How to find Authorization Bearer ?

[anymeofyou]

I am trying to decrypt video from a Android App.

MPD

https://drvideo-ak.akamaized.net/video-sg1/ed8a7273-37a0-44bb-874b-df7ca4e8692a/14436.ism/manifest(format=mpd-time-csf)

PSSH (From mpd file )

AAAAMnBzc2gAAAAA7e+LqXnWSs6jyCfc1R0h7QAAABISEPKdzoPLw0ApqDECYlsgMRY=

License URL (From mpd file)

https://drvideo.keydelivery.mediaservices.windows.net/Widevine/?kid=f29dce83-cbc3-4029-a831-02625b203116

I am assuming its using Azure Media services and Widewine DRM

whenever i make request to license server it shows error that AccessToken is missing i.e Authorization Bearer ey***** something i read from this forum

Problem arises as I cant see Any such header while intercepting network from android ( I am using Rooted Android phone with HTTP Toolkit )

Also I dont see app making network request to license server for key ( which is weird because app is playing video and i cross check from mpd the video is indeed encrypted and needs to be decrypted )

[A_n_g_e_l_a]

I have no knowledge of tis particular site, however any token will likely be in the header passed as part of the http communication. Intercept the traffic with httptoolkit or some such. To do that the android device needs to be rooted so that an httptoolkit certificate can be installed. It is worthwhile looking for any json being passed as the bearer token may be there also.

Many apps now use 'certificate pinning' which makes it difficult to access even with httptoolkit.

[anymeofyou]

I have no knowledge of tis particular site, however any token will likely be in the header passed as part of the http communication. Intercept the traffic with httptoolkit or some such. To do that the android device needs to be rooted so that an httptoolkit certificate can be installed. It is worthwhile looking for any json being passed as the bearer token may be there also.

Many apps now use 'certificate pinning' which makes it difficult to access even with httptoolkit.

Yes I am using HttpToolkit and installed system certs as well, I dont think the app uses certificate pinning as I noticed when intercepting if the app uses cert pinning the request wont go through , but in my case video is playing in app which means no pinning. PS: I may be wrong

[notaghost]

can i try?

[anymeofyou]

can i try?

https://play.google.com/store/apps/details?id=com.marrow
You can make a Free ID and try on free videos ( It has DRM too )

Try and let me know about it if you intercept any license url