Substitution of HTTP abstract data using ASP.NET

Question

The answers here and on various other sites are often full of warnings not to trust HTTP Referrer headers because they are “so easily” tampered with or tampered with.

Before I go any further - no, I'm not fine, but I want to run some source-specific tests.

Although I have no doubt that the warnings about fake referrers are correct, I cannot find much detailed information on how they can be manipulated. Even the Wikipedia article talks about this only in general terms.

I am going to play with the RefControl addin for FireFox.

Programmatically (in ASP.NET specifically) UrlReferrer is a read -only property, so I don’t see how I can reset requests with fake referrer data if I cannot set it? Do I need to do this manually?

How can I use ASP.NET to send a request to my site with a user-defined variable to populate the referrer header?

EDIT:. According to my comment below, I ideally want to accept an incoming request, manupulate the referrer data, and then transfer the request to another page, intact. If I can make it intact by creating a new one from scratch and copying the original properties, then this is also good.

Answer 1

I don’t know if this is really what you want, but in general you can fool the value of the UrlReferer property (even if it is read-only) in HttpContext.Current.Request using a little reflection.

For example:

 FieldInfo fi = HttpContext.Current.Request.GetType().GetField("_referrer", BindingFlags.NonPublic | BindingFlags.Instance); string initialReferer = HttpContext.Current.Request.UrlReferrer.ToString(); if (fi != null) fi.SetValue(HttpContext.Current.Request, new Uri("http://example.com")); string fakedReferer = HttpContext.Current.Request.UrlReferrer.ToString(); 

In VS; These are the values ​​before and after changing the UrlReferrer:

 initialReferer "http://localhost/Test/Default.aspx" fakedReferer "http://example.com/" 

If you open the System.Web assembly using ILSpy , you will notice that the UrlReferrer property looks something like this:

 public Uri UrlReferrer { get { if (this._referrer == null && this._wr != null) { string knownRequestHeader = this._wr.GetKnownRequestHeader(36); if (!string.IsNullOrEmpty(knownRequestHeader)) { try { if (knownRequestHeader.IndexOf("://", StringComparison.Ordinal) >= 0) { this._referrer = new Uri(knownRequestHeader); } else { this._referrer = new Uri(this.Url, knownRequestHeader); } } catch (HttpException) { this._referrer = null; } } } return this._referrer; } } 

Answer 2

You probably won't get what you want. But you can edit the link to HttpWebRequest. I don’t think there is a way to edit the referrer of your request in context.

 using System.Net; HttpWebRequest Req= (HttpWebRequest)System.Net.HttpWebRequest.Create("http://somewhere.com/"); Req.Referer = "http://www.fakesite.com";