but they're going to be yours soon. Yeah. So yeah, that's like 17. 17? 17 or something. I think that's right. All right, last box. Good luck, everybody. Nothing too crazy in this mixer. Sometimes that's the nature of the mixer, but we do have that higher hero we're still giving away, so... 21? Wait, from L.A. or he's just saying the teams? What state is the most professional sports team? He's saying 21. How to fact check Rex, as usual. Devontae Graham, Zach Levine. To 75 for Tristan and the Bulls. We just counted all the basketball, baseball, football, hockey, and soccer teams. There's Jaden Hardy. Wait, is it not California then? For Dallas, that's going to be for Jason. There's D'Angelo Russell, and behind him is... Oh, I thought it was going to be the guy on the box, but there's Cole Anthony, Perennial contenders autograph for Orlando. I was like, that's going to be a nice way to finish it. Jason S. with that. Alright, but even with L.A. Sparks, Angel City, and then like... There's not an NWSL soccer team in Northern California, or San Diego Wave, that's another floor. I guess that's 20. Maybe that gets us to 21. Golden Bears?  That's a college team, Rex. You said professional, don't change the rules on us. I know we had college then, you know... What's your source, Rex? We've got to go through this again. What's Rex's source? Alright, thanks everybody. That was the break. Let's give away the Tyler here. Let's gather everybody's names, one through 30. New dice, new list, winner take all, just one winner, name on top. After three and a one, four times. One, two, three, and a one, fourth and final time. So name on top. Thanks everybody for getting into this mixer. I appreciate you. It's going to be Alan Matsui with a spot he won in the filler. Congrats to you. Apologies to everybody else, but Alan, congrats.  Thanks everybody. That was Jasper's Five Box Playoff Push Basketball Mixer. Keep an eye out for more basketball on JasperCaseRace.com. We'll be talking playoffs, all playoffs long, and ripping basketball as well. I'm Joe for JasperCaseRace.com, and I'll see you next time for the next one. Bye-bye. Come on, Rex. You just Googled California Professional Sports Teams? Rex's research skills not exactly the best. Yeah, that's a college team, Rex.  That's Berkeley. Rex is trying to... There you go, Alan, congrats, man. Rex is trying to do some trivia, which I always appreciate him all about, but you know.  You know, those automatic results that come up in the first section on Google results are not exactly the most accurate. Well, yeah, you added women's. On that list was women's, so what's our criteria? You've got to include women, right? Or you can specify men's professional sports. Rex, adding college teams. All right, gang. In all seriousness, thank you very much for the fill. I wish there were some bigger hits. I wish there were bigger hits in that mixer, but we did give away that... Did give away that Tyler Hero, which was nice. That's the variables that come in with the mixer. But I'm glad we did it. At least most people won their way in. All right, Jason, Kay, keeping the Spectra Dream alive gets a spot. We're down to five. Are we gonna do this tonight? I hope so. We got time to do it tonight. We got time to do it. We're giving away two spots. We'd love to get that done tonight. Someone help Jason out. Someone help that entire number block group out. It's really effective. You're working through things. How are you managing just the adjustments in game and how did you feel on the back and what the results were? Yeah, I think it's very consistent. It's very consistent for the last few starts. I think it's just a matter of time. I guess it's gonna match five. I think that's everything. I'm just gonna get it for the next few minutes. I'm just trying to get it. I have to figure out what I guess the next two. I think how it felt. What's that? Comfort level? I don't know. You're messing with me. You're messing with me. Yeah, it's gonna be something. I think every time you look at it, you're gonna feel like you're the most part of it. It's not like basically every game. So it's like, it's great. I think you kind of find a run. You kind of get out of your mind. You're about there. You just pitch it. So I enjoy it. I don't want me to go, but if you had to think about what your first couple of starts as a doctor would be, pretty happy with this. Would you say? Yeah, me too. It was great. Obviously, I'm feeling perfect and I think I'm like, I wish I felt perfect again, but it's not the same. I'm like, our team is so good. And just I think you guys have been amazing. I think it's been a nice thing to see. I think early in season, I kind of get this team's ideas. And I think when you are feeling perfect, it's best to be on it because there's something out in this image. So maybe some of you guys see this as a balance. 6-8, 100-minutes, a little bit of days of day, great to bring help. We see Y-1, last night, one of the most powerful stars in baseball. But that's, he is amazing. He's fun. He made sure he gave his team a chance to win. He expects to bring us on himself. But the fight is there. The one who's there, so I'm low. He is our ace. Oh, and we want to know it. I trust him. All right. So Nick just took another two, another two out of spectra to make it four total. Those two extra is tonight only. So hopefully that moves the needle for somebody. It has to, right? If we're giving away four spots, that means we're only selling six spots outright, over half of you are going to get extra spots. So three of six left now, four spot giveaway right here. So over half of you are going to get extra spots. That's excellent odds. Unlocks the break. And I'll be honest with you, it's unlikely that I'm going to be reposting that spectra again. I thought that'd move a little bit more quickly, but maybe we'll save it for a mixer or something like that. So in terms of group breaks, just spectra. If you're a spectra football fan, get into it because we won't be posting more after this. So it says Joe, a ball, a bat, and two caps. I may be, that's what it was. Two caps. You've got to be Sonic, right? Yeah, I don't know. So I don't know what two caps means, but a ball and a bat, though, which I'm cool with. That's got to be awesome. It's got to be autographed, right? Well, that would say Shohei on there. Actually, that would be kind of sick because you know it would be his, yeah. Did you see the bat play on New Jersey? Was that the Japanese name on there? That's a bit bad. Let's board the home run to Left Center. He's a good swimmer. And that's where we'll get that first half since it's a part of the game. I'm just going to run it. You know, it was good to see that his first home run went good. I'm not going to appreciate it because I'm a fan, so he's got a lot of enjoyment out of him, but I'm sure he was just a muter. He was a little bit of a player. And that's where you'll run right there on big runs. And then I'll just go and look at that and say, well, it's important to get you so far at least, and can you give me anything at home if your home run is on the line? No, no right now, I've never been here for different ones. But even right now, with some guys that are kind of stuck away and trying to find their way with their swing we're still putting up a few hundred runs a game. So I think it's a big start, So, you know, of course now it's almost like every time you take the baseball you feel like there's no possibility that stuff is that good, and you left that slider. Oh, sir, sir, yo. Do we have a rally here? Can I hear a rally? Yes. Michael is going to try to start something.  Listen, over half of you are going to get extra spots.  It's basically a, it's almost a buy one, get one. We're one spot, oh, it's four spot giveaway, right? We're one spot away from a buy one, get one. We're basically giving this away at this point, you know, probably losing money on this at this point. So let's just get it done. Let's knock out these two spots. Let's get the break done. It's most likely going to be our last break of the night as well. I think I feel the momentum slowing down a little bit. So, you know, especially in the last 45 minutes of the show, we can't really expect like a, like another wave of people coming through. So if you're listening to the sound of my voice, you're it. You're the ones that have to fill it. So step up, grab a spot, got a great chance to win an extra spot. We unlock a two box break of Spectra. And that's probably, you know, we might sit around and see if we can get something else done, but at least do this tonight. So while you're placing your order, I just need two more people. Texans. Panthers. Packers. Raiders. Bangles. Chargers. Dolphins. Broncos. Saints. Broncos. Saints. Giant Steelers. Buccaneers. This guy's not supposed to have it in the Steelers spot. What did this person buy then? Ah, he has the Eagles, not the Steelers. Steelers. Buccaneers. Commanders. Back on track here. And last spot, Mojo is Cowboys. By the way, these two extra spots are tonight only. So these two extra spots are tonight only. We'll keep the standard, we'll keep those other two spots right there. But two spots away from unlocking this Spectra break. Like I said, if you're hearing the sound of my voice, you're it. It's very doubtful that there's going to be another wave of people coming in on a Wednesday night to fill up this Spectra. So if you want to do it, let's get it done. Remember, we're only selling six spots outright, over half of you. Four of the six spots, all right, that 66% of you will get extra spots. Incredible odds. So help me out, help yourself out. We got the Spectra football right here, ready to go. Most likely going to be the last break of the night. Two left, ladies and gentlemen. Only selling six spots outright. Four of you, four of those spots will get extra spots. Unlocks this two box break of Spectra football. The option estuary Ruiz, it's very odd. I don't know why they would do that. The explanation doesn't really make sense, too. Why not just give him Major League at bats, lead off at bats every day in the majors? What does he really have to prove in the minors? He's just going to crush minor league pitching. Do they want him to take more walks, I guess? This is a little, hold on to him longer? No, any service high manipulation is gone, right? I mean, he played a full season last year. On base percentage, if your on base percentage is over three, that's pretty nice. I guess you want to see him walk a bit more, but so there has to... Jason saying there was a protest, like he was protesting something, but bracelet. That's probably exactly what it is.  Yeah, if I'm those two guys today, whenever that happened, I would be like, you know what, I would like to request a trade.  