help to deobfuscate mp4 file from flash player #2950

Closed
opened 2026-02-20 23:11:40 -05:00 by deekerman · 6 comments
Owner

Originally created by @peugeot on GitHub (Aug 30, 2014).

hello,

im trying to reverse a video file address pattern from this site for inclusion in youtube-dl, eg:
http://www.drtuber.com/video/1724798/soft-young-lusty-brunette

in the page theres a reference to the mp4 file:

<video width="685" height="455.953125" controls="controls" poster="http://pics.drtuber.com/media/videos/tmb/1724798/player/18.jpg" preload="none">
    <source src="http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=da321b909ed1fd4d8d65bfb903233773&cdn_creation_time=1409420298&cdn_ttl=600&cdn_net=176.189.0.0.16&cdn_bw=86016&cdn_bw_fs=358400" type="video/mp4" />
</video>

unfortunately the access to the file is restricted:

Resolving a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)... 78.140.165.106, 78.140.171.56, 78.140.171.58
Connecting to a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)|78.140.165.106|:80... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: http://a18-45.1-183.cdn13.com/mp4/1724798.mp4?cdn_hash=da321b909ed1fd4d8d65bfb903233773 [following]
--2014-08-30 19:41:45--  http://a18-45.1-183.cdn13.com/mp4/1724798.mp4?cdn_hash=da321b909ed1fd4d8d65bfb903233773
Resolving a18-45.1-183.cdn13.com (a18-45.1-183.cdn13.com)... 78.140.171.56
Connecting to a18-45.1-183.cdn13.com (a18-45.1-183.cdn13.com)|78.140.171.56|:80... connected.
HTTP request sent, awaiting response... 405 Not Allowed
2014-08-30 19:41:46 ERROR 405: Not Allowed.

Any clues of how they manage to substitue the real file name ?

May the embedded video url be a weaker target ?
http://www.drtuber.com/embed/1724798

Regards.

Originally created by @peugeot on GitHub (Aug 30, 2014). hello, im trying to reverse a video file address pattern from this site for inclusion in youtube-dl, eg: http://www.drtuber.com/video/1724798/soft-young-lusty-brunette in the page theres a reference to the mp4 file: ``` <video width="685" height="455.953125" controls="controls" poster="http://pics.drtuber.com/media/videos/tmb/1724798/player/18.jpg" preload="none"> <source src="http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=da321b909ed1fd4d8d65bfb903233773&cdn_creation_time=1409420298&cdn_ttl=600&cdn_net=176.189.0.0.16&cdn_bw=86016&cdn_bw_fs=358400" type="video/mp4" /> </video> ``` unfortunately the access to the file is restricted: ``` Resolving a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)... 78.140.165.106, 78.140.171.56, 78.140.171.58 Connecting to a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)|78.140.165.106|:80... connected. HTTP request sent, awaiting response... 302 Moved Temporarily Location: http://a18-45.1-183.cdn13.com/mp4/1724798.mp4?cdn_hash=da321b909ed1fd4d8d65bfb903233773 [following] --2014-08-30 19:41:45-- http://a18-45.1-183.cdn13.com/mp4/1724798.mp4?cdn_hash=da321b909ed1fd4d8d65bfb903233773 Resolving a18-45.1-183.cdn13.com (a18-45.1-183.cdn13.com)... 78.140.171.56 Connecting to a18-45.1-183.cdn13.com (a18-45.1-183.cdn13.com)|78.140.171.56|:80... connected. HTTP request sent, awaiting response... 405 Not Allowed 2014-08-30 19:41:46 ERROR 405: Not Allowed. ``` Any clues of how they manage to substitue the real file name ? May the embedded video url be a weaker target ? http://www.drtuber.com/embed/1724798 Regards.
Author
Owner

@pcfreak30 commented on GitHub (Aug 30, 2014):

It seem's using wget works perfectly fine. I thought you may have needed to spoof the referrer but thats not the case. I accessed it in chrome and got a video player (from browser), and not a 405.

