hulu

README

Hulu

Sign up

1. https://privacy.com
2. https://signup.hulu.com/plans
3. Hulu (No Ads)
4. EMAIL
5. PASSWORD
6. NAME
7. BIRTHDATE January 1 2000
8. GENDER
9. CONTINUE
10. CARD NUMBER
11. EXPIRATION
12. CVC
13. ZIP CODE
14. SUBMIT

Android

> play -a com.hulu.plus
requires: 5.0 and up

• https://play.google.com/store/apps/details?id=com.hulu.livingroomplus
• https://play.google.com/store/apps/details?id=com.hulu.plus

Create Android 6 device. Install user certificate. after entering password, if you click LOG IN you get this:

Hmm. Something’s up. Please check your internet settings and try again. If all’s fine on your end, visit our Help Center.

system certificate? same result. if we disable proxy? it works. next:

https://github.com/httptoolkit/frida-interception-and-unpinning

pip install frida-tools

download and extract server:

https://github.com/frida/frida/releases

for example:

frida-server-16.1.4-android-x86.xz

install app, then push server:

adb root
adb push frida-server-16.1.5-android-x86 /data/app/frida-server
adb shell chmod +x /data/app/frida-server
adb shell /data/app/frida-server

then:

frida -U `
-l config.js `
-l android/android-certificate-unpinning.js `
-f com.hulu.plus

this worked a couple of times:

+++ b/android/android-certificate-unpinning.js
@@ -223,7 +223,7 @@ const PINNING_FIXES = {

     'okhttp3.CertificatePinner': [
         {
-            methodName: 'check',
+            methodName: 'a',
             overload: ['java.lang.String', 'java.util.List'],
             replacement: () => NO_OP
         },

but it seems to be a race condition or something, as it only works sometimes. like it might fail the first time, but then if I restart the app it will work. not sure.

https://github.com/httptoolkit/frida-interception-and-unpinning/issues/55

Hulu requires Recaptcha for authentication so just passing account credentials is not possible without captcha solving services. To work around this, this tool simply takes a Hulu session cookie.

https://github.com/jkmartindale/hulu

is this true on Android? example request:

POST https://guide.hulu.com/guide/details?user_token=nk77TZQgj1xc245G... HTTP/2.0
x-hulu-user-agent: androidv4/5.3.0+12541-google/b3d7ca343f99384;OS_23,MODEL_Android SDK built for x86
user-agent: Hulu/5.3.0+12541-google (Android 6.0; en_US; Android SDK built for x86; Build/MASTER;)
content-type: application/json; charset=UTF-8
content-length: 76
accept-encoding: gzip

{"eabs":["EAB::023c49bf-6a99-4c67-851c-4c9e7609cc1d::196861183::262714326"]}

user_token comes from here:

POST https://auth.hulu.com/v1/mobile/mfa/authenticate HTTP/2.0
x-hulu-user-agent: androidv4/5.3.0+12541-google/b3d7ca343f99384;OS_23,MODEL_Android SDK built for x86
user-agent: Hulu/5.3.0+12541-google (Android 6.0; en_US; Android SDK built for x86; Build/MASTER;)
content-type: application/x-www-form-urlencoded
content-length: 166
accept-encoding: gzip

code=941741&
friendly_name=Android%20-%20unknown%20Android%20SDK%20built%20for%20x86%20Android&
serial_number=b3d7ca343f99384&
token=83c42269-296c-47ea-ac62-023d02ef2a47

code is 2FA. token comes from here:

POST https://auth.hulu.com/v3/mobile/password/authenticate HTTP/2.0
x-hulu-user-agent: androidv4/5.3.0+12541-google/b3d7ca343f99384;OS_23,MODEL_Android SDK built for x86
user-agent: Hulu/5.3.0+12541-google (Android 6.0; en_US; Android SDK built for x86; Build/MASTER;)
content-type: application/x-www-form-urlencoded
content-length: 2842
accept-encoding: gzip