Yeah, I'll bet ownership was like... ownership, and that John Fischer is pretty garbage, too. Ownership was probably like, you know what?  Ridiculous. 30 minutes left, ladies and gentlemen. Jason's got two spots already. Robert's got a spot, Luis has a spot, Michael has a spot. I need last spot mojo from somebody. Maybe the last break of the night. We're not posting any more spectra. Unfortunately, it's just not moving as quickly as we needed to, but we can definitely pop up. We can save the boxes for mixers. Those are great boxes for mixers. Let's get this across the finish line. Let's get it done, ladies and gentlemen. Last spot mojo. It's funny because the owners obviously were worried about the backlash for keeping him in the majors. I don't think there would be a backlash if Ruiz was stayed in the majors. It's just his ego that's having a backlash. I think he's angered one side. He's angered the fans. Probably angered them even more now with dumb moves like this. Nice, Michael. Thank you. Stepping up with a second spot as well and last spot mojo. Thanks, everybody. Probably good night after that, but if you're feeling spicy, you want to fill up another quick little break, that Immaculate Collegiate could be a fun way to end the night if you feel like doing something else. A lot less expensive. Just need eight people if you want to do that. I'd be down to do one more quick thing if that fills, but otherwise, thanks, everybody. This might be our last break of the night. Hi, everyone. Joe for jaspyscasewrakes.com coming at you with a random number block for spectra. I think your team won two boxes from a fresh case featuring 13 teams. A lot of great teams involved in here. Appreciate everybody getting in on it. We're already giving two away, giving two more away tonight only. That moved the needle for this group right here. Thanks. Over half of you are going to get extra spots. So let's roll it. Randomize names. Five and a three. Top four after eight. Get extra spots. One, two, three, four, five, six, seven, and eight. After eight times, Luis, Jason, Jason, and Michael. Sorry, Robert, but appreciate you getting in. So a little buy one, get one opportunity for you now. Let's gather all of these names right here and randomize you a number. Let's roll it. Randomize it. Six and a three. Nine times for names and numbers. One, two, three, four, five, six, seven, eight, and nine. Michael down to Jason. And then six and a three. Nine times for the numbers. One, two, three, four, five, six. Good luck. Seven, eight, and ninth and final time. One down and nine. All right. So Michael with one. Jason with five. Jason with three and seven. Michael with six. Jason with two. Luis with eight. Michael with four. Robert with zero. And Jason with nine. Remember, zero gets any and all redemptions, including one-of-one redemptions. Michael, you'll still get live one-of-ones only for these teams, obviously. There you go. I'll see you in the next video for the break. Jaspeyscasebreaks.com. Whoa. No. I did not hear that. That's awesome. Did Pizzle pull it for himself? Or what was the... That's awesome. In a break? Nice. Lucky dog. All right. Good luck, everybody. Hi, everyone. Joe for Jaspeyscasebreaks.com with a two-box break of 2023. Panini Spectra football. Pick your team. Number one from Jaspeyscasebreaks.com. Big thanks, everybody, here for making it happen. Thanks to the people who bought their team straight up. Matthew, you ended up with last spot mojo with the boys. See, we pulled some teams for that random number block. I did that in a different video if you're looking for that. But here are the results. So it's a serial number break just for those teams. Just in pick your team. Number one. Half case from a fresh case. Empty box. So it's just a quick little two-box break. So let's roll the dice a couple of times just to see which halves we're going to do. First of all, left half or right half. One, two, three for the left side. Four, five, six for the right side. Six, right side. And then we'll go one, two, three for the top half. Four, five, six for the bottom half. The dice way over there, but you can see two. One, two, three. So we'll save four, five, six for some other time. Good luck, everybody. Four cards for pack. Four packs for box. Four autographs and four memorabilia cards. For box. So a lot of hits in here. We've got, let's see how we're going to do this. Two hits right here. Put that right there. So we'll take a look at these first. A couple of different Josh Wiley's, one of them's a refractor. Kind of tell right there. Respectra.  That'll be a randomizer between Cleveland and Miami. Cleveland will be Dan, Miami will be number block team. So we'll have to randomize someone. It's not numbers. We'll have to randomize someone for the non numbered cards. And we'll figure all that out. We'll deal with all that later. We got a Aaron Rodgers. Discount double check. 61 out of 75. Got Justin Fields, 47 out of 99. Max Impact. Jersey. It's going to go to the Bears. Jerry with the Bears. We got Tyree Wilson. Rising rookie. Dual relic for my Raiders. That's a random number block team. So that's going to go to Raiders 3. And that'll be for Jason. And then we've got Kenneth Walker III. Three out of 35. Retrospect. I like the retro look there. Autograph. Going to Seattle. That'll be for Adam. And the Seahawks. The Hawks of the Seas. Got the James Cook die cut. Seven out of 50 for the Bills. Bennett with the Bills. Buffalo. Crazy trade for the Bills. They traded Stavon Diggs to Houston. Great move for Houston. But what did the Bills do? Cedric Tillman. Two color. Dual relic is going to go to Dan and the Browns. 28 out of 50. And then we've got A Kendra Miller. Three out of 75. Good looking patch there. Three color patch and autograph. Nice pulsar pattern. Going to the Saints. Sorry, random number block team. So they'll go to Nolans III. Saints III. Jason K. Three out of 30. Amon Ross, St. Brown. Alex with the Lions. And we've got Jalen Hertz. 64. Out of 99. Brilliant relic. Piece of the jersey going to Joseph G. And the Fly Eagles Fly. And we've got Michael Meyer. 15 out of 60. Silver and black patch and autograph. For my raiders. Raiders are a number block team. That'll go to Vegas V. Luis with the number five. 85 out of 99. Got Sam Howell. Commanders are a number block team. So Commanders V. Another one for Luis. Titans. Eric and then Colts. Eric, okay. And we've got Jackson Smith and Jigba. Rising rookies. Dual relic. That's going to be for Adam and the Hawks of the Sea. Two out of 60 on that one. And we've got a nice Bijan Robinson. Eight out of ten. Real nice patch. Great autograph. Barry Roberts picked up the Falcons straight up. Nice one, Barry. Real low number two. I dig that. Out of ten. That's strong. Another box. We've got a redemption down here. Ooh, a nice CJ Stroud up there as well. There's his teammate, Will Anderson. That'll be part of the non-numbered group. Jameer Gibbs for Alex. Nice rookie aura to 99. Michael Pittman, Colts. And Trey Tucker for the raiders. Let me one of those non-numbered cards. And all the non-numbered cards, we're going to send this one lot to one person on that number block group. Alright, let's take care of the CJ Stroud really quick. Texans. This should be numbered. It is. 14 out of 30. Number four, Michael H. There you go, Michael. Probably go for a lot more on the secondary market than you might think. Remember, CJ Stroud doesn't have autographs, so all these types of cards have a big boost in value. And he's got Stefan Diggs now. Epic legends, Randy Moss. Karen with her Patriots. There you go. Four-color patch in there. There you go, Karen. Big Patriots fan. 13 out of 15. And we got Quinton Johnston. I think the Chargers, along with the Bills, have to kind of rebuild their receiving room. That's a number block team. Boltz are a number block team. So Chargers four, Michael H. Juju Smith-Schuster. 33 out of 50 for Karen and the Patriots. Tank Dell, 21 out of 75. Piece of the jersey. I mean, things are going to look better for Tank Dell, too, as Stefan Diggs on that team. So that's going to go to Houston one. That will be for Michael H. Last spot, Mojo, in the number block group. Then we've got Aspiring. Jaden Reed. Three-color Jersey Silver Ink Auto. Three out of 10. Packers are a random number block team. A serial number team. Packers three, Jason K. Great hit. Yeah, that Diggs trade was great. I was surprised to wake up to that. There's Justin Short, 35 out of 99 for the Bills. Bennett, there is no way that the Bears would take McCarthy over Caleb Williams. I mean, they may take a different quarterback. Maybe Jaden Daniels or something like that, or Drake May even, but even that's a long shot. No, Vegas bookmakers have... Here's Matthew Stafford, by the way, for the Rams. It's going to go to Jeremy. Books have, like, Caleb Williams is a huge favorite to go number one overall. Three out of 15. Three-color patch. Roshan Johnson. Yeah, so I mean, it's gotten to a point where analysts have just stopped talking about who the Bears will take. The assumption is that they'll just go with Caleb Williams, number one. Jerry with the Bears. Nice colors in that patch. And we got a champion signatures. Plaxco Burris. New York football giants, the G-men. And then the Bears' GM has said, yeah, every signal has been that, that they're going to take Caleb Williams. There's New York Giants four. Michael H. The only way that changes, I guess, would be if someone made some sort of crazy trade for the number one pick. It would be the only way that would happen. So four out of 20. Keishon Butte, that would be for Karen. I think people have kind of stopped talking about that. I don't think that's even... Unless the Bears are completely... And even this is, like, can't miss. Or a no-brainer to take that. I don't know if the players that can't miss we're going to find out, but... At least the pick is in. Again, unless someone does a crazy trade, but does not seem likely. Three-color triple relic, Fred Taylor. 