Okay. Thank you. Hello, everyone. My name is Komuna Ibrahim. I'm a developer from Hizpah, Western South Africa. So this morning, we will show you our report, the Builder app, and we'll show you how it's worked and how we did it. Okay. So we will present you a little bit of the apps and after that you will jump to the demo. Okay. So what is the report with the app? Okay. Please, do you see my screen? Yes, I can see it. See the problem. Okay. Thank you. So the report with the app, it is an app that allows for generating a report based on aggregate or tracker data. So the user also have the ability to design their own form using a HTML editor. So that means if you want to have like a report in which you want to display some information, with this app, you can create this report and you can display the data from aggregates or data from tracker. Okay. So you have also the ability to create your own reports or make a HTML outside of the app and come and paste in the app and make the configuration. You can also customize the legend. So you can decide to display the result as image or as color or as label. So it is a legend. So you have also the possibility to send SMS to a person. And you can also print your report in PDF file. Okay. So I'll show you some example. Okay. So that is an example for tracker case. So this example is a student card. So you can see in this student card, we have the information of students. We have his name, his surname, date of birth, sex, and so on.  And you can also see we have the place where you can create, design your reports. Okay. So that is an example of a tracker data. So let us continue. This is also another report. And there you can see we have aggregates data there. And it is, the things there, we can see we have the image there. That is because rather than display the value, we have decided to display image. So the image is a legend. So as I already said, you can display image or color or label. Okay. You know with me, sometimes the image is more easy to understand. So if you show this report to another person, they can quickly understand what this report means. Okay. So that is the case of aggregate data. Okay. So there we have the legend part where you can contribute or create your legend and use the created legend to display in the report. So there you can see some example of the legend creation there. Okay. Okay. Let us continue. There also, it is where you will create your SMS template.  So there you can configure your message to send.  So the app will make an interpretation before sending the SMS to students. Okay. So that is a little bit a presentation. So we will go into the demo. Okay. So before the demo, I don't know if someone want to have the question. No questions are in yet. You can continue. Okay. Thank you. So let us see. Let me refresh the page. Okay. That is the interface of the reporter builder app. So you can see at the left side, you have some menu there. You have a report, the current menu. We have a design menu. There you will create your report. We have a legend menu. There you will create your legend. So I will show you how you can create it very soon. So we have also this menu, SMS config. There you will create your SMS template. Okay. So quickly, let us come back on the report and show you what I already said in the presentation. So there, if you are there, that means you already created your report. Please. Someone was unmuted. You can continue. Okay. Thank you. Okay.  If, yeah, you already created your report. So you just need to come there, select your report. For example, let us take a student card. Okay. You select your report like that. And now, first of all, you can see the report there. Now you will select the program. So you can see you have just one program. It's because when we are creating our report, it is just this program. We are used to configure the reports. So automatically, the app detects the available program in the report and display it to you there. Okay. If you have a more than one report, a more than one program in your report, the application will list these reports to you there. Okay. So you will select your program like that. And now the organization unit, there it is where the app will fetch a T. Okay. In our case, I will select Gambia. Okay. Like that. And okay. Now we will click on this bottom to search all T like that. Okay. We have a lot of T, but you can also filter the students. Let me close this. Okay. You have this option search by attribute. So if I select this, I can open like that. Okay. And I can select the attribute that if I select one, two, three, at the top, you can see you have the field there. And you can enter your texture in the field there. Okay. So in our case, I will search the students by just a surname. Let me remove these two attributes and keep just a surname. Okay. And let me search. Like that. I know you will click on this button. Okay. No, it is not the right. It is by first name. Excuse me. Okay. Okay. Ibrahim. Like that. Okay. Yeah. You have a one T and at the end of the table, you can see this bottom report. So you need to click on this button and they will populate our report for us. Okay. In the report, you can see the image of Ibrahim. His surname, his first name and so of sex, class, and so of. Even though he's a school name there. Okay. And there before this bottom, you can send SMS. Okay. If I click on this bottom, you can see no SMS template configured. That is why I, that's what I already said. You must create the SMS to send to these students. So the SMS or the app will use the attribute phone number to send SMS. Okay. So if you have the number in this attribute, so the app will send to this number. Okay. So let me show you quickly the SMS template. Let me duplicate this page like that. Okay. Okay. Okay. There. This menu, SMS config. There you can create your SMS template there. Okay. For example, you can see Halo. Okay. Or you can also write or customize your SMS outside of this application in HTML file. Okay. And you just need to come there and paste your HTML file there. So for example, let us write like that. Halo. I will create this spam quickly like that and put maybe send him, send him like that. Okay. So point that you design your template outside in a HTML file and you come and paste it like that. You will click like that. You see Halo, send him. If you click there, you will select the attributes. Okay. First the program. Let me take this. Okay. And now the attribute. We have first name or surname like that. And if you click add, so they will replace our value like that. So and when you are, you will send the SMS, the app will replace this attribute by the surname of our student and send it using this number, the full attribute number. Okay. That is the SMS part. So of course you