Naughty hotlinking possible?

hotlinking becomimg linking

[nilloc]

hello,

I was asking myself if it would be possible to change a hot linking mod_rewrite into a real linking.

Meaning is that people who hotlink to an image are in reality putting a backlink to my site on their page so that instead of stealing bandtwidth they are giving a backlink and maybe some good PR to my site at the same time.

Currently my last line in the hotlink rule serves a banner called "hot.png" that invites to visit my website, as follows:

RewriteRule .*\.(gif¦jpg¦jpeg¦bmp)$ [widgets.com...] [R,NC]

would it be possible to serve the replacement image and the link at the same time, something as:

<a href="http://widgets.com"><img border="0" src="http://widgets.com/hot.png"></a>

thinking naughty,

[jeremy goodrich]

As I don't have any experience using rewrite rules to prevent bandwidth leeching, I don't know if the above will work. However, what I would suggest you do is to try it out on a subdirectoy that you create on your site for testing - then see what happens.

If the rewrite rule changes from an image link or what not to a hyperlink to your site...then it works the way you are trying to get it to work. :)

As for passing pagerank, etc - if it's a link, Googlebot will try to follow, and for other engines, if it's a link, they will add it to your 'popularity' or 'reputation' sore (afaik).

[DrDoc]

What you want to do cannot be accomplished unless the link functionality is built-in into the image itself.

[grahamstewart]

Just speculating but... couldn't this be achieved by sending back a

Location:

header?

Not sure if you can do that from Rewrite tho - but I think you could rewrite the URL so that it called a php script which then set the header.

Sorry, not enough experience here to be more specific - just throwing in my ideas...

[nilloc]

Hi,

I think to better forget about this, if it cannot be done

[TallTroll]

The code in the "target" site will be of the form

<img src="http://www.yourdomain.com/image.gif">

Now, you can (and I have) changed what image gets served to that call, and if the hotlinkers are careless enough not to use height / width attributes, you can even serve a full page image, completely covering the screen

But you can't change the code on the target page, so you can't add a link...

>> called a php script

... but with the right skills (skillz?) you might be able to create a script called image.gif that ran, and did something tricksy (although whether you can actually get a browser to do that or not is utterly beyond me. I suspect not, or someone would already be doing it)

[charlier]

You probably could use php to send whatever content you wished to the browser. Have the link request a gif that does not exist then create a 404 page in a directory which pulls in a php prepend file that captures the request information, then you can send back whatever header/content you wish. I actually saw this happening with a script that I wrote to display email archives from a database, the page designer added some clearpixel.gifs to space out the content but they weren't in the right place so it called my 404 page instead, made for some hair pulling debugging.

One problem may be that the browser already expects to display a gif and ignores your content headers in which case the display would be a mess. I don't think this will happen as I think the browser 'forgets' what it was requesting and simply displays according to the headers sent from the server. For instance I send .pdf files as octet data so the user can select to save the file rather than have Acrobat fire up. You may have to find an http expert to help you with the browser/server header negotiation aspect.

Good Luck

[dmorison]

Not possible i'm afraid. You will not convince any well-written user-agent to render interactive content onto the canvas via the <img> tag.

[waitman]

Hello

I agree that the browser would not behave as you desire. However, you might want to set up a subdomain 'images.freakinexample.com' and feed all requests for images to index.php.

In index.php you would have to send the content-type, etc. and spit out an image. Or, something that may improve performance would be to rewrite all .jpeg files to your index.php and do a header('location to the same requested file, except it has a '.jpg' extension. (like goodxxx.jpeg hops over to goodxxx.jpg)

You would have to see if blowing the jpegs out through php fpassthru or readfile had a performance penalty - but I think the word on the street is that it is negligable.

Then you should be able to make index.php a smart extension of the web server by modifying the images using gd functions, or select alternate images, based on the signature of the visitor.

For example, you could write naughty text on the images and send them out to visitors that do not accept your cookies. Or perhaps plaster your domain name all over images requested by visitors that do not transmit referrer information, or their referrer information does not match any of your domains. You just got lucky enough to have your photos plastered all over some high traffic porn chatter site, without regard to your true subject.

I have even had it send filename information back in the header content. With a little tricked out code you can convince the thing to name all of the images the same name, which causes a ruckus with people trying to save all your images. Even using wget, you end up downloading a bunch of xxx.jpg.n where n is a number. Of course, you don't have to actually reference the images in the html document that way.

Be mindful that there are a good many people using squid cache with a paranoid configuration, that does not allow much of anything to identify the signature of the visitor. And of course the people with firewalls configured to block cookies. But I imagine that they are all used-to abused by now.

Anyhow, I think you are on the right track.

Best Regards,

Waitman Gobble
snip
snip

[edited by: DaveAtIFG at 12:59 pm (utc) on Aug. 11, 2003]
[edit reason] Removed signature [/edit]

[waitman]

But do keep in mind it is not failsafe. You can fool some of the people some of the time, whatever.

There is almost always a way around whatever fence you put up, "if you can play it out-the speakers there is no question you can copy it" kind of thing.

Best Regards,

Waitman Gobble

[edited by: DaveAtIFG at 12:57 pm (utc) on Aug. 11, 2003]
[edit reason] Removed signature [/edit]