57 out of 60. That's going to be for Adam and the Jags. And the redemption. Did everyone see that? Signature is neon orange. It's going to be... Tyreek Hill. Dolphins, that's going to go to... Dolphins are a random number block team. That's going to go to zero. And that would be for Robert and the number zero. There you go, Robert. All right. Now, let's do a couple of randomizers here. First, we're going to see who's going to get the... All the non-numbered cards for that number block group. So let's flip back to that list. Let's gather everybody's names here. And then we'll do the Miami Cleveland randomizer. Because we'll have a... We'll know who's going to get the non-numbered cards there. Let's roll it randomized. Five into three, eight times. One, two, three, four, five, six, seven, and eight. There you go, Robert. You'll get all the non-numbered cards, including that Will Anderson. There may be a couple others in there. And you also have a shot at this two-player card right here. Five into three, eight times. One, two, three, four, five, six, seven, and eight. But no, Robert. It's going to go to Cleveland instead, and that's going to be for Dan. So there you go, Daniel. You'll get this dual-player card right here. All right. There you go, gang. I'm Joe for jaspyscasebreaks.com. Thank you very much for the Phil Strong late-night rally. Appreciate you. I'll see you next time for the next football break. Bye-bye. I mean, ever since the field's trade wrecks, I would say that probably even solidified it even more that they were going to take Caleb Williams. All right. So I think we're done for the night, folks. The best way to cope for putting in a lot and not getting lucky? I don't know.  I mean, that's really what it is, you know? You got to, first of all, you got to kind of establish what your budget is going to be, what you want out of the hobby.  They don't care whether they win or not. Some people it's strictly about flipping the hits for profit. Some people are about, hey, this is all personal collection stuff. So whatever I get, great. I would, you know, but if that's just still not working, but if you're still in kind of enjoying the experience, but not the results, which is often, this is going to be the case. First of all, just know that you're not the only one that happens to a lot more people. The majority of the people aren't in the same boat as you are. You know what I mean? But I don't know. I think the best thing to do is sometimes just take a break. Take a couple of days off and then check back in or wait for a different new release that you really like and then, you know, just wait until then. Just watch the show, hang out, have fun. But that's kind of the advice. Just kind of step away for a little bit, you know? It's really the only thing or step away from buying it. You can always hang out, you know? You can always hang out in the chat, obviously. You're always welcome, but that's really the only way to kind of do it is just sort of, you know, hit the pause button, lick the wounds a little bit and then, you know, try to get back in. I think the first, if you're new to this, the first year, basically, I would say, you know, especially for the people that end up being long-term customers like most of our crew are, the first year is always the roughest because I think it's so exciting and you want to get into every single new release that comes out and then what people realize is that people are like, man, you know what? Knowing what I know now, I never would have bought into this product, this product, this product but purchased more of that other product. So there's going to be a lot of trial and error. You're going to have to find out what you personally like and don't like out of the hobby, you know, what hits you like, what you're looking for out of the hobby.  Maybe I'm more of a baseball guy than a this team guy. Maybe I'm more of that guy than another guy. That works too.  Some people like, some people only buy Hit Parade because they only want to chase after the monster hits. Some people are only buying into, you know, this sort of hybrid break because they see a lot of value and numbered cards and like to grade those cards and things like that. It's just a lot of different ways to approach it. You just have to kind of figure out what your approach is. Like, what do you want to get out of this whole experience? You know? And then I think once you kind of figure that out, you'll kind of go from there. I always like to encourage people to try to, whenever you can, try to avoid spending too much on these fillers. I know those can be pretty seductive because you're going to try to win a spot for a fraction of the price. I feel like that's always, that's kind of a next level stuff. You kind of have to know what you're getting into, you know, but for anyone who's relatively new to this, I'd rather tell people, hey, just get a full spot into the break. You know, you don't want to lose a chance to even be in the main break before we can even get there, you know? So, unless you know what you're doing, I feel like for new people, I would rather encourage them because most of the time people are going to buy like five spots, right? What's $21.99 times five, right? That's already $110. At that point, I would tell people, screw that. If you're already spending $110 on a filler, why not just spend the extra, you know, $30 and guarantee yourself a spot instead of having five spots end up in the bottom half of the list and you're not winning anything?  Now, knowing the risk, there are a lot of people that go big on these fillers and take big swings at those, but a lot of times, a lot of times it's sad times. Right, and listen, we've been doing this for 10 years. Look at our YouTube videos. There's a whole archive of videos that we have. So like, for example, we just did that spectra break, right? You know, sometimes you can look at an old spectra break from previous years to give you a better idea on what this year's spectra might look like.  Or like, I would also watch our videos. Pretend you've got XYZ team in a break and then watch the break through and then you'll get an idea of, all right, if I bought this team, you know, I know how often they seem to hit or not hit as the case may be. Other thing, too, is for pick your teams, I think obviously the more expensive teams, right, are going to have a better chance to hit than that's why they're priced the way they are. If you're buying the $20 Rockies, yeah, your expectations can't be too high on that. Yeah, space out part. And the other thing is just know what your budget is going to be. You know, what you're comfortable spending with on a week-to-week basis. And always know that there are products that every week there's a new release coming out. You know? Yeah, I mean, it's a lot of fun. Yeah, it's like, it's pretty rewarding, especially with the group breaking thing. I think it is kind of rewarding because we've got a good community in the chat like Duncan and Rex and all these guys. And, you know, we at Jaspeas as hosts of the show, we really enjoy talking to people about sports in general. You know, a little bit of gambling talk. We like that too. A little bit of pop culture talk. We don't get to, you know, we say pretty mainstream. We don't get too controversial. We like to wrap all this up in sort of a family-friendly kind of show-ish, you know? So we love kind of community-building as well. As you've probably noticed, you've been watching the show, I think, for a little bit this week. So I think you kind of get what our vibes are like. But yeah, I think really it's just, it is, if you really want to get into this, you know, I think there's so much to, like, research. I think I'm a bit of a researcher, so I kind of like that. So the hobby does kind of align with how my brain kind of works. So there's a lot of checklist and a lot of resources out there that you can look into and try to avoid message boards.  Just if it makes you happy, do it. You can stay within your budget. That's all. Yeah, we have so many customers that just say, you know what, Jaspeys? I just put you onto the background. It's like radio, like sports talk radio. They just put me on the background, leave it on. If they work from home, they just leave me on the background with their laptop and they're going to do their work. And if they kind of hear, oh, Joe or Jason or Michael are saying this break is close and then they'll run over, check the website, maybe buy a spot or two and then join in when the break fills. So yeah, there's a lot of ways to consume the show and a lot of ways to have fun with it. But glad you found us. Yeah, Duncan does that way, yeah. Yeah, that's fine, yeah. I mean, you know, and just kind of, I think kind of watching for a little while before really diving back into it, I think would be good too.  Try to see like, oh, okay, let's see what happens.  You know, and then you can kind of track it along and see, all right, would I have been happy with that experience? Would I have not been happy? You know, you can kind of play that game as well. Or just watch any of our archive videos.   So you can always pretend like, all right, let's see what I would have gotten if I had, you know, the Royals or the Dodgers or something like that.  So the research is always like the key. Yeah, and I think you'll, yeah, that might be a little next level for brand new collectors, but yeah, Rex is right. I mean, like, especially in high-end breaks like Sterling, if a team, you know, I don't know about these $20 teams, but you know, if a certain team that feels like they have a lot of hits, if they don't hit in the first half, you know, a lot of people try them in the second half, try to see if they could get them in the second half. That's a strategy as well. Let me just have a couple pictures of these, I'll be right back to say our good nights. But yeah, I mean, Matthew, I think that would be kind of like the initial sort of thing. Just research a lot, budget and research, you know, and just kind of figure out what you want to get out of the hobby, you know. Sam, what's up? Yes. Whenever they, yeah, whenever we can get our hands on more, we always love doing those underwraps jerseys. They're always, practice golf all my back pocket. Where's my phone? There it is. Yeah, but yeah, whenever we can get our hands on some more, we'll certainly do some more. Gables printed out, photos taken of some of the hits. A nice day, everybody, really nice day. I'm glad we were able to, with Nick's help, we were able to get a couple more breaks across the finish line. We gave away some extra spots. That moved the needle for some people. I appreciate everybody putting in the work today. We got a case of sterling done today, which was awesome. So a lot of excellent work done today. So thank you very much. Duncan, Sam, Rex, Matt, and anyone else who's still lurking and listening in the background. Have a great night, sleep tight. I'm on Fanatics Live tomorrow, tomorrow's Thursday, so I'm on Fanatics Live tomorrow with Michael Jaspe. Jason will be taking care of you tomorrow here, and he'll be in around two or three o'clock Pacific. And then he'll get a lot of stuff started. Hopefully we'll get some more sterling done. We'll get some other breaks across the finish line, maybe pre-order some more of that immaculate football. Get that moving as well. Thanks, everybody. Have a great night. See you tomorrow.


