location.replace="'.$url.'"; ';

echo ' ';

echo ' window.location.href="'.$url.'"; '; echo ' window.location.replace="'.$url.'"; ';

代码如下 复制代码 $uinfo = parse_url($url);//解析URL地址，比如http://php100.com/archives/1.html

if($uinfo['path']) //

$data = $uinfo['path'];//这里得到/archives/1.html

else

$data = '/';//默认根

if(!$fsp = @fsockopen($uinfo['host'], (($uinfo['port']) ? $uinfo['port'] : "80"), $errno, $errstr, 12)){

echo "对不起对方网站暂时无法打开，请您稍后访问：".$uinfo['host']; exit;

}else{

fputs($fsp, "GET “.$data .” HTTP/1.0rn");//如果是跨站POST提交，可使用POST方法

fputs($fsp, "Host: ".$uinfo['host']."rn");

fputs($fsp, "Referer: php100.comrn");//伪造REFERER地址

fputs($fsp, "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)rnrn");

$res='';

while(!feof($fsp)) {

$res.=fgets($fsp, 128);

if(strstr($res,"200 OK")) {

header("Location:$url"); exit;

}

//如果是301或302状态码可以继续处理

//返回地址大概形式：HTTP/1.1 301 Moved PermanentlynContent-Length: 164nContent-Type: text/htmlnLocation: http://php100.com/

$arr=explode("n",$res);

$arr=explode(": ",$arr[3]);//Location后面是真实重定向地址

header("location:".$arr[0]);//跳转目标地址

exit;

None of the above three methods can pass the REFERER address. 2. Use the PHP Socket function to forge REFERThe following is the PHP forged REFERER code part. After testing, the REFERER address can be passed, where $url is the input address. The code is as follows Copy code $uinfo = parse_url($url);//Parse URL address, such as http://php100.com/archives/1.htmlif($uinfo[ 'path']) // $data = $uinfo['path'];//Here you get /archives/1.htmlelse $data = '/';//Default rootif(!$fsp = @fsockopen($uinfo['host'], (($uinfo['port']) ? $uinfo['port'] : "80"), $errno, $errstr, 12)){ echo "Sorry, the other party's website cannot be opened temporarily, please visit later:".$uinfo['host']; exit;}else{ fputs($fsp, "GET “.$data .” HTTP/1.0rn");//If it is a cross-site POST submission, you can use the POST method fputs($fsp, "Host: ".$uinfo['host']."rn"); fputs($fsp, "Referer: php100.comrn");//Fake REFERER address fputs($fsp, "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)rnrn"); $res=''; while(!feof($fsp)) { $res.=fgets($fsp, 128); if(strstr($res,"200 OK")) { header("Location:$url"); exit; } }}//If it is 301 or The 302 status code can continue to be processed //The approximate form of the return address: HTTP/1.1 301 Moved PermanentlynContent-Length: 164nContent-Type: text/htmlnLocation: http://php100.com/ $arr=explode("n",$res);$arr=explode(": ",$arr[3]);//Location is followed by the real redirect address header("location:".$arr[0]);//Jump target addressexit; Use another method curl) to fake HTTP_REFERER

The code is as follows 代码如下 复制代码 //PHP(前提是装了curl): $ch = curl_init(); curl_setopt ($ch, CURLOPT_URL, "http://www.bkjia.com/"); curl_setopt ($ch, CURLOPT_REFERER, "http://www.bkjia.com/"); curl_exec ($ch); curl_close ($ch);

//PHP(不装curl用sock) $server = 'blog.qita.in'; $host = 'blog.qita.in'; $target = '/xxx.asp'; $referer = 'http://www.baidu.com/'; // Referer $port = 80; $fp = fsockopen($server, $port, $errno, $errstr, 30); if (!$fp) { echo "$errstr ($errno) n"; } else { $out = "GET $target HTTP/1.1rn"; $out .= "Host: $hostrn"; $out .= "Cookie: ASPSESSIONIDSQTBQSDA=DFCAPKLBBFICDAFMHNKIGKEGrn"; $out .= "Referer: $refererrn"; $out .= "Connection: Closernrn"; fwrite($fp, $out); while (!feof($fp)) { echo fgets($fp, 128); } fclose($fp); }

Copy code //PHP (provided curl is installed): $ch = curl_init();curl_setopt ($ch , CURLOPT_URL, "http://www.bkjia.com/"); curl_setopt ($ch, CURLOPT_REFERER, "http://www.bkjia.com/");

curl_exec ($ch); curl_close ($ch); //PHP (use sock without curl) $server = 'blog.qita.in'; $host = 'blog.qita. in'; $target = '/xxx.asp'; $referer = 'http://www.baidu.com/'; // Referer $port = 80; $ fp = fsockopen($server, $port, $errno, $errstr, 30); if (!$fp) { echo "$errstr ($errno) n “; = "Cookie: ASPSESSIONIDSQTBQSDA=DFCAPKLBBFICDAFMHNKIGKEGrn"; $out .= "Referer: $refererrn"; $out .= "Connection: Closernrn"; 🎜 > while (!feof($fp)) { echo fgets($fp, 128); } fclose($fp);}

http://www.bkjia.com/PHPjc/444608.htmlwww.bkjia.comtruehttp: //www.bkjia.com/PHPjc/444608.htmlTechArticleThis article will introduce to you two ways to use php to achieve page jumps and cross-site submission of fake Referer address sources. The implementation method mainly uses two functions: fsockopen and curl. If you need to know more...