This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

asked 27 Aug '13, 14:21

tdx3000's gravatar image

tdx3000
1111
accept rate: 0%


The video link is this:

http://r19---sn-4g57lnlz.googlevideo.com/videoplayback?id=8c6602ad47600920&itag=34&source=picasa&ip=88.217.140.185&ipbits=0&expire=1380286154&sparams=expire,id,ip,ipbits,itag,source&signature=18D167E4C9F5D16823AC59842FD47526C5896354.7FC5177924498400A4E041F5BBEA4E0FB4A8A413&key=cms1&begin=0&cm2=0&cms_redirect=yes&ms=nxu&mt=1377694101&mv=m

If you click on it, it will at least offer the download of a 220 MByte flash file. I'm not sure how long this link will be valid, as most of the video hosters tend to generate dynamic URLs that are only valid for defined period of time.

Here is how I found the link:

Statistics -> Conversations -> TCP

Pick the conversation with the most bytes (after the movie is playing for a couple of seconds), as that is most certainly the video, if there was no other download in parallel. Then click "Follow Stream" and extract the URL from the HTTP request header.

Regards
Kurt

permanent link

answered 28 Aug '13, 05:54

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Hello,

Thank you helping.

The link you got is the genereate link i can get that with in chrome network tool no problem.

The link im looking to find is picasaweb.google.com/lh/photo/xxxxxx

This seem to be the share link https://picasaweb.google.com/lh/photo/sUWS1rSBmbd5opCoiZ7pJ5AXDnHPiDqJi8iGjh-qmp4nU7TeaO8OKjTI9ctVHJyhkqVUdmibvSJeXTAMcOv2nC2VgAA8r-uPGh1Rj55HDDKWZZnRZ27mYsELo8UdTpTt

But it too long to be a valid share link, a valid share link should be like one of 3 below

https://picasaweb.google.com/lh/photo/oLb1wikeW75BUCYthty5JGdsRkDU9D-GZvm2P4XELMM https://picasaweb.google.com/lh/photo/oLb1wikeW75BUCYthty5JGdsRkDU9D-GZvm2P4XELMM?start=15https://picasaweb.google.com/106164294256489669464/Image?authkey=Gv1sRgCKm7hsnPk5aRZQ#5657122599477586178

sUWS1rSBmbd5opCoiZ7pJ5AXDnHPiDqJi8iGjh-qmp4nU7TeaO8OKjTI9ctVHJyhkqVUdmibvSJeXTAMcOv2nC2VgAA8r-uPGh1Rj55HDDKWZZnRZ27mYsELo8UdTpTt I wonder if this part is encoded or encrypt it.

On the server they use a proxy to get the link from database and pass it to the player. The player much decrypt it and request with picasaweb to generate the video link.

If that is the case then the truth link im looking should be somewhere in the package that must be capture by wireshark ?

(28 Aug '13, 18:12) tdx3000

The link im looking to find is picasaweb.google.com/lh/photo/xxxxxx

I don't think there is a way to get the 'reverese' picasaweb link, as that is most certainly only stored in the databases of google.

At least you cannot get that information by looking at capture files while the video plays.

I suggest to ask this question in a google picasa forum or ask the guy how posted that page on http://phimtt.com where he got the video from.

(29 Aug '13, 03:55) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×89
×1

question asked: 27 Aug '13, 14:21

question was seen: 4,397 times

last updated: 29 Aug '13, 03:55

p​o​w​e​r​e​d by O​S​Q​A