Everybody forest here ripping it's 20 21 select football hobby hybrid five bucks number three I'll leave the results on screen for you can always find those a latent sports cards calm. Let's do it. Good luck everybody No, Paul. Oh my god You guys are just wild You know butter plane or crunchy I prefer crunchy, but I'm not like I'm kind of both ways I like crunchy on my PB and J's but It's something else Do they should make uncrossable Be amazing Elijah Moore Michael Carter premier level disco James Robinson Jags Parker silver premier level gates for the Chargers silver premier level rookie Eagles Kenneth Gainwell That's what I'm saying elusus I wonder concourse disco Steelers Troy Palamalu digs in Mond You know butterfudge is the best fun send it hands down the best in the world is peanut butterfudge I'll get you the address name to the shop Dean. I'll Venmo you right now pay for the all the ingredients And I'll end all I'm nice. I'll throw you even more money for the for all the because you're literally working, so Red disco club level Najee Harris nice one Steelers 39 to 49 Oh Deans getting mad break credit this much. I promise you Dean come up again something Jalen waddle come on course silver Antonio Gibson Washington Creamy natural honey do the honey roasted peanut, but there's a The brand is called Santa Cruz. They make organic peanut butters. They do like a honey roasted Peanut butter and oh my goodness It is like so it's not like super sweet because it's organic, but oh my god All right back to the break. We got gold disco coming After that Wilson and Bateman gold disco come on Hackers rookie concourse Eric Stokes Very nice three of ten for the Packers Chris see there you go man Nice one there collar match as well Derek Henry Levi was a Rique Gotta find it man. It's not super cheap. It's like six bucks a jar. I guess that's not crazy or peanut butter nowadays though You know what it's like five bucks anyway Mountain Dew fudge. Oh, yeah, you saw me. He's telling me about the Mountain Dew fudge Yeah, I'm interested Hold my teeth to fall out now. I need that new fudge. Yeah Club level disco Niners Fred Warner Mouth my first Troy Nixon silver premier level rookie Chuba Hubbard Panthers Dude I asked her so don't get it wrong.  I don't make you hungry Concourse rookie Mack Jones. That's awesome. Yeah, well premier level disco rookie liking Samir Smith Marseille Keenan Allen Shannon shark isn't going to work up an appetite do group breaks and everybody talk about food and chat Bateman Schwartz concourse disco rookie Vikings Amir Smith Marseille Well silver concourse Packers Devontae Adams with some chips away Get ourselves I don't know and there's also not a lot of time to eat while we're here to be fair I have like uncrustables that I have that I keep in the freezer here at work For like something I can just kill like 20 seconds, you know Concourse blue disco rookie Jay little bottle nice one fins 15 of 25 Nice one fins Got a lance premier level and a watt with a dented a corner there The base if anybody sends me chewy chips of hoy, I'm blocking you on the site Yeah Don't you dare send me chewy chips away? Bonte Smith Concourse disco rookie Bengals Chris Evans. I'm in the first truck back to you Premier level silver rookie Lions leave on was a reek egg return to send her nobody Cheer cheer wine is cheer wine is so good off the author just get you something. Yeah, it's awesome If you like dr. Pepper or like cherry type soda, it's like cherry dr. Pepper for better. It's alcohol. No Williams blue premier level disco Tyson Campbell Jags rookie number 14 of 25 All right Dean as much so I want to hear about I'm gonna have to ask you to pump the brakes on all this man Concourse red disco Patriots from Andre Stevenson 28 of 49 come to the glass of milk in the dentist silver concourse Miles Sanders Eagles Club level rookie disco bills Greg Rousseau What'd you hate Rory? Zach Wilson premier level Pat my homes Yeah, the minutes breaks can be kind of tough The six boxers chips of hoy Reese's I've had those there. All right Club level rookie disco bears Justin Fields nice fields Hubbard Oh, that's awesome Rory club level rookie silver Javon Holland Dolphins a pick it. I mean Non-auto pick it. Okay. Let's hear you're saying it's bonce Williams. Khalil Herbert premier level rookie disco Pat for our move Steelers Good luck with that. Good luck to be Hess Well Herbert Romo concourse silver rookie or not concourse silver but concourse disco Derrick Gord chiefs Silver concourse Zeke for the Cowboys Trey Lance Premier level red Stefan digs bills 46 49 All right last box We've had some really nice cards in every single one of these hobby hybrid break so far Fields eskridge Montgomery premier level disco Bo Jackson Raiders There Tucker silver premier level Derrick Henry concourse disco Marshall Falk Rams That's Fitzpatrick premier level in a Ben Ralthus burger. Where'd you pick him a lucis? Gold coming up nice Frank Darby rookie gold premier level three of ten Falcons Concourse of rookie Michael Carter Jets. Shea well played and Red club leveled rookie disco trace sermon Niners 30 at 49 and Silver club level Zach or its Cardinals. All right, give me one sec guys. Why should we just have one maggots card here? There was a nausea here is red as well, but we have this concourse blue Rookie Jalen waddle 1525 dolphins congrats on that. Thanks again everybody one more H2 coming up


Hi and welcome to our session. Let's discuss the following question. The question says integrate the following functions. The other function is 1 by square root of x plus a plus square root of x plus b. Let's now begin with the solution. In this question, we have to integrate the function 1 by square root of x plus a plus square root of x plus b with respect to x. In this question, we will multiply the numerator and denominator by square root of x plus a minus square root of x plus b. So this is equal to 1 by square root of x plus a plus square root of x plus b into square root of x plus a minus square root of x plus b by square root of x plus a minus square root of x plus b dx. This is equal to integral of square root of x plus a minus square root of x plus b using identity of a square minus b square. In the denominator, we have square root of x plus a whole square minus square root of x plus b whole square dx. This is equal to integral of square root of x plus a minus square root of x plus b upon x plus a minus x plus b dx. This is equal to 1 upon a minus b into integral of x plus a minus square root of x plus b dx. This is equal to 1 by a minus b into integral of square root of x plus a dx minus 1 by a minus b into integral of square root of x plus b dx. This is equal to 1 by a minus b into integral of x plus a to the power 1 by 2 dx minus 1 by a minus b into integral of x plus b to the power 1 by 2 dx. We know that integral of a x plus b to the power n with respect to x is a x plus b to the power n plus 1 by n plus 1 into derivative of x that is a plus c. Using this formula, derivative of integral of x plus a to the power 1 by 2 with respect to x is x plus a to the power 1 by 2 plus 1 by 1 by 2 plus 1 into derivative of x that is 1 minus 1 by a minus b. Again using this formula integral of x plus b to the power 1 by 2 is x plus b to the power 1 by 2 plus 1 by 1 by 2 plus 1 into derivative of x that is 1 plus c. This is equal to 1 by a minus b into 2 by 3 into x plus a to the power 3 by 2 minus 1 by a minus b into 2 by 3 into x plus b to the power 3 by 2 plus c. This is equal to 2 by 3 into a minus b into x plus a to the power 3 by 2 minus x plus b to the power 3 by 2 plus c. Hence a required answer is 2 by 3 into a minus b into x plus a to the power 3 by 2 minus x plus b to the power 3 by 2 plus c. This is a required answer. So this completes the session by intake care.


