Pandora Hack - Get Free MP3s

by SickCodeMonkey

Applications such as BitTorrent give many Internet users the ability to download free music, applications, and movies from other users.  Because BitTorrent is one of the most popular applications used to obtain copyrighted material (illegally), BitTorrent trackers have been a target of frequent raids and shutdowns on behalf of the (((MPAA))) and (((RIAA))).

Never fear, because this article will show you a whole new way to get the free music you're looking for and will also show you how you can obtain it from online radio stations, specifically Pandora.

Please note, my purpose in writing this article is not to have the lawyers after Pandora or have them taken off line, but rather to exploit a logic bug in hopes that they too will see the light and correct this breach.

In order to get free music from Pandora, you will need to download a browser plugin.

For all of the Internet Explorer fans, you can download a free tool called HTTPWatch.  This tool can be downloaded by going to the following URL: www.httpwatch.com/download

At first I was having issues with finding a plugin compatible with Firefox and then it dawned on me: Google [firefox httpwatch]

The very first entry pointed me to a nice little Firefox extension (currently in beta mode) called HTTPGuideDog.  You can download the HTTPGuideDog extension from: code.google.com/p/httpguidedog

(Note: There are other Firefox extensions that will perform the same function.)

Both of the recommended browser plugins will capture GET and POST requests with corresponding response data from the browser session.

Now that you have the tools you need, it is time for the free music.

You will first need to set up an account on Pandora.com and create some of your favorite "Music Stations."

Just as an example, the first radio station I created was based on the band Radiohead.

Just as an aside, both HTTPWatch and HTTPGuideDog have almost identical features and will work in the same way.  Now is the time you will need to turn on either HTTPWatch or HTTPGuideDog and start recording your POST and GET data.

When you start to hear music, you should see the browser plugin recording all of your GET and POST data.

It is easy to tell which HTTP requests are songs because Pandora will use a specific domain: http://audio-...

For example, the first song that I saw in creating my radio station was:

09:16:12.333 0.444 12345678 GET 200 application/octet-stream http://audio-ixxx8-fex25.pandora.com/access/123456?version=2&token=abcdefghijklmnopqrstuvwxyzababedefghijklmnopqrstuvwxyzababcdefghijklmnopqrstuvwxyzab&lid=123456789

You should only be concerned with the specific song URL:

http://audio-ixxx8-fex25.pandora.com/access/123456?version=2&token=abcdefghijklmnopqrstuvwxyzababedefghijklmnopqrstuvwxyzababcdefghijklmnopqrstuvwxyzab&lid=123456789

Note:  The URL used in this example is a fake URL, so do not attempt to go to that URL.

You will need to copy that URL and past it in a Firefox browser window.

After submitting the URL, you will quickly get a "Download Notification."  Make sure you save the file to disk and do not open it.

After the file has successfully downloaded, you will need to edit the name of the file to include a file extension.

The file that I downloaded was 8XXX2X5 so I changed the name to: 8XXX2X5.mp3

At this point, you have successfully downloaded a music file from Pandora.

Be careful because Pandora likes to queue up music requests, so if you are not careful you will download the next song that will be played on your station.

If you are a coder you can take this logic to an extreme.  One could theoretically build a Python script, or whatever language you feel most comfortable with, to automate this process.

On that note, happy downloading.

Return to $2600 Index