Referer spoofing

In HTTPnetworking, typically on the World Wide Web, referer spoofing (based on a canonized^[1] misspelling of referrer) sends incorrect referer information in an HTTP request in order to prevent a website from obtaining accurate data on the identity of the web page previously visited by the user.

Referer spoofing is typically done for data privacy reasons, in testing, or in order to request information (without genuine authority) which some web servers may only supply in response to requests with specific HTTP referers.

To improve their privacy, individual browserusers may replace accurate referer data with inaccurate data, though many simply suppress their browser's sending of any referer data. Sending no referrer information is not technically spoofing, though sometimes also described as such.

In software, systems and networks testing, and sometimes penetration testing, referer spoofing is often just part of a larger procedure of transmitting both accurate and inaccurate as well as expected and unexpected input to the HTTPD system being tested and observing the results.^[2]

While many websites are configured to gather referer information and serve different content depending on the referer information obtained, exclusively relying on HTTP referer information for authentication and authorization purposes is not a genuine computer security measure. HTTP referer information is freely alterable and interceptable, and is not a password, though some poorly configured systems treat it as such.

Some websites, especially many image hosting sites, use referer information to secure their materials: only browsers arriving from their web pages are served images. Additionally a site may want users to click through pages with advertisements before directly being able to access a downloadable file – using the referring page or referring site information can help a site redirect unauthorized users to the landing page the site would like to use.

If attackers acquire knowledge of these approved referrers, which is often trivial because many sites follow a common template,^[3] they can use that information combined with this to exploit and gain access to the materials.

La suplantación de identidad a menudo permite acceder al contenido de un sitio web cuyo servidor está configurado para bloquear los navegadores que no envían encabezados de referencia. Los propietarios de sitios web pueden recurrir a esto para evitar el hotlinking .

También puede utilizarse para eludir los controles de verificación de referencia que se emplean para mitigar los ataques de falsificación de solicitudes entre sitios .

Existen varias herramientas de software para facilitar la suplantación de URL de referencia en navegadores web. Algunas son extensiones para navegadores populares como Mozilla Firefox o Internet Explorer , que ofrecen funciones para personalizar y administrar las URL de referencia de cada sitio web que visita el usuario.

Otras herramientas incluyen servidores proxy , a los que el usuario configura su navegador para que envíe todas las solicitudes HTTP. El proxy reenvía diferentes encabezados al sitio web de destino, generalmente eliminando o modificando el encabezado de referencia. Estos proxies también pueden presentar problemas de privacidad para los usuarios, ya que pueden registrar su actividad.

• Spam de referencia , un tipo de spam dirigido a los motores de búsqueda.