Morning everyone. Let's get started today. So we are All right, so we are going to continue on ahead with the next Area of Insecurity that we're gonna look at and specifically we're gonna look at web and web applications so a Lot so kind of part of what I want you to be thinking about when we start talking about this is how our How are web applications different from traditional? binary applications that we've been looking at What makes them unique? What makes them different? Why are they interesting? There's an eye of my own reasons, but I'm curious to know what your thoughts are and so Basically the plan is we're first gonna look at kind of an evolution of the web. We're gonna look at some core technologies We're gonna understand how web applications work and then we're gonna look at vulnerabilities vulnerability classes in those web applications and We'll also try to draw some parallels between the web application vulnerabilities We look at and the binary vulnerabilities that we also saw and also see that some of the things that can happen in here Actually also affect the network security problems that we talked about right so Okay, so the lead This is believe it or not an image of the very first web browser So this in the center. This is a picture of since it's welcome to the universe of hypertext right very grandiose name so this was in 1990 1991 So Tim Berners lead the author of the first world-wide web browser and server He worked at CERN. So what does CERN do? Does Yeah, the LHC right there the thing that's going to destroy the world and create a super black hole where the earth is and we're all going to be believe happening to existence So he was working there. He had a tech background and he realized man. It's really annoying to have to Because they had scientists coming and going to work on the project now work on the project And he's like man, it would be really nice to like have some central directory for Who people are what their phone numbers are how to get in contact with people so that we could connect to them So this is the very first website So this was the very first website on the worldwide web It's a wide area hyper media hyper media information retrieval initiative And we give universal access to a large universe of documents. It's pretty cool. We don't try to write like Tim And so this is Tim So Tim service that is a server now from I assume the Queen England. That's how those things go And so he was working at CERN. He proposed this idea of so at the time this hyper media Which we'll talk about what exactly that is these ideas that are even kind of bubbling up at the time There were previous hypertext systems and So in 1989 he his proposals accepted the people at CERN well, yes We think this is a good investment of your time resources work on that He created the first website at the end of 1990 and I'll say he wrote a book I'll be leaving the web. So this is if you're interested in the web and the origins of the web I highly recommend this book. It's a really good take on his experience what things get to do and why he thinks it kind of took off So What's the difference between the internet and the web? What is the internet? Let's start there It's a network of networks, right? It is the network of networks where you have independently on networks We're all connected to each other So using the internet or using the internet technologies that we saw right TCP IP UDP Right we can send a packet of information from one computer to any other computer on the internet So how does that differ from the web? Is the web the internet? So the web is associated with HTML and browsers. So is email the web and is email the internet? Yeah, so what layer so we talked about kind of a seven layer, so what layer is the email? At the application layer right so it's application level protocol It uses usually port 25 to do SMTP messages to send hosts. There's a whole protocol designed to do that, right? So what's the web? It's also just another application, right? It's just another application that uses the internet to do things right uses port 80 typically to do HTTP requests it uses port 443 to do HTTPS requests, which we won't really get into here So I do want you one of the things I want you to keep in your mind, right? Especially when you read like popular news articles Oftentimes people conflate these terms, right? We just talk about the web when really they're talking about the internet or they talk about the internet when they're talking about the web and so that that comes up a lot and it makes sense in popular Popular culture because people use the web, right? I mean they don't really think that they're using all these other protocols on all these layers, right? They don't care. They're just using their web browser. They're firing up a web browser and going to places Okay But how do we put the web in the web? So the design originally was envisioned. It was a way to share research results and informations at CERN Which kind of when you think about it it's kind of crazy that it became this worldwide phenomenon that all every single one of our phones Computers everything is using, right? and at the time Sir Berners-Lee I don't know if he likes to be called He combined kind of some multiple different emerging technologies of hypertext the internet TCPIP and so The hypertext, right, is text. It's essentially the links that you think about on the web page, right? Or just like when you read a research paper Right, there's references in those research paper Those references tell you where to find more information or where that idea came from, right? So you can think of that as a link to some other piece of information Right, so this idea of hypertext was around and he kind of combined this with wow the internet is actually pretty big and I can I actually don't exactly know what you would do on the internet probably from 89 like use net and email and other things and So this idea grew into the universal access to a large universe of documents He said hey wouldn't it be great if anybody could put a document out there And at any place in that document we have a link to another document That could live on that machine or on a different machine and that machine itself that document could have other links That would be clicked on and follow and that document would have other links, right? So you have this interconnected web of information have all these documents In this universe and easily accessible to everyone so There's three central questions that the architecture of the web this really drives everything even The freaking crazy Gmail Google Maps all these fancy web applications now all these three design questions Influenced the whole design of this technology How do we name a resource right? So we're just talking about documents How do I name a document and how do I name a document such that my? CV PDF is different from your CV PDF, right? We just can't have the same name Once I have a name, how do I then request that resource and then how does that other machine know? How to serve me that resource and give me that resource and finally how do we create hypertext? So how do we actually represent these links to other documents? So these are the three key technologies of the web that answer these three questions Right, so how do we name resources on the web? URLs yeah, exactly so So technically I'm I'll be completely honest I don't know that I remember the ultra fine distinction between your eyes and URLs I believe that you are eyes are more general and they can be applied to different types of protocols and different types of resources Whereas you are L's are more specific to HG like HGP you are L's And then so we've already actually kind of done a little bit of a homework assignment on this So how do we request and reserve this serve a resource? What? What's the protocol? HTTP right hypertext transport protocol Right, and we can see how these are all related, right because really can you use HTTP to fetch something that is not hypertext? Yeah, I don't know the PDF documents. The PDF document doesn't necessarily have hypertext Or plain text file or an image a PNG file So at this point it's kind of a misnomer, but you can see the historical context We need some way to name things which is you are eyes URLs we need some way to fetch those things and then we need some way to Represent that hypertext document, so that's where the HTML comes in and so these actually form these three beautiful connections So in the URI right when you have a URI or a URL Right that tells you all the information you need in order to make an HTTP request Right, so you can look at any URI URL and you'll know exactly what HTTP request This is going to make if you want to fetch that resource, so the URI describes the resource and how to get it HTTP describes how to actually make that request and then when you make that request you get back an HTML document and What are the links on that HTML document map? Yeah, more URIs URLs right and those could be on that same server. They could be on other servers, right? So it's this cycle right this is when you think of when you're browsing the web This is exactly what you're doing right you're starting on one page Starting on one link you click that page you get a whole new page with new links You click one of those links you get a whole new page with new links, right your browser is continually doing this cycle So this is how these three technologies are all related to each other, so URLs can create HTTP requests HTTP requests typically result in HTML content. The HTML content gives you more URLs Okay, so now we're gonna look at each of these in turn, so the URI is As we said right it's essential metadata to describe How to reach and find the resource So it tries to answer the following questions which server has this resource that I want right who has it how do I ask for it and Then how can the server locate that resource? Right, so this needs to have enough information so that I know okay if I want to fetch So on the HTML page on your server I need to know how to talk to your server I need to know what purpose all talk to your server and I need to know that there has to be enough information for the server to Locate what I'm talking about So RFC 3986 has the latest as of January 2005 definition of what exactly the URI it is And we'll see that it's incredibly general so this should be very familiar with what you're What you've been looking at with URLs right, so the syntax here is We have a scheme We have a colon we have an authority. We have a slash. We have a path Followed by a question mark all about it quick my query and a hash followed by a fragment So is this look kind of familiar? Yes Doesn't describe all the URLs you've seen No Why no Yes, yeah, so there's stuff without question marks, right there's stuff that have no query no fragment, right? So, yeah, so some of these fields could be optional right and so So okay, so the scheme Right, so this is what makes you are a general so what's the scheme in normal HTTP URLs that you're Oh Right, so that tells the browser. Hey, this is how you fetch this resource is over HTTP Right. Have you seen other URIs that use a similar or that use a different scheme that aren't HTTP STP right you could send somebody an FTP URI right well HTTPS right it could be HTTPS and else Was that Yeah, I think there's an LDAP Is definitely a scheme any of the reports are saying our saying yeah, I think our sync uses this URI syntax as well Go for that's a really anybody actually use go for It was basically the Was it a precursor competitor to the web kind of I don't know if it came first I think it maybe did a little bit