You should try again.

@pcfreak30 commented on GitHub (Aug 30, 2014): It seem's using wget works perfectly fine. I thought you may have needed to spoof the referrer but thats not the case. I accessed it in chrome and got a video player (from browser), and not a 405. You should try again.
Author
Owner

@pcfreak30 commented on GitHub (Aug 30, 2014):

wget "http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400"
--2014-08-30 20:30:25--  http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400
Resolving a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)... 204.155.149.245, 204.155.149.246
Connecting to a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)|204.155.149.245|:80... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: http://a18-45.1-198.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400 [following]
--2014-08-30 20:30:26--  http://a18-45.1-198.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400
Resolving a18-45.1-198.cdn13.com (a18-45.1-198.cdn13.com)... 204.155.149.246
Connecting to a18-45.1-198.cdn13.com (a18-45.1-198.cdn13.com)|204.155.149.246|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 11000035 (10M) [video/mp4]
Saving to: ‘1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400.1’
@pcfreak30 commented on GitHub (Aug 30, 2014): ``` wget "http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400" --2014-08-30 20:30:25-- http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400 Resolving a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)... 204.155.149.245, 204.155.149.246 Connecting to a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)|204.155.149.245|:80... connected. HTTP request sent, awaiting response... 302 Moved Temporarily Location: http://a18-45.1-198.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400 [following] --2014-08-30 20:30:26-- http://a18-45.1-198.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400 Resolving a18-45.1-198.cdn13.com (a18-45.1-198.cdn13.com)... 204.155.149.246 Connecting to a18-45.1-198.cdn13.com (a18-45.1-198.cdn13.com)|204.155.149.246|:80... connected. HTTP request sent, awaiting response... 200 OK Length: 11000035 (10M) [video/mp4] Saving to: ‘1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400.1’ ```
Author
Owner

@peugeot commented on GitHub (Aug 31, 2014):

Definetely not: [
I thought it was from my network, but I tried from a remote ssh server, with no luck either.

--2014-08-31 07:58:15--  http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400
Resolving a18-45.clients.cdn13.com... 78.140.171.56, 78.140.171.58, 78.140.165.106
Connecting to a18-45.clients.cdn13.com|78.140.171.56|:80... connected.
HTTP request sent, awaiting response... 405 Not Allowed
2014-08-31 07:58:15 ERROR 405: Not Allowed.

@peugeot commented on GitHub (Aug 31, 2014): Definetely not: [ I thought it was from my network, but I tried from a remote ssh server, with no luck either. ```wget "http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400" --2014-08-31 07:58:15-- http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400 Resolving a18-45.clients.cdn13.com... 78.140.171.56, 78.140.171.58, 78.140.165.106 Connecting to a18-45.clients.cdn13.com|78.140.171.56|:80... connected. HTTP request sent, awaiting response... 405 Not Allowed 2014-08-31 07:58:15 ERROR 405: Not Allowed. ``` ```
Author
Owner

@pcfreak30 commented on GitHub (Aug 31, 2014):

It may be ip restricted, so if you did that, grep the url out of the HTML. ATM I can't replicate this to bypass anything.

@pcfreak30 commented on GitHub (Aug 31, 2014): It may be ip restricted, so if you did that, grep the url out of the HTML. ATM I can't replicate this to bypass anything.
Author
Owner

@peugeot commented on GitHub (Aug 31, 2014):

that's weird, it gets blocked even through various proxy sites, maybe only works from usa ?

@peugeot commented on GitHub (Aug 31, 2014): that's weird, it gets blocked even through various proxy sites, maybe only works from usa ?
Author
Owner

@peugeot commented on GitHub (Sep 2, 2014):

in fact it worked with browser, not with wget, even when setting --user-agent="" or "Safari"

@peugeot commented on GitHub (Sep 2, 2014): in fact it worked with browser, not with wget, even when setting --user-agent="" or "Safari"
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
starred/youtube-dl#2950
No description provided.