PHP使用curl伪造IP地址和header信息

superaj 发布于
评论关闭

curl虽然功能强大，但是只能伪造$_SERVER[“HTTP_X_FORWARDED_FOR”]，对于大多数IP地址检测程序来说，$_SERVER[“REMOTE_ADDR”]很难被伪造：

首先是client.php的代码

view source
01$headers['CLIENT-IP'] = '202.103.229.40'; 
02$headers['X-FORWARDED-FOR'] = '202.103.229.40';
03 
04$headerArr = array(); 
05foreach( $headers as $n => $v ) { 
06    $headerArr[] = $n .':' . $v;  
07}
08 
09ob_start();
10$ch = curl_init();
11curl_setopt ($ch, CURLOPT_URL, "http://localhost/curl/server.php");
12curl_setopt ($ch, CURLOPT_HTTPHEADER , $headerArr );  //构造IP
13curl_setopt ($ch, CURLOPT_REFERER, "http://www.163.com/ ");   //构造来路
14curl_setopt( $ch, CURLOPT_HEADER, 1);
15 
16curl_exec($ch);
17curl_close ($ch);
18$out = ob_get_contents();
19ob_clean();
20 
21echo $out;

然后是server.php

view source
01function GetIP(){
02    if(!emptyempty($_SERVER["HTTP_CLIENT_IP"]))
03        $cip = $_SERVER["HTTP_CLIENT_IP"];
04    else if(!emptyempty($_SERVER["HTTP_X_FORWARDED_FOR"]))
05        $cip = $_SERVER["HTTP_X_FORWARDED_FOR"];
06    else if(!emptyempty($_SERVER["REMOTE_ADDR"]))
07        $cip = $_SERVER["REMOTE_ADDR"];
08    else
09    $cip = "无法获取！";
10    return $cip;
11}
12echo "<br>访问IP: ".GetIP()."<br>";
13echo "<br>访问来路: ".$_SERVER["HTTP_REFERER"];

 

分类：Web相关

评论关闭