Mmm, okay, and it was like select one to go here select to go here, and that's how you browse the web Interesting so it's actually I wasn't gonna talk about it since we brought it up. There is So if you have a web application that will fetch urls as you give it Right, so like bit.ly or whatever right will go out and maybe fetch that URL or like Facebook will go fetch a URL to make sure There's no viruses or whatever if the code is not written correctly you can change this scheme to be a go for scheme you can actually Control a lot of what that server will send so you can actually use These schemes by these weird schemes to get the machine to scan other parts of the network like it's an internal network and give you the results Yeah, so it's I guess that's the only reason I know about go for I mean besides for an historical context Okay, the authority right So the authority is the entity that Controls how to interpret the rest of this right so basically this is where it's usually the server name So this is the server that this resource lives at right so it could be google.com HTTP colon slash slash google.com. It could be and the syntax here You can do a username at post colon port So this is why you can do google.com colon Whatever a different port to try to go to report number This is how you can try to access different ports of the default HTTP 80, but the important thing here is that What this path query and fragment means to you the user you don't care, right? You just know that this defines some resource and It's up to this authority this server to understand based on this URI what resource you were talking about So in the path it is usually a path name Separated by slashes right just like the Unix system, right? The query is used to pass data. So non hierarchical means not like the path, right? So this is Usually key value pairs HTTPS, but it doesn't have to be And what is this fragment so maybe seen fragment stuff What is it for what have you seen it what context have you seen it in? I think that gets your fragments. Yes, completely different though. This is in URIs Yeah, so it actually has nothing to do with the server at all, right? So this is usually identified a subsection or a sub resource of this resource, right? So you ask for the server for everything up to the fragment and then when your client gets that back It decides where to go or what part of that document you meant by the fragment So this is when I send you a link with a fragment in it Your browser will usually take you Directly to that element that has that specific ID. So that's the HPV standard Okay, so some examples so we can have something like food colon slash slash example comm colon 8042 slash over slash there question mark testing with bar And hash nose Right, so which would be the scheme authority path query fragment of this what's the scheme? who the authority Example comm yeah colon 8042 right the important is part of that exactly so the path would be over there and the Query would be test equals bar and on the fragment would be nose So we have an FTP. So this is an FTP URI right same thing Also, you've seen mail to links, right? So this is a scheme mail to and the authority is a host name at asu.edu All right, and I can have an HTTPS colon slash slash example comm Right, so kind of is this about URI the colon one dot HTML. So what's the problem here? Yeah, so is the problem is how to parse this right does this mean that I'm talking about is this whole thing the authority up to this slash Right is this the host example comm slash test slash example colon one is then the port and Then slash Adam is the path and then even if we did that right Where does the path end and the query begin here? Yeah, does it begin at the question mark? So everything after the question mark is a query, but I have a slash here So maybe that's part of the path Maybe my path is slash test slash example colon one dot HTML question mark slash Adam Maybe this whole thing is the path Right every sale. There's multiple ways to interpret this. So we have a problem So this leads us to the reserved characters So these are the whole set of characters that you can't have in a URI And so What do we do just never use these in our URIs Yeah, so we didn't code them somehow right we'd have some way to tell the server hey I meant a Colon character in the path not colon as a port right or I meant slash as part of a query parameter Not slash as part of the path Right, so that's what we get to URIs one of the big issues here is percent in coding So anything that's not alphan americ a digit a Dash dot underscore or tilde you have to present percent in code and Percent encoding is very simple. I mean so it's it's pretty straightforward. So you have a percent sign Followed by the hexadecimal reference representation of that fight So slash some of you have seen from the binaries right the hex asky value is 2f And I only know that I also spend time looking at shellcode and that kind of stuff right so The URI encoding of the slash would be percent 2f Cool. So this means amber Sam gets transformed into percent 2 6 the percent sign How do we go back? The assy value of the sense I was it Yeah, maybe percent 25 right so that's how we represent an actual percent because why is the percent character special? Yeah, because it's used to start the URI URI encoding right so we have to actually encode that a space gets encoded as percent 20 and So on and so forth. So now we can fix this example Right, we can say example comm slash test slash Example colon one dot html and then dollar a question mark percent 2f add up Right. So now I know that this URI is going to be parsed correctly And I know exactly how to parse the path the query and everything from this URI That's that's Sweet. Okay. So URI so we've probably seen Right. We've seen URLs. We've seen some on a page Right, so they can either be absolute where they say hey, this is exactly the resource. I'm talking about use HTTPS Talk to example comm fetch and pass this path parameter Or it can specify a location relative to the current resource So it can say slash slash example comm slash example slash demo about html So this is going to be relative to the current network path. So whatever the current scheme is That's what that slash slash means. So whatever we're never you see this URI this link. It knows Reuse the current scheme. So if it's HTTP, it'll be HTTP colon slash example comm if it's HTTPS It'll be HTTPS example comm Same thing for like slash text slash HTML health. This will be relative to the current authority So reuse the authority Right dot dot slash dot slash people dot HTML. So it's just gonna be relative to Yeah, so relative to the current authority and pack, right? So this is gonna move us up, right? So What did we learn about that slash? Yeah Right, so this is part of these things whenever you see things like this that remind you of vulnerabilities We talked about it's probably also a problem here In this case context is important so it depends on What context we actually are in so what page are we on when we see one of these app relative URLs? But the important thing is your browser or whatever user agent you're using has to be able to take these relative URIs And turn them into something absolute Right because it needs to know where to go to fetch that new resource, right questions on URIs Sweet. Hopefully stuff you've already seen before sent you Using use the web a lot Cool, okay, so HTTP is that the layer that talks about how a web client can try to request a resource from our web server and It's based on TCP Doesn't have to be I guess not but it is So the default is TCP port 80 Version 1.0 is defined by an RFC in 1996 version 1.1 got updated in 1999 And version 2.0 right so people heard of HTTP 2.0 So I believe it's based on SPVY which was a protocol to help my Google to do a Whole lot of additional improvements to HTTP But it's I believe it's still under discussion It hasn't actually been finalized the HTTP 2.0 spec. Does anybody know how's it is that incorrect information? Be refuted by anybody with the phone, okay so HTTP Right the clients and we have servers so the server right as We saw we've written a little HTTP web server, right? So the server listens for incoming TCP connections on whatever port the client opens a TCP connection to the server and Then sends the request to the server through that TCP connection. Finally the server reads that request Figures out what resource the client wants and then sends a response containing that resource right, so So actually thinking about all the things we talked about till now you kind of should have a very good understanding of every single one of these steps Right so from listening to TCP connection from this opening of TCP connections You know exactly what packets the client's gonna send you even have an understanding of how those packets make it from one host To the other of traversing the local network and then how the hops go in IP, right? So this is powerful stuff, so you're learning exactly how everything works Okay, so we have a client who's running some web browser and we have some server, right? So the server makes an HTTP requests gets an HTTP response That's how we can think about things abstractly right, so we just think about okay, there's one client one server Make a request get a response. That's the bare bones HTTP In reality things are often more complicated, right, so the There may be a firewall in between the client and the server so ASU actually has not just a firewall but a intrusion prevention system that looks for traffic will drop traffic if it doesn't like it You could be talking to not an actual server But a proxy that actually will forward that connection back to the server So this could be for load balancing purposes It could be because the server lives somewhere else that you have no idea where it lives That proxy could have a cache, right? So we can store and save the data from the server so that way it's reducing bandwidth and load on the server The client also has a cache so sometimes when you request things it doesn't actually fetch So this is why if you've ever had to let me tell you to hard refresh like control R a page Forces your browser to not use the cache and to request the resources So what happens is your client usually goes to the firewall which goes to a proxy Which goes to a server and then generates that request finally gets sent back from the server to the proxy to the firewall back to you There's a lot of moving parts. So this is part of the reason why hd wide web applications are Interesting is they are very complicated. There's a lot of moving parts in here So you can actually have problems at kind of any place along here So for a request, right? We've seen a request consist of a method. So as we're getting to the get in the post The resource which is derived from the URI. So what resource are they trying to request? The protocol version. So why is the protocol version important? compatibility, what's that? Yeah, so that way we know what protocol we're talking, right? So I'm trying to talk to you at HTTP 2.0, but the server only supports to 1.0 Right, we should detect that by Seeing what protocol version we're using right that way I can tell you hey actually I don't support HTTP 1.1 I only support HTTP 1.0. We also have information about the client So this isn't strictly necessary, but this happens very frequently, right? So this is the user agent header that our client sends to tell the server Hey, this is kind of like this is the software that's accessing you And often and occasionally a body so on post requests, we'll see that the Post request gets encoded into the