PornHub video download without authentication

2018.04.13
my da74 (MY) my
Risk: Low
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

Introduction: PornHub is an adult website that does not allow users to download video(s) without login. Bug: Just goto the video page, view source-code and you will find the direct link to the video in the same quality as selected. // POC // 1) Take this video for example: https://www.pornhub.com/view_video.php?viewkey=ph57533a4118973 2) Goto source 3) We find: https://dv.phncdn.com/videos/201606/04/78592421/480P_600K_78592421.mp4?ttl=1523628236&ri=1024000&rs=408&hash=8e887753f9ae43b30520bf547111ad33 This the is the direct link of the cdn from which the video is loaded on the webpage. This should not happen because they clearly have a requirement for users to login before downloading the video. - Credits: da74


Vote for this issue:
0%
100%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2018, cxsecurity.com

 

Back to Top