Referer spoofing
From Wikipedia, the free encyclopedia
 |
This article does not cite any references or sources. (March 2008) Please help improve this article by adding citations to reliable sources. Unverifiable material may be challenged and removed. |
In computer security, referer spoofing or ref tar spoofing is the sending of incorrect referer information along with an HTTP request, sometimes with the aim of gaining unauthorized access to a web site. It can also be used because of privacy concerns, as an alternative to sending no referer at all.
[edit] Application
Some subscription sites, especially many pornographic paysites, utilize referer information to secure their materials: only browsers arriving from a small set of approved (login-) pages are given access; this facilitates the sharing of materials among a group of cooperating paysites. If attackers acquire knowledge of these approved referers (which is often trivial because many sites follow a common template), they can then gain free access to the materials.
Spoofing often allows legitimate access to a site's content where the site's web server is configured to block browsers not sending referer headers. Web site owners may do this to disallow hotlinking.
[edit] Tools
Several software tools exist to facilitate referrer spoofing:
- Proxomitron is a proxy capable of referrer spoofing.
- The Mozilla Firefox extension refspoof [1] allows to use a custom referer URL for any site one visits, and provides a mechanism to manage a bookmark list of such referer/site pairs.
- QuickSpoof and Spooph provide the same functionality for the Internet Explorer browser.
- SuperMegaSpoof [2] is a Windows application that supports both browsers and allows users to exchange and rate referer spoofs; it displays advertisements while it is running.