body that the client would send Okay, so the syntax for a request we have the start line followed by headers So any number of headers followed by a new line followed by the body So each line is separated by CRLF. Hopefully you learn that in the homework project, right? CRLF is very important. New line is not quite the same. It will mess up some things So headers are separated from the body by an empty line So you always have a start and then you keep trying to parse headers So every time you see a line you parse it as a header until you see a new line a line of just CRLF Then you know you're done with the headers and you know that everything follows as the body so For specifying the method so this is the method so This kind of does get into rest although the rest is a lot later, but the idea is HTTP is general enough to allow Different actions to be taken on a resource right So common methods include get so we just want to get give me whatever entity is referred to by this URI right give it to me So one of the important things in here so the server make any changes to that resource based on this request Does this affect the state of the server in any way? No, right? It should be just a get just give me that resource. Don't do anything else. Don't change the state of your server Just give me that resource Whereas post basically says hey, I'm gonna send you some data in my body and You're gonna figure out what to do with that in relation to this specific resource I'm talking about Right, so this specifically says hey make some changes or do something right what that something is is application dependent But it means the post means do something put is actually a Historical thing that's been used to say hey replace that resource with this content that I'm sending you in the body so You can actually so Maybe see a little bit of the historical evolution here In Tim Berners-Lee original idea, right? It's kind of like a Wikipedia style thing where like people could just You could change you wouldn't need to use a web server You would just have a server and then you could use your browser to edit that page Right, so you could get that page make changes and then put that those changes back They would be reflected on the server and actually that was how that first one browser was actually built and crammed was because He was was actually like that so you could not only it was not only a browser. It was also an editor as well But nowadays right we kind of realize hey giving everyone in the entire world access to be able to edit our resources It's probably not a great idea Right, so that's why there's a whole bunch of access control things that have to happen here to make sure you can actually do this Head is a method that is used. It's identical to a get except that you're not supposed to return a body So why would this be useful? Yeah, so that's a good one right so To see if the copy has been updated, right? Maybe there's additional header information that tells you when a last change That's a good one. What else? Some metadata why did Why did IP include like ICMP messages like pain Yeah, so debugging purposes right so that so this is kind of where head came about Originally, let's just say okay. Just give me that header So maybe I need to check if things exist that don't exist. I can do some sanity checking I can use this as a debugging tool to make sure that those firewalls or proxies along the way are not messing with anything Right any of my headers? So yeah all these reasons Okay, there's also a lot more methods. There's options method which Is By most web servers There's delete so just like we can get things post things put things We want to be able to delete things from our server. Oh Trace right Yes trace is really interesting. So this is another debugging method which Asks the server send me in the body everything that I sent you So it's kind of like a pain But the response you get is everything that you sent so this allows you also to debug Hey, I want to see what firewall proxies are changing things from the way to me to you Just from the client you can't debug that right? You can't see what the server so this option allows you to do that Connect is an option. So if you know you're using a proxy connect will Actually tell the proxy. Hey, I want to connect to this URI so that way if your browser is proxy aware we'll be able to do this and The dot-dot-dot here is not just because there are more that I didn't want to list although for sure there are It's actually that a web server can define arbitrary methods arbitrary extension methods So these are defined in the spec to be an HTTP server. You must support these things But you're free to extend this and do what you want Okay, so let's look at an example request So here we have on the first line. This is the status line Right and then we have a series of headers and then we have an empty body so on the status line we have Again, so you say that okay this the method is yet the resource that it's looking for is slash The protocol is HTTP 1.1 and then we have each of our headers So this header so the order of the headers to the order of matter does the order matter now So the or the headers can be in any order So we say this came from curl. I'm trying to access Google.com and Accept is a header that tells the server. Hey, these are the file types that I will support Right, so that you're actually doing some negotiation between the client and the server Oh, sorry, not file types. It's the content encoding So this would be if we support gzip encoding or any kind of other encoding So why do we need to specify the host here doesn't the server know who we're talking to right? We clicked on a link for Google.com. We resolved Google.com to an IP address We made a request to that IP address on this specific port. We're telling them we want slash So why do we just send a header that tells who we're trying to talk to? A server city So what would that mean from that description I guess that? The Right exactly so the IP address right so we can have multiple different authorities or domain names, right? I all have the same server that IP address that's hosting it. I would we want that though Should they all be unique? I mean Yeah, but we could give each of those share your virtual hopes their own IP address, right?  Virtual posts weren't quite as common great exactly. Yes Right, so it goes back to this problem. How many IP addresses are there in IPv4 To the 32 theoretically right and then once you start locking off the local addresses all that kind of stuff And you have class and then you consider the fact that they gave out allocations To various companies organizations, right? So a lot of company not a lot, but some companies have a whole slash eight IP range so they have a lot of IP addresses that they're not using right now We've technically run out of IPv4 addresses or we're very close to running out Right, so now if you wanted every single domain name had to have a different IP address Right, that's a problem But this host header was actually added in HTTP 1.0 or 1.1. Sorry HTTP 1.0 did not have a host header Which is why you had to create different posts different IP addresses for every web server They didn't even make sense there you couldn't do virtual hosting because you needed something like this Or maybe you do something really weird where you put it in the URL itself, but then it's not really virtual host So this was the so the web originally didn't have this the protocols evolve when people realized Hey, it would be a good idea so that we could support all of these things So now modern requests look much more like this So we actually still have the same features that we're used to we have the status line We have a host we have accepting coding this sense I can accept requests in deflate or gzip. We have an accept Header that says hey, I'll all accept text HTML application whatever whatever all this stuff This queue means that this is their preference for what they would like to have so you can the preferences are supposed to be in This order, and I believe they're gonna tie or something it will Try to take the one that has the higher How about the queue stands for QoS My head the user agent that specifies the exact Model and version number of Chrome that made this request Right.  I have constantly like 20 30 tabs open. I think sometimes you guys can see my browser So you're sending all this information and the IP address that you're coming from to every one of those servers So these are how we do requests. How do we do responses? Right So response once again has the protocol version right to make sure we're talking the same protocol. It has a status code right if we've seen 200 404 Right, there's a whole bunch of different status codes. There's a short reason that describes that status code and then similar thing with headers a new line and then body So the syntax we have a status line headers body each line is separated by CRLF headers are separated by a body with an empty line and It's almost the same overall structure as the request. The big difference is the status line. So let's look so okay So the status codes Right, so they're grouped into classes. So there's the 100 classes responses Which are actually very interesting. So these are just a Way to tell the client. Hey, I got your request, but I'm still processing it right, so this is a response, but it's not exactly a response to That was crazy I dropped with one hand and tried to catch it All right, I'm awake So 200 so these are maybe the response code that hopefully we're more used to because this is what we Are normal this is when everything's going good So the whole 200 class are all successful that we received the request We understood the request to be accepted the requests 300 level response codes are interesting. They're telling the client. Hey, I got your request But that resource that you wanted is somewhere else Right, so it's kind of like the original Mario right that princess they're looking for is in another castle So you have to go somewhere else as a pointer to say yes I understood your request But really you could go look here for that resource that you wanted and here it could be again a URI So it could be on that machine or a completely different machine 400 said means you made a mistake. So I didn't understand your request Right, so that's where 404 comes from. It means you tried to request something that doesn't exist 500 means I made a mistake Right, the server says a something broke Right, I don't know what happened, but something the problem. So it wasn't your fault. It's my fault So probably try again later So 200 response code 200 it's okay There's also 201 202 204 response code the 300 response codes are interesting 301 means moved permanently so this server can the client can actually store Whenever it tries to get this resource it can always go somewhere else. So it just tells the client you can store that in its cache 307 is a temporary redirect Which means hey, go get the resource over here, but next time you want this thing contact me So other ones 400 for a bad request 401 if you're unauthorized, so maybe you've seen this if you try to access a page and weren't locked in 403 means you're forbidden 404 is not found 500 means that there's internal server error. This is kind of the general when we've seen the problem and 501 to 5253 these are all different types of errors. So let's look at a request. So So now we have our example here of this get slash html 1.1 Use rated curl. So this is what we just saw So now let's look at the response. So the response that Google sends us is actually this huge response Right, but if we break it