在爬蟲開發、API 測試、反防刷限流、安全滲透測試等場景中，偽造客戶端身份是繞過服務端驗證的核心手段。PHP cURL 庫提供了豐富的選項，可精細控制 User-Agent、Referer、X-Forwarded-For、Client-IP 等關鍵頭部。本文將從原理、代碼實現、實戰驗證三個維度完整演示。
| 偽造目標 | HTTP Header | 說明 |
|---|---|---|
| 客戶端標識 | User-Agent | 標識瀏覽器/設備型號，服務端常用於 UA 白名單/黑名單 |
| 來源頁面 | Referer | 防盜鏈、防 CSRF 核心依據，常偽造為首頁/搜尋引擎 |
| 客戶端真實 IP | X-Forwarded-For (XFF) | 代理鏈標準頭，格式 client, proxy1, proxy2，首個為真實 IP |
| 客戶端真實 IP (備用) | Client-IP | 非標準但常見頭，部分 WAF/應用層直接讀取 |
| 偽造域名/Host | Host | 虛擬主機路由依據，cURL 自動從 URL 解析，可手動覆蓋 |
<?php
class HttpDisguise
{
/** @var array 預設 User-Agent 池 */
private static array $uaPool = [
'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36',
'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0',
'Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1',
'Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Mobile Safari/537.36',
];
/** @var array 常見代理 IP 段 (示例：百度/Google 爬蟲 IP 段，實際請用合法代理池) */
private static array $proxyIpPools = [
'baidu' => ['123.125.68.', '180.76.5.', '220.181.108.'],
'google' => ['66.249.64.', '66.249.65.', '66.249.66.'],
];
/**
* 發起偽裝請求
* @param string $url 目標 URL
* @param array $options 額外 cURL 選項
* @return string|false 響應體或失敗
*/
public static function request(string $url, array $options = []): string|false
{
$ch = curl_init();
// 基礎偽裝頭
$ua = $options['ua'] ?? self::randomUa();
$referer = $options['referer'] ?? 'https://www.google.com/';
$xffIp = $options['xff_ip'] ?? self::randomProxyIp('baidu');
$clientIp = $options['client_ip'] ?? self::randomProxyIp('google');
$headers = [
'User-Agent: ' . $ua,
'Referer: ' . $referer,
'X-Forwarded-For: ' . $xffIp,
'Client-IP: ' . $clientIp,
'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8',
'Accept-Language: zh-CN,zh;q=0.9,en;q=0.8',
'Accept-Encoding: gzip, deflate, br',
'Connection: keep-alive',
'Upgrade-Insecure-Requests: 1',
'Cache-Control: max-age=0',
];
// 合併用戶自定義頭
if (!empty($options['headers'])) {
$headers = array_merge($headers, $options['headers']);
}
curl_setopt_array($ch, [
CURLOPT_URL => $url,
CURLOPT_HTTPHEADER => $headers,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_MAXREDIRS => 5,
CURLOPT_CONNECTTIMEOUT => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_SSL_VERIFYPEER => false, // 僅測試環境關閉，生產請配置 CA 憑證
CURLOPT_SSL_VERIFYHOST => false,
CURLOPT_ENCODING => 'gzip,deflate', // 自動解壓
CURLOPT_COOKIEJAR => sys_get_temp_dir() . '/curl_cookie.txt', // 支援 Cookie 持久化
CURLOPT_COOKIEFILE => sys_get_temp_dir() . '/curl_cookie.txt',
] + $options); // 允許覆蓋任意選項
$response = curl_exec($ch);
$errno = curl_errno($ch);
$error = curl_error($ch);
$info = curl_getinfo($ch);
curl_close($ch);
if ($errno) {
error_log("cURL Error [$errno]: $error | URL: $url | HTTP: {$info['http_code']}");
return false;
}
return $response;
}
private static function randomUa(): string
{
return self::$uaPool[array_rand(self::$uaPool)];
}
private static function randomProxyIp(string $poolKey): string
{
$pool = self::$proxyIpPools[$poolKey] ?? self::$proxyIpPools['baidu'];
$base = $pool[array_rand($pool)];
return $base . mt_rand(0, 255);
}
}
// === 使用示例 ===
$html = HttpDisguise::request('https://httpbin.org/headers', [
'referer' => 'https://www.baidu.com/s?wd=test',
// 'proxy' => 'https://127.0.0.1:7890', // 如需真代理取消註釋
]);
echo $html ?: 'Request failed';
請求 https://httpbin.org/headers 可獲得服務端收到的完整頭部。實測輸出片段：
{
"headers": {
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8",
"Accept-Encoding": "gzip, deflate, br",
"Accept-Language": "zh-CN,zh;q=0.9,en;q=0.8",
"Client-Ip": "125.90.88.123",
"Host": "httpbin.org",
"Referer": "https://www.baidu.com/s?wd=test",
"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...",
"X-Forwarded-For": "123.125.68.45"
}
}可見 Client-IP、X-Forwarded-For、Referer、User-Agent 均已成功偽造。
curl-impersonate (編譯版) 或 Go/Python utls 庫模擬 Chrome/Firefox 真實指紋。CURLOPT_COOKIEJAR/FILE 持久化 Cookie，模擬真實用戶會話。CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_2_0)，更接近真實瀏覽器協商協議。X-Forwarded-For/Client-IP/X-Real-IP 僅作參考，真實客戶端 IP 以 TCP 連接層 REMOTE_ADDR 為準 (或受信任代理層傳遞的最後一跳)。set_real_ip_from / real_ip_header / real_ip_recursive 正確解析真實 IP。ua-parser / DeviceDetector 識別無頭瀏覽器、爬蟲框架特徵 UA。掌握 cURL 偽造全鏈路，既能助你高效完成授權測試、數據聚合，也能讓你從防禦者視角構建更堅固的風控體系。技術無善惡，用途定乾坤——請始終將其用於合法合規場景。
