Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@truecarry/tiktok-signature
Advanced tools
Install puppeteer
npm i tiktok-signature
const Signer = require("tiktok-signature"); // Import package
const signer = new Signer(); // Create new signer
await signer.init(); // Create page with. Returns promise
await signer.sign("tiktok url"); // Get sign for your url. Returns promise
await signer.close(); // Close browser. Returns promise
You can pass your desired User-Agent and tac on class creation.
new Signer("Mozilla"); // Set User-Agent to Mozilla
new Signer(null, "123"); // Set tac to 123
Install dependencies
npm i puppeteer puppeteer-extra puppeteer-extra-plugin-stealth
Now you can generate the token using
node browser.js "tiktok url" # service url
The response tokne should look like this
root@localhost: VIm6dAAgEBYZFjzZxqkSy1SJu2AAAlc
If you cannot succeed with this token, replace tac
token (window.tac
) inside local.html
.
https://m.tiktok.com/share/item/list?secUid=&id=&type=5&count=30&minCursor=0&maxCursor=0&shareUid=
https://m.tiktok.com/share/item/comment/list?id=<owner id here>&count=50&cursor=0
https://m.tiktok.com/node/video/feed
You can test it using
import requests
signature = "s0Ju9AAgEBCwzpufd4dd9bNCb-AAO0V"
referer = "https://www.tiktok.com/@ondymikula/video/6757762109670477061"
url = "https://m.tiktok.com/share/item/list?secUid=&id=&type=5&count=30&minCursor=0&maxCursor=0&shareUid=" + \
"&_signature=" + signature
request = requests.get(url, headers={"method": "GET",
"accept-encoding": "gzip, deflate, br",
"Referer": referer,
"user-agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.38 (KHTML, like Gecko) Version/11.0 Mobile/15A372 Safari/604.1"
})
data = request.json()
print(data)
NOTE
It's very important that the userAgent be the same when generate and when request for response.
If you have a better improvement to this code, let me know ;)
Hope it helps.
FAQs
Install `jsdom`
The npm package @truecarry/tiktok-signature receives a total of 0 weekly downloads. As such, @truecarry/tiktok-signature popularity was classified as not popular.
We found that @truecarry/tiktok-signature demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.