Chrome/Firefox extension for pen-testing to retrieve encryption keys of Widevine protected content !DON'T DECRYPT CONTENT UNLESS YOU HAVE THE RIGHT TO DO IT!
chrome-extensionchrome-extensionsdrmencrypted-media-extensionsfirefox-add-onsfirefox-addonfirefox-addonsfirefox-extensionfirefox-extensionsfirefox-webextensionpyodidepywidevinewasmweb-extweb-extensionweb-extensionswebassemblywebextensionwebextensionswidevine
schemes | ||
.gitattributes | ||
background.js | ||
content.js | ||
icon.png | ||
inject.js | ||
LICENSE | ||
manifest.json | ||
popup_drawList.js | ||
popup.html | ||
popup.js | ||
README.md |
WVGuesserExtension
Instalation
-
Setup Guesser API (Guide)
-
Install extension
-
Firefox
1. Navigate to
about:debugging#/runtime/this-firefox
2. Load temporary addon
-
Chrome
1. Navigate to
chrome://extensions/
2. Load unpacked
-
Kiwi Browser(Android) NOTE:Remote API needed; Not work with Termux for now
1. Navigate to ︙ --> Extensions
2. +(from .zip/.crx/.user.js)
-
Demo
Todo
- Improve UI
Disclaimer
This extension is for educational and researchment purpose.
Only use it for content for which you own the rights and do not use it for piracy purposes.
How it works?
- inject.js injected by content.js gets Widevine PSSH by hooking EME.
- background.js fetches POST URLs/Headers
- PSSHs will passed by this route inject.js-->content.js-->background.js-->popup.js
- PSSHs+URLs+Headers will passed by this route background.js-->popup.js
- popup.js will contols UI(popup.html)
- User input into UI
- popup.js sends key request to Guesser API