must contribute first the gateway in your instance. Actually, we don't have a gateway configured so we can't send it. Okay. So let me show you quickly how you can design. Oh, let me continue first. Hello. Yeah. You will go on for a second. Okay. Sorry. So let me continue with the aggregate example. Okay. Let me duplicate this page again. Okay. So again, let me take this report. This report. So it is an aggregate case. Okay. In this report, you can see we have a lot of information there. So there you must select the period. But first you need the period type. So if you click, you will click on this thing. You can see we have a three type there daily, monthly and yearly. In our example, let me take yearly. Okay. Now you will select the period. For example, let me take 20, 20. Okay. 20, 21. Like this. Now you will select the organization you need. Okay. You will select it like that. And you see the organization you need three. Let me search I'll be on like this. Okay. I'll be on. And you need to click on a cable Now you will update the information like that. And you can see our report is filling. Okay. Okay. So there you can see we have image. So at the left, left side, you can see we have the value. But there in the table, we can see we have the image. And this is a different image. So each image have his owner's invocation. So I will also explain you very soon. Okay. So that is the aggregate case. Okay. And so now you can print the report by clicking on this button. Print the report. Okay. And it is a PDF file. If I could save and you can give the name and save it. Okay. Like this. Yeah. Of course. Okay. So let me also show you another report where in which we can have all case. So the legend a the color, the image and the label, because I always said in the presentation that's for the legend, we can have image. We can also have color and label. Let's me for example, let me take this report. Okay. This report. Okay. And let me take 2020, 2020, like this. Okay. For the arguments, let me take a come here. Like this. Okay. So what will happen there? So we have this, this place, it is, it must be a color. This must be image and this must be label. Okay. Let me generate the report. And you can see if you decided to display rather than image or value, the color, you will have it like this. If it is image, you will have it's like this. And if it is label, you will have it like this. So very soon, I will show you how you can create the legend. But for now, suppose that you already have a legend and what that is the results. Okay. And the update at the top, we have the dates there, the dates, the selected dates. If I select the, for example, 2019 and update. Okay. You can see the color has changed. And the period also. Now we have 2019. Okay. That is the example. Now we also have something. If I take 2020, 2021. Okay. And I update, you can see a normally displayed. We must have the image, but we have the value. And we have got this one. You try to display some image that has not been configured for the selected periods. So it is because in the legend, I didn't configure it. The image for this legend. So I will show you very soon. So let us quickly jump to the reports, how we can create our reports. And after that, you will come back on how you can create the legend. Okay. So to create the reports, again, let us duplicate this page again. Okay. So it's this menu, the design. Okay. We have the list of the report there. Okay. Let us, if you want to create a new report, you will, you need to create and you click, you need to click on this button, new reports like this. Okay. And there you can design your reports like this. So you can put the test name, maybe say name. And there you will select your value. So you can also, because rather than create your report using this builder, okay, you can create it outside of this app.  And automatically, this builder will interpret the HTML. Okay. So let me close this and show you already a report. So let me take this report you will see. Yeah. This report, for example. Okay. So we have this report. Okay. If you want to insert data, okay. For example, you want to insert data, you will suppose that you are creating your report. Oh, you already create your report outside and you can paste it there. Okay. You will select in the place. Okay. You will click on this button. So there, you will select all your elements that you want to use to populate your report. Okay. For example, let me select all. Okay. Like this. Okay. And you will close this pop-up. It is just to select the elements. Okay. Now, at the right side, you can see you have a lot of session there. And you can see you have data elements. There is some list there. We have indicator, some list there, data set also. Okay. Okay. So there, you must select now your, your element. Suppose that there at this place, I want to insert a data element. Okay. You must click on the place where you want to select, you want to insert the element. Okay. Now you will click on the element like this. Okay. Now we have a new pop-up there. Now they ask us to select the arguments. Okay. You will click on this field. Now you have some list there. We have first the current organization unit. Now we have something like parent 1, parent 2, parent 3, parent 4. So this is a dynamic. So first it generates it based on the available organization unit level. So that means if you have more than four organization unit level, they will generate using the number of organization unit level. Okay. So you must select your organization unit level. So for example, I will select this current organization unit. So what does this mean? Current organization unit level mean, no, it is not level. Please, excuse me. It is organization units. So that means if you select this, let me show you there. Okay. For example, okay. If you select like this, you see in this case we have selected Gambia. That is the current organization unit. The selected organization unit. It is the current organization unit. Now if you select parent 1, that means if we come back there, when you select your own unit there, the app will go up one time and take the organization unit. Suppose that I take Albion like that. Okay. This. Okay. The parent 1 means the app will go up and take Albion LBS admin. This. You see. Okay. Now the parent 2 mean the app will go up two times. Okay. First time and second time and take Banjul for us and solve parent 3, parent 4, until parent 4. Yeah. Okay. So that is the syndication of the parent and the current organization unit. Okay. Suppose that in our case you want to put a data for this tool for the selected organization unit. So in this case, we need to select the current organization unit like that. Okay. For a moment, let us keep this selected or this field. I will come back it soon. Now we have the way we want to display our result. So we have value and legend. If we take value, that means let me come back there. Okay. That means we will have the result like this. It is not a legend. It's just the pure value which is come from the result, our result. Okay. But if you take the legend, that means you will select your legend.  