How to download songs from heroboard.es without subscribing or registering

February 27, 2017 by Asbra — Leave a comment

TL;DR version: the final download link is https://www.heroboard.es/dl479cee37aba2504763690c2a26ef64f1/{youtube_id} where you replace {youtube_id} with the ID of their YouTube video

Heroboard is one of the “music promotion” YouTube channels, they supply no copyright and/or royalty-free music that you can use in your projects such as YouTube videos or Twitch streams.

In order to download songs they are promoting you are required to connect your YouTube account and subscribe to them. This would be all fine except that the way they do this requires you to connect with their app which not only gets access to your Google account details (name, email) but also full access to your YouTube account/channel:
download heroboard.es songs without YouTube account
which I really cannot accept.

Update: behind the scenes they just use YouTube in MP3

So let’s dive into their site and take a look at how we can bypass heroboard.

After clicking a download link on a heroboard.es song we get to their download page.

A savvy user will immedietly notice that the URL of the page contains the same ID as the YouTube video
https://www.youtube.com/watch?v=B8jNcz30DAE
https://www.heroboard.es/download/?id=B8jNcz30DAE

Let’s go into inspect mode on the download button, to do so in Chrome simply right-click and Inspect

So we see the following HTML

<a id="download-button" style="padding-top: 15px;" class="x-btn x-btn-rounded x-btn-large x-btn-block" href="#" data-options="thumbnail: ''">Step (2) Download your track <i class="x-icon x-icon-download" data-x-icon="" aria-hidden="true"></i></a>

We know that the ID of the button is download-button, id="download-button"

So now let’s grab any scripts that they load, at a quick glance this one looks really interesting

Open up that script and search for download-button, you will get a few hits in this region

Next what I do is use a JavaScript beautifier to make the code more readable, so I head on over there and paste the code in there, get the following output:

function countdown() {
    if (getVideoID() != "" || rossSongNumber != "") {
        var count = timeToWait,
            countdown = setInterval(function() {
                jQuery("#download-button").html("Wait " + count + " seconds");
                var counter = 0;
                if (count == 0) {
                    count = timeToWait + 1;
                    clearInterval(countdown);
                    jQuery("#download-button").html("Unlocked! Download your track <i class='x-icon x-icon-download' data-x-icon='' aria-hidden='true'></i>");
                    if (isRossSongCase())
                        jQuery("#download-button").attr('href', rossSongsList[getRossSongNumber() - 1]);
                    else
                        jQuery("#download-button").attr('href', 'https://www.heroboard.es/dl479cee37aba2504763690c2a26ef64f1/' + getVideoID());
                }
                count--;
            }, 1000);
    } else {
        jQuery("#info-nullref").show();
    }
}

So what sticks out here immediately is the following line jQuery("#download-button").attr('href', 'https://www.heroboard.es/dl479cee37aba2504763690c2a26ef64f1/' + getVideoID());

Now we can execute getVideoID() in the JavaScript console of our browser..

Low and behold, it’s the same ID as from the URL! B8jNcz30DAE

So as we can see from the code, the final download link is https://www.heroboard.es/dl479cee37aba2504763690c2a26ef64f1/B8jNcz30DAE. If we just go to that URL we get the song download we want, no need for giving away our YouTube account. Enjoy.

Asbra

Posts Facebook

Blogging out of many years of experience with gamehacking, programming, reverse-engineering and general tomfoolery.

No Comments

Be the first to start the conversation.

Leave a Reply