Wireshark - Getting *.flv video url of youtube

Question

I'm trying to get the url of the *.flv from any youtube video. I used wireshark to analyize the traffic. I have also an addon for firefox which downloads the videos from youtube. It has a feature where I can see the direct url to the *.flv video.

So far I got this :

http://r1---sn-i5onxoxu-i5hl.c.youtube.com (it's the host) This matches to what the downloaders url is.

followed by

"videoplayback?" and then some video specific stuff I guess. And that's exactly what I cannot figure out. The downloader starts with the host, followed by this and then some other stuff.

What I did was capturing the packages. Then I searched in http requests for "/videoplayback?...". I just added it to the host but it doesn't work.

Can someone help me? What do I have to put after the host? And where do I find it?

Answer 1

This is what I figured out so far.
I watched the same video Wireshark - Using Dumpcap to capture to disk by Mike Pennacchi.

After capturing the packets and saving the file, apply the following display filter:
http.request.full_uri contains "range"

There are 3 packets displayed in my file:
735
2708
4615

Select the first packet, go to Packet details and expand Hypertext Transfer Protocol. Right-click on Full request URI [truncated]: and select Copy -> Value and paste the url in a text file.
Copy also the url's (see Note) from the other packets and you get a list similar to this one:

http://r2---sn-5hn7zn7k.c.youtube.com/videoplayback?algorithm=throttle-factor&burst=40&cp=U0hWR1FUTl9GT0NONl9JTlJBOlBwSjNTRTA0azVw&cpn=B84QkSbXB7EAaDfs&expire=1372190015&factor=1.25&fexp=935500%2C910100%2C929227%2C916613%2C921047%2C928201%2C901208%2C929123%2C929915%2C929906%2C929907%2C929125%2C925714%2C929917%2C929919%2C931202%2C912512%2C912515%2C912521%2C906838%2C904488%2C906840%2C931910%2C931913%2C932227%2C904830%2C919373%2C933701%2C904122%2C900816%2C926403%2C909421%2C912711%2C935102&id=6ca6b1fa4c861ff9&ip=my ip address&ipbits=8&itag=34&keepalive=yes&key=yt1&ms=au&mt=1372168727&mv=m&newshard=yes&range=13-1781759&ratebypass=yes&signature=D8D28CBCD4AAC5F46901397219F62CB04D3C6290.114129F2F93249AC4D88DF184C7D47C9929B3232&source=youtube&sparams=algorithm%2Cburst%2Ccp%2Cfactor%2Cid%2Cip%2Cipbits%2Citag%2Csource%2Cupn%2Cexpire&sver=3&upn=9RmkbstttTM
http://r2---sn-5hn7zn7k.c.youtube.com/videoplayback?algorithm=throttle-factor&burst=40&cp=U0hWR1FUTl9GT0NONl9JTlJBOlBwSjNTRTA0azVw&cpn=B84QkSbXB7EAaDfs&expire=1372190015&factor=1.25&fexp=935500%2C910100%2C929227%2C916613%2C921047%2C928201%2C901208%2C929123%2C929915%2C929906%2C929907%2C929125%2C925714%2C929917%2C929919%2C931202%2C912512%2C912515%2C912521%2C906838%2C904488%2C906840%2C931910%2C931913%2C932227%2C904830%2C919373%2C933701%2C904122%2C900816%2C926403%2C909421%2C912711%2C935102&id=6ca6b1fa4c861ff9&ip=my ip address&ipbits=8&itag=34&keepalive=yes&key=yt1&ms=au&mt=1372168727&mv=m&newshard=yes&range=1781760-3563519&ratebypass=yes&signature=D8D28CBCD4AAC5F46901397219F62CB04D3C6290.114129F2F93249AC4D88DF184C7D47C9929B3232&source=youtube&sparams=algorithm%2Cburst%2Ccp%2Cfactor%2Cid%2Cip%2Cipbits%2Citag%2Csource%2Cupn%2Cexpire&sver=3&upn=9RmkbstttTM
http://r2---sn-5hn7zn7k.c.youtube.com/videoplayback?algorithm=throttle-factor&burst=40&cp=U0hWR1FUTl9GT0NONl9JTlJBOlBwSjNTRTA0azVw&cpn=B84QkSbXB7EAaDfs&expire=1372190015&factor=1.25&fexp=935500%2C910100%2C929227%2C916613%2C921047%2C928201%2C901208%2C929123%2C929915%2C929906%2C929907%2C929125%2C925714%2C929917%2C929919%2C931202%2C912512%2C912515%2C912521%2C906838%2C904488%2C906840%2C931910%2C931913%2C932227%2C904830%2C919373%2C933701%2C904122%2C900816%2C926403%2C909421%2C912711%2C935102&id=6ca6b1fa4c861ff9&ip=my ip address&ipbits=8&itag=34&keepalive=yes&key=yt1&ms=au&mt=1372168727&mv=m&newshard=yes&range=3563520-5347327&ratebypass=yes&signature=D8D28CBCD4AAC5F46901397219F62CB04D3C6290.114129F2F93249AC4D88DF184C7D47C9929B3232&source=youtube&sparams=algorithm%2Cburst%2Ccp%2Cfactor%2Cid%2Cip%2Cipbits%2Citag%2Csource%2Cupn%2Cexpire&sver=3&upn=9RmkbstttTM

Check the range; it is in these long url's:
range=13-1781759
range=1781760-3563519
range=3563520-5347327

Copy the first url and paste it in your browser.
Now you can download and save the first fileas videoplayback_Pennacchi01.
Repeat the steps for parts 2 and 3.

There are a couple of steps to go, before you can play the file.
Open the file videoplayback_Pennacchi01 in a hex editor.

The file starts with:
12 00 03 4B 00 00 00 00 00 00 00 02 00 0A 6F 6E  ...K..........on

Prepend the the FLV header: 
46 4C 56 01 05 00 00 00 09 00 00 00 00           FLV..........

Now the file looks like:
46 4C 56 01 05 00 00 00 09 00 00 00 00 12 00 03  FLV.............
4B 00 00 00 00 00 00 00 02 00 0A 6F 6E 4D 65 74  K..........onMet

Move you cursor to the end of file 01.
Open files 02 and 03 and copy and paste the content of the files into file 01. Now you are ready to play the video.

Note 1
These links expire after some time: expire=1372190015
Convert Unix timestamp to Readable Date/time: Tue, 25 Jun 2013 19:53:35 GMT

You can also reconstruct the FLV file from the capture file.
Go to File -> Export Objects -> HTTP
look for Content Type video/x-flv.
Select the first one, hit Save As ans save the file.
Save also the other 2 parts.
Merge the files in order and prepend the FLV header.

Note 2
It used to be very easy. Apply display filter (http.request.method == "GET") and grab the URL from GET request containing /get_video?video.... But things have changed...