help to deobfuscate mp4 file from flash player

[peugeot]

hello,

im trying to reverse a video file address pattern from this site for inclusion in youtube-dl, eg:
http://www.drtuber.com/video/1724798/soft-young-lusty-brunette

in the page theres a reference to the mp4 file:

<video width="685" height="455.953125" controls="controls" poster="http://pics.drtuber.com/media/videos/tmb/1724798/player/18.jpg" preload="none">
    <source src="http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=da321b909ed1fd4d8d65bfb903233773&cdn_creation_time=1409420298&cdn_ttl=600&cdn_net=176.189.0.0.16&cdn_bw=86016&cdn_bw_fs=358400" type="video/mp4" />
</video>

unfortunately the access to the file is restricted:

Resolving a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)... 78.140.165.106, 78.140.171.56, 78.140.171.58
Connecting to a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)|78.140.165.106|:80... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: http://a18-45.1-183.cdn13.com/mp4/1724798.mp4?cdn_hash=da321b909ed1fd4d8d65bfb903233773 [following]
--2014-08-30 19:41:45--  http://a18-45.1-183.cdn13.com/mp4/1724798.mp4?cdn_hash=da321b909ed1fd4d8d65bfb903233773
Resolving a18-45.1-183.cdn13.com (a18-45.1-183.cdn13.com)... 78.140.171.56
Connecting to a18-45.1-183.cdn13.com (a18-45.1-183.cdn13.com)|78.140.171.56|:80... connected.
HTTP request sent, awaiting response... 405 Not Allowed
2014-08-30 19:41:46 ERROR 405: Not Allowed.

Any clues of how they manage to substitue the real file name ?

May the embedded video url be a weaker target ?
http://www.drtuber.com/embed/1724798

Regards.

[pcfreak30]

It seem's using wget works perfectly fine. I thought you may have needed to spoof the referrer but thats not the case. I accessed it in chrome and got a video player (from browser), and not a 405.

You should try again.

[pcfreak30]

wget "http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400"
--2014-08-30 20:30:25--  http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400
Resolving a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)... 204.155.149.245, 204.155.149.246
Connecting to a18-45.clients.cdn13.com (a18-45.clients.cdn13.com)|204.155.149.245|:80... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: http://a18-45.1-198.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400 [following]
--2014-08-30 20:30:26--  http://a18-45.1-198.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400
Resolving a18-45.1-198.cdn13.com (a18-45.1-198.cdn13.com)... 204.155.149.246
Connecting to a18-45.1-198.cdn13.com (a18-45.1-198.cdn13.com)|204.155.149.246|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 11000035 (10M) [video/mp4]
Saving to: ‘1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400.1’

[peugeot]

Definetely not: [
I thought it was from my network, but I tried from a remote ssh server, with no luck either.

--2014-08-31 07:58:15--  http://a18-45.clients.cdn13.com/mp4/1724798.mp4?cdn_hash=768654620b1925f5aed5aacb049b52fc&cdn_creation_time=1409444952&cdn_ttl=600&cdn_net=75.177.0.0.16&cdn_bw=86016&cdn_bw_fs=358400
Resolving a18-45.clients.cdn13.com... 78.140.171.56, 78.140.171.58, 78.140.165.106
Connecting to a18-45.clients.cdn13.com|78.140.171.56|:80... connected.
HTTP request sent, awaiting response... 405 Not Allowed
2014-08-31 07:58:15 ERROR 405: Not Allowed.

[pcfreak30]

It may be ip restricted, so if you did that, grep the url out of the HTML. ATM I can't replicate this to bypass anything.

[peugeot]

that's weird, it gets blocked even through various proxy sites, maybe only works from usa ?

[peugeot]

in fact it worked with browser, not with wget, even when setting --user-agent="" or "Safari"