Breakpoints

I have a hunch that ak might be a Javascript object name. Let’s search for “ ak: ”.

player.js

player.script.js

Aha! It looks like ak is a concatenation of “_” and two strings in both player.js and player.script.js . We also see it in player.js passed to function k.md5() .

My guess is that this concatenated string value is converted to an md5 hash value. But first we must figure out the values being concatenated to “_”.

Let’s open player.js in the Sources tab (right click inside Response body and choose Open in Sources panel) and add a breakpoint after ak is defined.

player.js

Next, let’s close our open file tabs under Sources and reload the page.

Odd. It doesn’t seem to hit that line. Let’s try the same thing in player.script.js.

player.script.js

(Make sure to click the Pretty Print brackets on the bottom left after reloading the page.)

player.script.js

Bingo! i appears to be the same value as the spaceid that we noted earlier, and r is “ headlines.yahoo.co.jp ,” our host name, so we now have the string value “ 2078710353_headlines.yahoo.co.jp ”.

It looks nothing like the long, cryptic ak value in the request query, but remember that k.md5 function call in player.js ? Let’s check its md5 hash value.