is it JAVA? what's the interesting video defense?

[vvv84]

Hey, everybody!
can you see what is the strange video stream protection, I'm not a super expert, but it feels like this course is played through java.
Or am I wrong?

I start the video and in the inspector I see nothing but this link.
https:// here is the name of the site /personal/records/webinar2/rec1.php?ajax=full&v=3702&7b1

question - such videos as I correctly understand are already downloaded only through screen recording?

Translated with DeepL.com (free version)

if anyone's interested in trying it, here are the accesses:
site
1) authorization - https://clck.ru/399QJz
3) login bmwclub2022@yandex.ru
4) password Sghekidh8&W
5) link to the course https://clck.ru/399QSv

Any help or advice would be appreciated



[Attachment 77375 - Click to enlarge]

[[ss]vegeta]

Google searches say this is a dodgy site, also it is blocked by the filters in uBlock and it seems to be also blocked in my HOSTS file which is modified by Steven Black.

Ain't visiting this.

[Karoolus]

yeah, uBlock is complaining, PiHole won't let it through either.

[white_snake]

Clck.ru seems to be just a link shortener (not sure why OP would post it like that). The actual login page is: https://welcomepro.ru/auth/ which seems to be fine.

Btw this looks like a job for Pepe.

[[ss]vegeta]

Clck.ru seems to be just a link shortener (not sure why OP would post it like that). The actual login page is: https://welcomepro.ru/auth/ which seems to be fine.

Thanks!

Btw this looks like a job for Pepe.

Nah.
Just copy as curl (Windows) and remove most of the headers.

curl "https://welcomepro.ru/personal/records/webinar2/rec1.php?ajax=full&v=3702&1" --output bla.mp4 ^
  -H ^"cookie: PHPSESSID=4bWn6ISaNTCGZO1f91y078QZMspOA7qo; BITRIX_SMN_welcomepro.ru=12; BITRIX_SMN_PERS=1; BITRIX_SMN_NCC=Y; BITRIX_SMN_LOGIN=bmwclub2022^%^40yandex.ru; BITRIX_SMN_SOUND_LOGIN_PLAYED=Y; user_auth=true; hideCookiesWrap=true; _gr_session=^%^7B^%^22s_id^%^22^%^3A^%^228e33cc1d-7db5-4ec4-9db0-140ea0b08d35^%^22^%^2C^%^22s_time^%^22^%^3A1709305488170^%^7D^" ^
  -H ^"referer: https://welcomepro.ru/personal/records/webinar2/bis.php?w=1292915^%^26ba=true^%^26z=3437879^%^26zad=3437892^" ^
  -H "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"

[Attachment 77376 - Click to enlarge]

[2nHxWW6GkN1l916N3ayz8HQoi]

Says record not found for that video link. Weird. Guess it got deleted recently.

Edit: nvm, it's still up because @vegeta's command still works. Weird that I can't access it from the browser after login.

Edit2: Oh I see why. It's because of the referer. You can't even paste that URL in the browser. You must access it from the right context. Doesn't matter if you logged in.

[vvv84]

Clck.ru seems to be just a link shortener (not sure why OP would post it like that). The actual login page is: https://welcomepro.ru/auth/ which seems to be fine.

Btw this looks like a job for Pepe.

I hid it so that the organizers would not see that I want to download the video from their site and therefore decided to make short links through the service

[white_snake]

Nah.
Just copy as curl (Windows) and remove most of the headers.

curl "https://welcomepro.ru/personal/records/webinar2/rec1.php?ajax=full&v=3702&1" --output bla.mp4 ^
  -H ^"cookie: PHPSESSID=4bWn6ISaNTCGZO1f91y078QZMspOA7qo; BITRIX_SMN_welcomepro.ru=12; BITRIX_SMN_PERS=1; BITRIX_SMN_NCC=Y; BITRIX_SMN_LOGIN=bmwclub2022^%^40yandex.ru; BITRIX_SMN_SOUND_LOGIN_PLAYED=Y; user_auth=true; hideCookiesWrap=true; _gr_session=^%^7B^%^22s_id^%^22^%^3A^%^228e33cc1d-7db5-4ec4-9db0-140ea0b08d35^%^22^%^2C^%^22s_time^%^22^%^3A1709305488170^%^7D^" ^
  -H ^"referer: https://welcomepro.ru/personal/records/webinar2/bis.php?w=1292915^%^26ba=true^%^26z=3437879^%^26zad=3437892^" ^
  -H "user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"

[Attachment 77376 - Click to enlarge]

Ah, good one! Although I had to add -k to ignore certificates to make it work.

I hid it so that the organizers would not see that I want to download the video from their site and therefore decided to make short links through the service

Okay makes sense, but it looked confusing. Maybe splitting the url like:

https://welcomep ro.ru/auth/

and telling us to put it back together would have been better. To make it even more suspicious you posted your email in plain (I suggest you edit your message to remove it completely or change @ with at if you want to prevent spam), but then censored the urls, lol