4 ms·
Using VLC to watch an m3u8 playlist at a URL with custom Referrer and User Agent
- jtjj222 2y agoI am not sure that it is safe to open devtools on a sketchy website. There is a lot of extra attack surface there.
- prmoustache 2y agoUsually the sketchy websites are the one you open from an ephemeral VM anyway. Who would open those on their main desktop?
- out-of-ideas 2y agoi'd argue any website with a 3rd party ad is a sketchy website. but any site can do it check out https://github.com/AEPKILL/devtools-detector https://github.com/AEPKILL/devtools-detector
- mathfailure 2y agoWhy does opening devtools on any sites is not safe?
- shbooms 2y agoWhat can a website do just from opening dev tools that it can't do without opening them?
- out-of-ideas 2y agoit can basically fork bomb the user
- chatmasta 2y agoThe websites I've seen (and was referencing in the Gist) basically do this. But it's a very simple anti-debugger technique that uses an IIFE containing a `while` loop with a `debugger;` statement in every iteration. You can circumvent it by opening DevTools on another website and toggling it to "skip all breakpoints." I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors. And I'm sure that the attack surface for actual exploits (beyond just DOS) is also greater than browsing a website without DevTools open. But it's not like browser vendors grant super-permissions to websites when the user has DevTools open; any exploit would depend on a high severity vulnerability. I do agree that it's probably smart to browse sketchy websites in an isolated browser, and ideally one inside a VM.
- tamimio 2y ago> I'm sure there are more advanced anti-debugger techniques with different denial-of-service vectors. Just rename debugger to banana. Edit: I see you have posted it below already! https://www.nullpt.rs/evading-anti-debugging-techniques https://www.nullpt.rs/evading-anti-debugging-techniques
- out-of-ideas 2y agowhile i agree, 2 things come to mind to assist this: - browsers should have a user-input string for the debug statement that is manually accepted before the debugger runs every time devtools launches (and should be randomly generated each time that devtools is opened) - browser plugins help: check out Netmon (though sadly its yet-another-plugin and js-bloat for the browser to handle) edit: format i hope
- chatmasta 2y agoThis researcher [0] found the optimal solution was to use a custom build of Firefox with the `debugger` keyword changed to something else :) [0] https://www.nullpt.rs/evading-anti-debugging-techniques https://www.nullpt.rs/evading-anti-debugging-techniques
- out-of-ideas 2y agoyes i remember reading something about somebody compiling it to a unique word! wanted to do similar myself (but didnt fall down that rabbit hole yet) - i feel it should be a set-able in the browser (per tab or whatever) - not to sound like a broken record ha browsers are supposed to be a tool we humans use, not be controlled by edit: format maybe one day ill get it right
- Andrews54757 2y agoI have trouble watching things without subtitles. I dislike most video players on websites since they don't give you the option to search for or manually upload subtitles. This and other inconveniences motivated me to make a browser extension to fix bad video players on the internet. It works by replacing the video player with a custom one. It also allows me to see what the manifest URL is and what headers it uses so I can copy it over to VLC if I need to. The extension is available on Github, you can find it here https://github.com/Andrews54757/FastStream https://github.com/Andrews54757/FastStream
- chatmasta 2y agoNice extension! It would be cool if it could also re-render the page to be _just_ the video player (thus solving the problem in the Gist, with all the ads). About subtitles: in case an m3u8 stream has them, you can ask VLC to render them with a flag like `--sub-track 0`
- Andrews54757 2y agoThanks! You can already do that. Open a new tab, and then click the icon to make the player appear. It will fill the whole tab. Then use another tab to find videos on other websites. The new-tab player will automatically collect sources and you can play it by using the sources browser tool. You can then close the tab with the original website.
- krackers 2y agoHow does it work? Since sites often have their own craptastic JS player that doesn't embed the source stream in the DOM directly.
- Andrews54757 2y agoMost sites still use a player that fetches a ".m3u8" or ".mpd" manifest file. The extension monitors webRequests and triggers when it sees a request to such a file.
- 2y ago
- deleted 2y ago[deleted]
- russelg 2y agoAnother browser extension I've used to handle this exact problem: https://github.com/54ac/stream-detector https://github.com/54ac/stream-detector It's archived but I would argue it's feature complete.
- iKlsR 2y agoThis is how I transcribe my local radio stations who have a stream running on their site. I use ffmpeg however and save to 1 minute chunks which I send to whisper.