Wednesday, October 28, 2009

Re: [BLUG] hiding an .html link as an .mp3

Welcome to the internal workings of the web. You seem to be fairly
interested in this so I thought I'd delve into it more for you.

Its not done in the HTML, its a trick (not really though) done with
webservers themselves. There is generally a seperation between the
filename extension and the document mime type. Most of the time the
extension matches the mime type of the document, but its not required
too. In the case of your nice site here, they have made mp3 a file that
generates the mime type of text/html. You can see this by using the
option in wget or curl that will show you the headers generated by the
server:

# curl -i http://downloads.khinsider.com/game-soundtracks/album/monkey-island-2-lechucks-revenge-pc-rip-/01-theme.mp3 | head -10

Date: Wed, 28 Oct 2009 22:14:00 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5
mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
PHP/5.2.6
X-Powered-By: PHP/5.2.6
Transfer-Encoding: chunked
Content-Type: text/html <=================================


<!DOCTYPE html PUBLIC "-//W3C//DTD Xhtml 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"><head>


Now try the same thing with the actual mp3 file and you'll see the
difference in the webserver response headers, note that you should pass
the output through the string program to remove binary data:


# curl -i http://208.53.138.111/soundtracks/monkey-island-2-lechucks-revenge-pc-rip-/fjfnybaydu/01-theme.mp3 | strings | head -20


Date: Wed, 28 Oct 2009 23:33:27 GMT
Server: Apache/1.3.37 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2
mod_bwlimited/1.4 PHP/4.4.7 FrontPage/5.0.2.2635.SR1.2 mod_ssl/2.8.28
OpenSSL/0.9.8b
Last-Modified: Thu, 23 Nov 2006 09:49:18 GMT
ETag: "2cfc62c-228c0b-45656e9e"
Accept-Ranges: bytes
Content-Length: 2264075
Content-Type: audio/mpeg <=================================
TPE1
Michael LandTALB
LeChuck's Revenge (game rip)TCON
GameTIT2
ThemeTRCK
01PRIV
PeakValue
PRIV
AverageLevel
COMM
engiTunNORM
000008D7 00000799 00002AD2 00002799 0000C37E 00013897 0000640C 000069FD 0001D4C0 000186A0


You even see some of the id3 tag there in the output too.

You can configure Apache to change the mime type for a document like
this:

AddType text/html .mp3

Either put that in your server config or if its supported, put it in
an .htaccess file.

Despite the deception that this site has probably in order to get
better search engine placement, there are many good reasons to do this
too. Let's say you want to be able to generate dynamic images on your
website like a graph that pulls data from an online database and
displays it in real time. This is done by making a program such as a
PHP program or even a CGI written in Perl or C that sends a different
Content-Type header than normal to the browser. Most dynamic web
applications send text/html to the browser, but if you have them send
something like image/jpeg instead, you can send image data out and it
will be displayed accordingly. I wrote a quick program that demonstrates
this:

http://suso.suso.org/box.php

By default it just creates a blue box that is of the png image type,
but if you pass it query strings in the URL you can change its size and
color like so:

http://suso.suso.org/box.php?xsize=900&ysize=5&redshade=255


Here is all the code that's needed to do this in PHP, provided PHP has
the GD library loaded:

<?php
header ("Content-type: image/png");

# defaults
$xsize = 100;
$ysize = 100;
$redshade = 0;
$blueshade = 255;
$greenshade = 0;


# Take overrides from the browser and sanity check them.
if (isset($_GET['xsize']) && (1 <= $_GET['xsize'] && $_GET['xsize'] <= 1000)) {
$xsize = intval($_GET['xsize']);
}
if (isset($_GET['ysize']) && (1 <= $_GET['ysize'] && $_GET['ysize'] <= 1000)) {
$ysize = intval($_GET['ysize']);
}

if (isset($_GET['redshade']) && (0 <= $_GET['redshade'] && $_GET['redshade'] <= 255)) {
$redshade = intval($_GET['redshade']);
}
if (isset($_GET['blueshade']) && (0 <= $_GET['blueshade'] && $_GET['redshade'] <= 255)) {
$blueshade = intval($_GET['blueshade']);
}
if (isset($_GET['greenshade']) && (0 <= $_GET['greenshade'] && $_GET['redshade'] <= 255)) {
$greenshade = intval($_GET['greenshade']);
}

unset($im);
unset($fore_color);

$im = @ImageCreate($xsize, $ysize) or die;
$fore_color = ImageColorAllocate ($im, $redshade, $greenshade, $blueshade);

ImageFilledRectangle ($im, 0, 0, $xsize, $ysize, $fore_color);
ImagePng($im);
?>

There are many other examples of this on the net, one common one are the
CAPTCHA images that are used to verify that someone is human and not a
bot. Another one are all those polls with graphs to them. All this is
done using this same technique.

Images aren't all that is done like this, its also possible to
generate flash video that is dynamic and even stuff like pdf files. Just
for fun one time, I wrote a PHP program that streamed an mp3 file
through the PHP program itself just by reading the file in, then sending
an audio/mpeg Content-Type header and then the file. I suppose if you
knew what you were doing you could do some kind of PHP tone generator or
dynamic music generator.

This is an exercise left to the reader. ;-)

Mark

On Wed, Oct 28, 2009 at 10:04:08PM GMT, Ben Shewmaker [ben@shewbox.org] said the following:
> So I was googling around looking for some music from old PC games I used to
> play and found the music from Monkey Island 2 here:
>
> (i would NOT view this site w/out some sort of adblock installed, it is
> seriously annoying)
>
> http://downloads.khinsider.com/game-soundtracks/album/monkey-island-2-lechucks-revenge-pc-rip-
>
> My first thought was to open up a terminal and grab them with wget like so:
>
> wget -r -np -A.mp3 url
>
> But it seems that although the links are listed as .mp3, they are in fact
> links to new pages. For example:
>
> http://downloads.khinsider.com/game-soundtracks/album/monkey-island-2-lechucks-revenge-pc-rip-/01-theme.mp3
>
> is actually a new page which then has a link to the actual mp3:
>
> http://208.53.138.111/soundtracks/monkey-island-2-lechucks-revenge-pc-rip-/fjfnybaydu/01-theme.mp3
>
> Which is a legit file this time. I hate these kinds of sleazy sites and
> usually avoid them but I'm curious as to how this is actually working.
> Looking through the html for the site, it looks like your standard link.
> So when I tell wget to recursively scan for .mp3s it thinks it finds a
> match and downloads the "mp3" (I also tried the Firefox plugin dowmthemall
> but it has the same effect) Does anybody have any idea how this sort of
> thing works?
>
> Ben
>
> (as a side note, it's nice when I run into these types of sites when I'm
> booted into Ubuntu. They may be annoying but I'm not worried about getting
> all sorts of nasty malware)

> _______________________________________________
> BLUG mailing list
> BLUG@linuxfan.com
> http://mailman.cs.indiana.edu/mailman/listinfo/blug


--
Mark Krenz
Bloomington Linux Users Group
http://www.bloomingtonlinux.org/
_______________________________________________
BLUG mailing list
BLUG@linuxfan.com
http://mailman.cs.indiana.edu/mailman/listinfo/blug

No comments: