ASP伪造REFERER实例

index.asp代码:
<%
Function GetBody(weburl)
    Set Retrieval = Server.CreateObject("MSXML2.XMLHTTP")
    With Retrieval
        .Open "Get", weburl, False, "", ""
        .setRequestHeader "referer","http://www.hao123.com/"'想改什么就改什么
        .Send
        GetBody = .ResponseBody
    End With
    GetBody = BytesToBstr(GetBody,"GB2312")
    Set Retrieval = Nothing
End Function

Function BytesToBstr(body,Cset)
        dim objstream
        set objstream = Server.CreateObject("adodb.stream")
        objstream.Type = 1
        objstream.Mode =3
        objstream.Open
        objstream.Write body
        objstream.Position = 0
        objstream.Type = 2
        objstream.Charset = Cset
        BytesToBstr = objstream.ReadText
        objstream.Close
        set objstream = nothing
End Function

Response.Write(GetBody("http://www.mzwu.com/referer.asp"))
%>

referer.asp代码:
<% =Request.ServerVariables("HTTP_REFERER") %>

看到了吧,referer.asp中显示的是"http://www.hao123.com/",既然REFERER可以伪造,那阻止外部提交还有用吗?

上一篇: 借用hosts轻松破解阻止外部提交
下一篇: 常见SP专业术语
文章来自: 本站原创
引用通告: 查看所有引用 | 我要引用此文章
Tags:
最新日志:
评论: 0 | 引用: 0 | 查看次数: 7251
发表评论
登录后再发表评论!