Greasy Fork is available in English.
Unlocks all Plus features (Speed, Loop, Solo) and Native Download (.gp5) by exploiting the Magic Guest Profile and server-side anonymization. Works on Chrome, Edge, Firefox & Zen.
当前为
*An advanced Tampermonkey script that unlocks all Songsterr "Plus" features, including native download (.gp5), by exploiting a server-side logic flaw. *
This project is the result of a deep analysis (Reverse Engineering) of Songsterr's React application and API. Unlike classic scripts that only modify the interface (CSS/DOM), this script intercepts and manipulates network requests in real-time to:
100000000) that retains privileged access rights on Songsterr's servers.Install the Tampermonkey extension for your browser:
Create a New Script and paste the full code from the Songsterr_Unlocker_V37.js file.
Save (Ctrl+S) and enable the script.
Go to Songsterr.com (works a lot better in private search !) .
This script utilizes a local Man-in-the-Middle (MITM) technique via the browser's fetch API.
Songsterr's server verifies session cookies during the file download process. If a free-tier user attempts to download a file (even with a patched UI), the server detects the "Free" session cookie and rejects the request with a 401 Unauthorized error.
This script implements a two-step strategy to bypass this check:
Profile Injection (ID 100000000):
It intercepts the /auth/profile request and responds with a spoofed JSON profile containing User ID 100000000. This specific ID appears to be a backdoor or an internal test account authorized by the server.
Request Anonymization (Credentials Omit):
When the "Download" button is clicked, the script intercepts the request to /api/edits/download. It surgically removes the cookies (credentials: 'omit') and authorization headers.
Result: The server receives a "Guest" request containing the Magic ID in the body. Since it sees no "Free" cookie to contradict the claim, it validates the request and serves the file (200 OK).
This project as only been tested on ZEN Browser (firefox based) so MIDI and Guitar pro downloads can not work on other Browsers
This project is for educational and cybersecurity research purposes only :) It aims to demonstrate logic vulnerabilities in server-side rights validation (Insecure Direct Object References / Broken Access Control). If you enjoy Songsterr and use the application regularly, please support the developers by subscribing to an official plan.