PHP curl伪造IP地址和header信息代码实例

curl虽然功能强大，但是只能伪造$_server["http_x_forwarded_for"]，对于大多数ip地址检测程序来说，$_server["remote_addr"]很难被伪造：

首先是client.php的代码

$headers['client-ip'] = '202.103.229.40'; 
$headers['x-forwarded-for'] = '202.103.229.40';
 
$headerarr = array(); 
foreach( $headers as $n => $v ) { 
    $headerarr[] = $n .':' . $v;  
}
 
ob_start();
$ch = curl_init();
curl_setopt ($ch, curlopt_url, "http://localhost/curl/server.php");
curl_setopt ($ch, curlopt_httpheader , $headerarr );  //构造ip
curl_setopt ($ch, curlopt_referer, "http://www.163.com/ ");   //构造来路
curl_setopt( $ch, curlopt_header, 1);
 
curl_exec($ch);
curl_close ($ch);
$out = ob_get_contents();
ob_clean();
 
echo $out;

然后是server.php

function getip(){
    if(!emptyempty($_server["http_client_ip"]))
        $cip = $_server["http_client_ip"];
    else if(!emptyempty($_server["http_x_forwarded_for"]))
        $cip = $_server["http_x_forwarded_for"];
    else if(!emptyempty($_server["remote_addr"]))
        $cip = $_server["remote_addr"];
    else
    $cip = "无法获取！";
    return $cip;
}
echo "<br>访问ip: ".getip()."<br>";
echo "<br>访问来路: ".$_server["http_referer"];