I
I
Ivan Orlov2020-07-01 17:29:12
Parsing
Ivan Orlov, 2020-07-01 17:29:12

What encryption method was used to hide the link to the image?

Task: to parse images from the site japancar.ru, but we need images without a watermark, they used to store a link to the original simply in base64 , then they changed the system, but still there is hope, because the length of the new hash is not the same, which means there is a chance to decode.

For example, here is the product:
https://parts.japancar.ru/jc/view/parts/P619541830...

Previously, the link to the picture was like this:

https://8d861f77-be75-46f9-990c-e24de00dfe4b.selcdn.net/filecpd.php?u=aHR0cHM6Ly9kYXRhLmpjOS5ydS9pbWFnZXMvX2Jhc2VwYXJ0cy8yMDE4MDkvaW4xNTM2Mjc0NjgwLTA0ODUwLmpwZw==&tp=custom&w=423&h=317&s=1&l&nocrop&sc=ca5f4&ver=2

Here we see the GET parameter u, if we do base64 decode , we will get the result:
https://data.jc9.ru/images/_baseparts/201809/in1536274680-04850.jpg
(big good picture without a watermark)

And now the link to the same picture looks like this:
https://q1.s2.jc9.ru/filecpd.php?fo=5b0efb617c7b95349ec22925cd81104c5050659083ffe27da4f7be62ee533714c2c57542e8519e08eb4eff0837301bde49c5626d30b91e4498bf74bb79da72b2337ba4bd6ad3b14b&tp=custom&w=423&h=317&s=1&l&nocrop&sc=ca5f4&ver=2

Only the name and content of the GET parameter has changed, it was:
u=<base64: original image url>
it became:
fo=<некий текст, похожий на хеш, но разной длины>

Fresh photos have a length of 144 characters: [ link ]
5b0efb617c7b95349ec22925cd81104c5050659083ffe27da4f7be62ee533714c2c57542e8519e0826a0e1b24288f15861684e3e9679f838cc7023f6f985d75e3552fa23539b0bd6

And for comparison:
5b0efb617c7b95349ec22925cd81104c5050659083ffe27da4f7be62ee533714c2c57542e8519e08eb4eff0837301bde49c5626d30b91e4498bf74bb79da72b2337ba4bd6ad3b14b
5b0efb617c7b95349ec22925cd81104c5050659083ffe27da4f7be62ee533714c2c57542e8519e0826a0e1b24288f15861684e3e9679f838915044b0b2aca046a91655a800730853
5b0efb617c7b95349ec22925cd81104c5050659083ffe27da4f7be62ee533714fd750d693ff111d8125d65f5c02863b0f87a2e6c05572773ed92faf20ebfeddd8740dfb83debd968
5b0efb617c7b95349ec22925cd81104c5050659083ffe27da4f7be62ee533714fd750d693ff111d8125d65f5c02863b0f87a2e6c05572773960c1094f04ca2ec24d4b8d260cbead2
5b0efb617c7b95349ec22925cd81104c5050659083ffe27da4f7be62ee533714fd750d693ff111d8125d65f5c02863b0767a3275f2950d95290701da282d8036fa8c36e430c1fba3

If you dig, you can find hashes of other lengths ( 160 characters): [ link ]
5b0efb617c7b95345595d86e6157c0c114617b1972321c1d91550be6881ca81c32208f60de916a6a928f53a532d2c6e04758d99c86ea978fba7ec9a40953761edd8242ad3851cecdff929b65edb1e68a

Another hash 177 characters: [ link ]
5b0efb617c7b95349ec22925cd81104c5050659083ffe27d830f64b267a806acd4826aa86c319cbd78e2c07d07a8451416dafe8c22ca860690d36a90ee0f3b14172baf69302f641f48e147f078911745277f1fdfb2386e66


Facts:
  1. If a one-way encryption algorithm were used, then the hash would always be the same length, and a different length indicates that the link to the original may still be encrypted there.
  2. The character set is similar to one-way functions like SHA and the like, only numbers and lowercase letters.
  3. The greater the time difference between the pictures, the less the first characters match, but the number of matching hints: 16, 48 and 64 first characters of the hash can match.
  4. If I were the developers, I would simply use AES for encoding and decoding, it is safe and no one will decrypt it, but the result of this function would have to be wrapped in base64 or HEX, and I don’t smell such wrapping in the links provided.


Please tell me, can anyone come across similar hashes and know how to decode them?
If this is not possible, can you share your experience on removing a watermark from pictures?

Answer the question

In order to leave comments, you need to log in

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question