additional_properties=%7B%22distro%22%3A%22google%22%2C%22device_platform%22%3A%22Android%22%2C%22device_type%22%3A%22mobile%22%2C%22app_version%22%3A%225.3.0%22%2C%22device_family%22%3A%22Android%22%2C%22build_number%22%3A%225012541%22%2C%22device_os%22%3A%22Android%20REL6.0%22%2C%22device_manufacturer%22%3A%22unknown%22%2C%22device_product%22%3A%22Android%20REL6.0%22%2C%22device_model%22%3A%22Android%20SDK%20built%20for%20x86%22%2C%22device_capabilities%22%3A%7B%22device%22%3A%7B%22hulu%3Aapp%3Aandroid%22%3A%225.3.0%22%2C%22hulu%3Aplatform%3Aandroid%3Agoogleplay%22%3A%2223%22%2C%22hulu%3Adevices%3Aunknown%3Aandroidsdkbuiltforx86%22%3A%22%22%7D%2C%22capabilities%22%3A%5B%22hulu%3Adcs%3Acapabilities%3Acompass%3Asite-map%22%2C%22hulu%3Adcs%3Acapabilities%3Aonboarding-person-collection%22%2C%22hulu%3Adcs%3Acapabilities%3Acompass%3Acompass-mvp%22%5D%7D%7D&
device_id=166&
friendly_name=Android%20-%20unknown%20Android%20SDK%20built%20for%20x86%20Android&
mobile_capabilities=telephony&
password=...&
screen_size=%7B%22width_pixels%22%3A1080%2C%22height_pixels%22%3A1794%2C%22width_pixel_density_in_inches%22%3A420%2C%22height_pixel_density_in_inches%22%3A420%7D&
serial_number=b3d7ca343f99384&
time_zone=America%2FChicago&
user_email=...&
recaptcha_type=android&
recaptcha_token=03AFcWeA6hFI1SkP4tWKM4l23acaqlu6la04aHYSxjAehgrfYIiJJocCXpLnkW...

Documentation

Index

• type Authenticate
  • func (a Authenticate) DeepLink(watch ID) (*DeepLink, error)
  • func (a Authenticate) Details(d *DeepLink) (chan Details, error)
  • func (a *Authenticate) New(email, password string) error
  • func (a Authenticate) Playlist(d *DeepLink) (*Playlist, error)
  • func (a *Authenticate) Unmarshal() error
• type DeepLink
• type Details
  • func (d Details) Episode() int
  • func (d Details) Season() int
  • func (d Details) Show() string
  • func (d Details) Title() string
  • func (d Details) Year() int
• type ID
  • func (i *ID) Set(s string) error
  • func (i ID) String() string
• type Playlist
  • func (Playlist) RequestBody(b []byte) ([]byte, error)
  • func (Playlist) RequestHeader() (http.Header, error)
  • func (p Playlist) RequestUrl() (string, bool)
  • func (Playlist) ResponseBody(b []byte) ([]byte, error)

Types

type Authenticate

type Authenticate struct {
	Data []byte
	// contains filtered or unexported fields
}

func (Authenticate) DeepLink

func (a Authenticate) DeepLink(watch ID) (*DeepLink, error)

func (Authenticate) Details

func (a Authenticate) Details(d *DeepLink) (chan Details, error)

func (*Authenticate) New

func (a *Authenticate) New(email, password string) error

func (Authenticate) Playlist

func (a Authenticate) Playlist(d *DeepLink) (*Playlist, error)

func (*Authenticate) Unmarshal

func (a *Authenticate) Unmarshal() error

type DeepLink

type DeepLink struct {
	EAB_ID string
}

type Details

type Details struct {
	Episode_Name   string
	Episode_Number int
	Headline       string
	Premiere_Date  string
	Season_Number  int
	Series_Name    string
}

func (Details) Episode

func (d Details) Episode() int

func (Details) Season

func (d Details) Season() int

func (Details) Show

func (d Details) Show() string

func (Details) Title

func (d Details) Title() string

func (Details) Year

func (d Details) Year() int

type ID

type ID struct {
	// contains filtered or unexported fields
}

func (*ID) Set

func (i *ID) Set(s string) error

hulu.com/watch/023c49bf-6a99-4c67-851c-4c9e7609cc1d

func (ID) String

func (i ID) String() string

type Playlist

type Playlist struct {
	Stream_URL string
	WV_Server  string
}

func (Playlist) RequestBody

func (Playlist) RequestBody(b []byte) ([]byte, error)

func (Playlist) RequestHeader

func (Playlist) RequestHeader() (http.Header, error)

func (Playlist) RequestUrl

func (p Playlist) RequestUrl() (string, bool)

func (Playlist) ResponseBody

func (Playlist) ResponseBody(b []byte) ([]byte, error)