HLS Streaming PoC
TypeScript · Next.js · hls.js · JW Player · Tailwind CSS
Proof of concept for how pirate sites streamed movies off TikTok's ad CDN - HLS segments disguised as PNG images, played through a Next.js proxy that rewrites playlists and guards them with expiring tokens.
Overview
Streaming a movie costs a lot of bandwidth, and some pirate sites got it for free by hosting their videos on TikTok's ad CDN. This project recreates the playback side of that setup: an anime streaming page whose video segments live on tiktokcdn.com, served through a proxy so the browser never sees the CDN links.
The upload trick it depends on has since been fixed by TikTok. This is for research only. Using a third-party API this way breaks its terms of service.
How it works
- Polyglot segments: the upload endpoint for ad images only checked the start of a file. A file that begins with a valid PNG passes as an image, and the MPEG-TS video data after it plays as an HLS segment.
- Playlist proxy:
/api/hlsreads the.m3u8and rewrites every CDN segment URL to point at the site's own/api/hls-segmentroute. - Segment proxy: fetches each segment from the CDN with TikTok's referer, retries with backoff, and supports range requests, so hls.js gets the CORS headers it needs.
- Hotlink protection: playlist requests carry an obfuscated file name, a timestamp that expires after 5 minutes, and a referer check. A decoy API adds fake traffic to make the real stream requests harder to spot.
- Player: JW Player and hls.js, with separate tuning for mobile and Android.
The full write-up, including the upload pipeline and how TikTok could fix it, is on my blog: Biến CDN của TikTok thành kho phim miễn phí.