木子屋 Dnawo's BLOG

ASP伪造REFERER实例

👤 dnawo 📅 2008-02-27 👁 8116 👍 0 💬 0 🔄 本站原创
index.asp代码:
<%
Function GetBody(weburl) 
	Set Retrieval = Server.CreateObject("MSXML2.XMLHTTP") 
	With Retrieval 
		.Open "Get", weburl, False, "", "" 
		.setRequestHeader "referer","http://www.hao123.com/"'想改什么就改什么
		.Send 
		GetBody = .ResponseBody
	End With 
	GetBody = BytesToBstr(GetBody,"GB2312")
	Set Retrieval = Nothing 
End Function

Function BytesToBstr(body,Cset)
        dim objstream
        set objstream = Server.CreateObject("adodb.stream")
        objstream.Type = 1
        objstream.Mode =3
        objstream.Open
        objstream.Write body
        objstream.Position = 0
        objstream.Type = 2
        objstream.Charset = Cset
        BytesToBstr = objstream.ReadText 
        objstream.Close
        set objstream = nothing
End Function

Response.Write(GetBody("http://www.mzwu.com/referer.asp"))
%> 

referer.asp代码:
<% =Request.ServerVariables("HTTP_REFERER") %>

看到了吧,referer.asp中显示的是"http://www.hao123.com/",既然REFERER可以伪造,那阻止外部提交还有用吗?

评论(0)

暂无评论。

计算题
评论需审核通过后显示
← 上一篇 借用hosts轻松破解阻止外部提交 下一篇 → 常见SP专业术语