down at the top We have the status line and the very first thing on that status line tells us the protocol So this says this is an HTTP 1.1 response The response code is 200. This means everything was good and that short little status code from Google From Google tells us that everything is okay, which calms us and makes us Okay so some other things so This header the expires header. I believe and this cash control header What is expires of negative one means does that mean it Never expires are always expired. It's one of the two cash control private max age zero. So what would this do the cash? This is this thing that So how would you find this out if you wanted to understand more about this header the RFC? Yeah, I'm searching for man page the RFC is close I don't think the man page will tell you much the RFC will definitely tell you what this means and And So yeah, I don't know a hundred percent exact But it's basically telling the caches along the way as we saw right the proxy the browser cash Who can cash it and how long they can catch things for if they can? We have the content type so this tells our browser how to interpret the response Right HTTP hypertext transport protocol. So this says hey what I'm sending you is text HTML sorry Yeah, text HTML and it even tells us the character set in coding of our response, right? So that our browser can properly interpret that And so this is so this is the body. So there's a bunch of other things in here. There's some cross-eyed surfing prevention stuff some frame click jacking stuff and Then finally the body with the HTML of the page So another thing interesting thing that we're looking at really quickly is that HTTP has an authentication mechanism built-in So it's based off of this challenge response scheme so the basic idea is If you request some resource the server responds with a 401 that says hey you're on off of on unauthorized and it tells you as part of the header the schema that it wants you to use and The idea is you need to be able to so this is on the server then pops up that window That says hey filling your username and password and then you fill it in it sets this authorization header So when you get the reply, there's gonna be a header in a 401 message that says www-authenticate basic authentication for this realm of reserve docs Then the client retries the access including In the header a field containing a cookie composed of base 64 encoded username and password So how secure is base 64 encoding? What is base 64 encoding? Right so it represents it in the form I actually can't remember the entire character set but yes, it represents it in characters. Is it a cryptographic? encryption or hash or anything No, you can take this string and you can go back and figure out exactly what that password is Right, so you can crack this username password exactly from this and if you're using HTTP Right, what do we know about the data sent over a TCP connection? Clear text right now HTTP isn't doing anything. I mean TCP isn't performing any encryption or anything HTTP We're talking about it, but it's just using regular TCP. It's not encrypting anything So anybody on that path right can anybody on your router or on your open wireless network? Can see that packet that you send with this data in here and can immediately crack it just it's not crack It's decode your username password from there So it's kind of funny that HTTP often authentication is quote-quote built into HTTP But a it's terrible and be it provides a really bad user experience because if you know that pop up So HTTP 1 1 has a little bit better authentication scheme So you actually uses some cartography where we get a nonce We basically hash the username password the nonce value the HTTP method in the quest of URL But the problem here is the server has to have access to your plain text username and passwords right, which is Not always great, so okay. I want to finish up here So you can actually use most of all the techniques and tools that we talked about in Internet Insecurity to talk to analyze and look at your HTTP traffic You can use TCP dump to look at the traffic that's going on your system. You can use wire shark to do the same thing We use sniffers to collect traffic right so we can use sniffers on the network to collect collect all the port 80 there we Can configure servers to create logs I honestly when I'm doing web security stuff nine times eight times out of ten. I just use a straight browser Like I know a lot of browsers especially now with all of the developer tools that are built into them Have a lot of the information that you need so really most of what you need is a browser Proxies are really great to be able to analyze the traffic without having to modify anything So this is another technique that I use so client-side proxies are also really effective means of Intercepting and understanding what's going on So Firefox has extensions like live HTTP headers tampered data If you just open Chrome or Firefox and you open the developer tools and make a request You can see all the headers that were sent and all the headers that were received The one tool I will mention her proxy. It's a professional grade tool So it's it's a commercial tool. I think cost about $300 for a license, but it has a free Version that has just some modules disabled, but even the free version is super easy awesome Really cool to use You set up the per proxy you set up your browser to use per proxy And then it will pause and let you inspect every request your browser makes and every response that comes back It keeps track of all the requests and responses and then you can say, okay I want to make this request again, but manually change one of these values And so you can easily see exactly what's going on there So if you're interested in web security stuff, I highly recommend checking out her proxy. Well, and then we'll stop here We come back. Let's talk about HTML


We have a new event that just dropped, and a ton of packs to be opened. Yo, what's going on Leaf Nation? It's Leaf for back again, and welcome back to the channel. Today we are back again with another pack opening. We got a pretty good event, and some pretty good packs to open. So we got the Master of the event, Master has been a Jad, Wa, Ekman Larson. Anyways, those are your four masters. You can pull that Kessel, Ben, Edler. We got Jiru, Flurry, Tavares, Crosby, some pretty good cards out, Popvin, Jesper Bratt. We got a Mitch Marner at defense, Brett Burns at forward. That's pretty cool. Prime times, we got Dryset, O'Connor, Barzell, Patterson, Horvath, Montour. Team of the Week is pretty cool, actually. We got 89 Lidsstrom, 88 Yizerman, 87 Shanahan. Some pretty good cards in the Team of the Week. Decent Junior Performers, Big Shooters. We got 89 Matthews, which we need to get. I need them right now, so I better pull them. And that's about it. So we got some big boy packs to be opened. A couple Elite packs, a couple Premium Players packs, a Jumbo Elite pack, and then obviously an Ultimate Choice pack. We are nervous for that. So we're going to start off with the Mini pack. Get the Trash packs out of the way, save the best ones for last. Simple, simple. Give me something. I'm skipping this one. We all know there's going to be nothing in this one. That's cool. Players pack 180 overall. Here comes the 89 Matthews. I can't wait to see that purple. All right, James Reimer. Crab stuff. Crab stuff? I don't know. I'm so bad at pronouncing names. Gustav Nyquist, Akposo. And that's it. Don't know. These packs are the greatest, but I think I pulled Crosby out of these packs last week. I can't remember. I'm pretty sure Jacob Truba could branch in. An alumni will take them.  Anthony Manta. All right, nothing good so far on to the next. On to the next. Give me something. All right, here we go. Let me see some purple. Brady Kachuk, not a bad pull. Not the greatest though. Colin Miller. Ross Colton. Casey DeSmith. And that's it. These packs weren't as good as last week. That's for sure. No Crosby in these ones. A lead pack. Let's do the Entradables first. 580 plus overalls. Give me something good. Brayden Point. That's not bad. 83 overall might be used. Turnbull, sure. Shay Weber. Tori Krug. Eelers. Oh boy. Oh no. All righty then. I mean 83, that's our best pull right now. Two more of these elite packs to go. Four packs in total left. Dame Severson, Brandon Tanev. Jared Spursian. Devon Taze. A bunch of 81 overalls that we don't really care about. 750 coins, that's cool. Oh my god. Jacob Truba. All right. That's an interesting pack. This one's untradable, so if you want to give me something in the tradable packs. Touche, yay. Touche, Valorina Shuskin. All right. Anthony Duclair. Jordan Stahl. Justin Pogui. Stouplane Hockey. That's crazy. Charlie Coyle. Oh my goodness. Yep, all right. Yep, noted EA. Absolutely noted. Jumbo Elite Players Pack. 20 items, all gold players with at least 1880 plus overalls. Surely, surely there's something in this pack. I've pulled nothing up until this point. The purple's lying in this pack. Manji Apane. Not what I'm looking for. Gallagher. Newler. OK, my god. Noah Hannafin. Dude, please. I beg. I beg. I beg, dude. Oh my god. Just a bunch of 80. OK, 85 overall. Jiru, that's a new card. His milestone card. Dude, it's a good card, man. 80 and a speed, 89 Excel. Good shot. Good hand stat. Decent checking. That's a dub card. 85 overall, Claude Jiru. I'm going to see what he goes for because I'm trying to buy X Factor Matthews. But that's not bad. We'll take an 85 Jiru. Belt time. We were due for something big. Prime time, Paul Mary. Don't think he'll go for anything. Alrighty. And that's about it. No purples yet, but we will take that 85 Jiru any day of the week. Ultimate choice pack. It was bad for us last week. We've yet to pull a purple yet. So maybe they were saving the purples for this pack. Maybe, maybe that's what it is. First round's always bad. That's fine. Like first round, usually typically they're bad. It's fine. The second, third, fourth, and fifth round got to be better though. Maybe not the second. The third to fifth needs to be better though. My God, I wish I had some sort of luck in this game when it comes to pack luck. I feel like I've had decent luck this year. But right now it's not looking good. It is not looking good. This third round continues to be horrible. My God. OK, fourth round. The last two rounds are typically the best rounds. Maybe they were saving it to the last round here. 89 Matthews incoming. Oh my God. Last round. Surely there's a purple in this round. Kilmucar. First card. It's a Kilmucar. Oh my God. That is huge. That is actually huge. The best defenseman in this game. I think it's safe to say it's between him and Hedman. We pulled Kilmucar. All right. There's our purple. We love that. Another purple. Hilary Knight. Back to back purples. They were saving. Are we going 4 for 4 on purples? Hilary Knight. OK, no purple there. And no purple there. It's Steve of Stampkos, so all right. We'll take Stampkos. We'll take Knight. We'll take McCar. Two purples saved until the last. We'll take that. We'll take that. Anyways, guys, that's it for today's pack open. If you guys did enjoy it, be sure to drop a like on it. If you guys are new around here, make sure to subscribe button down below. We are on the road to 5,000 subscribers. Also, I am currently live on Twitch.tv right now, doing a 15-hour charity stream for November. If you guys want to join up, donate to Good Cause. Have a chance to win surprises. Make sure to join or hit the link down below. Anyways, guys, that's it for today's video. Thank you guys very much for watching. And I'll talk to you guys later. Poof.