Hi all, Im trying to use wireshark to capture and reveal a link in this video but in the past couple day i not able to find it. If someone could help i would really appricate. Here is the video link: http://phimtt.com/xem-phim/nu-trang-tai-danh-word-twisters-adventures-2008 The format im looking for are: https://picasaweb.google.com/lh/photo/oLb1wikeW75BUCYthty5JGdsRkDU9D-GZvm2P4XELMM https://picasaweb.google.com/lh/photo/oLb1wikeW75BUCYthty5JGdsRkDU9D-GZvm2P4XELMM?start=15https://picasaweb.google.com/106164294256489669464/Image?authkey=Gv1sRgCKm7hsnPk5aRZQ#5657122599477586178 https://picasaweb.google.com/lh/photo/EXbYzXpUnlELm0FHsEcmbE9c4LVWd6J4g-EJTl_M9Bo The video is host on picasaweb.google.com From the video link above: i was able to find this with chrome network tool, but is not valid: Thank you asked 27 Aug '13, 14:21  tdx3000 |
One Answer:
The video link is this: If you click on it, it will at least offer the download of a 220 MByte flash file. I'm not sure how long this link will be valid, as most of the video hosters tend to generate dynamic URLs that are only valid for defined period of time. Here is how I found the link:
Pick the conversation with the most bytes (after the movie is playing for a couple of seconds), as that is most certainly the video, if there was no other download in parallel. Then click "Follow Stream" and extract the URL from the HTTP request header. Regards answered 28 Aug '13, 05:54  Kurt Knochner ♦ |
Hello,
Thank you helping.
The link you got is the genereate link i can get that with in chrome network tool no problem.
The link im looking to find is picasaweb.google.com/lh/photo/xxxxxx
This seem to be the share link https://picasaweb.google.com/lh/photo/sUWS1rSBmbd5opCoiZ7pJ5AXDnHPiDqJi8iGjh-qmp4nU7TeaO8OKjTI9ctVHJyhkqVUdmibvSJeXTAMcOv2nC2VgAA8r-uPGh1Rj55HDDKWZZnRZ27mYsELo8UdTpTt
But it too long to be a valid share link, a valid share link should be like one of 3 below
https://picasaweb.google.com/lh/photo/oLb1wikeW75BUCYthty5JGdsRkDU9D-GZvm2P4XELMM https://picasaweb.google.com/lh/photo/oLb1wikeW75BUCYthty5JGdsRkDU9D-GZvm2P4XELMM?start=15https://picasaweb.google.com/106164294256489669464/Image?authkey=Gv1sRgCKm7hsnPk5aRZQ#5657122599477586178
sUWS1rSBmbd5opCoiZ7pJ5AXDnHPiDqJi8iGjh-qmp4nU7TeaO8OKjTI9ctVHJyhkqVUdmibvSJeXTAMcOv2nC2VgAA8r-uPGh1Rj55HDDKWZZnRZ27mYsELo8UdTpTt I wonder if this part is encoded or encrypt it.
On the server they use a proxy to get the link from database and pass it to the player. The player much decrypt it and request with picasaweb to generate the video link.
If that is the case then the truth link im looking should be somewhere in the package that must be capture by wireshark ?
I don't think there is a way to get the 'reverese' picasaweb link, as that is most certainly only stored in the databases of google.
At least you cannot get that information by looking at capture files while the video plays.
I suggest to ask this question in a google picasa forum or ask the guy how posted that page on http://phimtt.com where he got the video from.