Okay. For example, let me, no, for example, let me take this. Okay. And really click on okay. Okay. You see, you have some label there. There's the elements and the organization unit. It is the code which is displayed there. Okay. So that is what we are done there in this report. So let me show you for a legend. Suppose that there you want to display a legend there. Okay. I select the place. We select the elements. We select parent one or parent two. Okay. Let me take parent two for example. Okay. Now there I will select a legend. Okay. I click on legend. And now you will select your created legend. Okay. Suppose that is this legend. Okay. Now we have a new field there. Choose the legend to display. Okay. If I click there, you can see we have color, we have label, we have image and the pie chart. So let us leave a pie chart. Okay. And just keep the tree first. Okay. We have color, label and image. So you will select one of them. Color, for example. And you will click on okay. Now you see the display. We have the elements. We have the organization units code there, parent two. And now the name of the legend. Now behind how it works, they write it in HTML attributes. Okay. So I will show you also it very soon. And that is the case of a pure value and a legend. That we have done in this report there. Okay. There we have selected the elements. You have selected the organization units. You have selected our legend. And now the legend type. There it is color. There it is image. You can see image. And there it is label. Okay. That is what a that is the result we have there. Now you have also the period. Let me show you for the period. Okay. Suppose that you want to insert period. Let me take just one case, one table. Like this. Okay. I click on, I click, I will select the place where I want to insert the period. Okay. Now let me close the section like this. Okay. We have this section. Other elements. If I open it, you can see we have organization unit level. Hey, sorry organization unit name and the dates. The name means the school name. And this is the selected dates. Okay. So what we have there, you have the selected date there. Now you just need to click in the place. You select the elements like this. Okay. The dates. That is what we have done there at this place. You just select the place and we select the elements and automatically if we come to generate a page, we select the needs element there and we click on the generate. You will have our period and other elements. Okay. You see. Okay. So let me show you now how you can create the legend. Okay. Okay. So let me duplicate again. Let me reflect this page and show you how you can create the legend. So quickly, it is a legend menu. Okay. You will need to click on this button, new legend like this. Okay. Now you must create like a legend sets. Okay. First, let me take like this. Okay. Let me select. So you might select the start and the end. The end is optional. So I will explain you why it is like that. Okay. Or what does it mean? Okay. So for example, let me take the 1st January 2022. 1st January 2022 like that. And the end, it is December. Of course, 2022 December 31 like this. Okay. We have the starts 1st January to December like this. Now you will save the legend set like this. Now you need to create the item. Quickly, you will click on this edit like this and you will generate the item. It is the same thing like the what we have in GHS 2. Okay. You will select the mean value and the max value for example 100. And you will select the interval for example 4. And you will click on the generate legend like this. We can see the generate as an item. Okay. And now you will edit each item like this. Okay. Now we have the name. Of course, you can change the name. Okay. Now we will select the image and the color. For example, I will select this quickly. Okay. Like this and this the color. Okay. After that, you just click on this. You see, we have the color and we have the image. It is the same thing for others. So let me show you existing legend and I will explain you very quickly. Okay. Let me take this legend, Abraham legend. Okay. Like this. Okay. Now there you can see we have just a start date. But we don't have the end date. That means, so if that means if we have the legend like this, so let me first explain this. You will understand more easily. Okay. The first the start date and the end date mean when we are there. Okay. We are there with the period. The app will take the legend corresponding to the selected period there. For example, in our case, I select 2020 to 2020. That means the app will come there. Okay. And take the legend, this legend set 2020. So the 2020 January, the first January of this year and the 31 December of this year. They will take this period set for us. If I open it, you can see that is the item. Okay. So you see the way how we got developed is because the app selects the appropriate legend for us. Okay. So 2020, we have this color. All right. And some information there. Okay. And there, let us take 2020. Okay. Okay. So no, it's not the right legend. Sorry, it's not the right legend. Okay. This 2021, for example, no, sorry. I am lost. Yeah. Let me refresh the page. Okay. Quickly. Okay. I select the report like this, the period. Okay. The organization units like this. Okay. Let me take this period. Yeah. This period. Okay. Now let me come back there. Okay. It is this legend. Okay. It is this legend. Yeah. Yeah. It is this. We can see you have this image. And if I come back there, okay. There we have this image there. If you can see, you have also the right color. You can see also the right color there. That means the app takes the latest legend 2019. You see, if I select another period, 2020, like this. Okay. The app will take this period for us 2020 and make a history using the item on present there. Okay. This period. You see, that's where we have there. You can see the image and the color. Okay. And the label. It is bad. If I come back, it is bad. Okay. That is the specification of this kind of period set. Now for the first, the first one which has not have the end dates. That means the app will consider from the start date until now. That means if I select, okay. For example, if I select 2020, 2023, okay. Like this. Okay. You can see in this legend or in this period set, we don't have 20, 23 legends, but we have our results there. It is because the app will consider this period until today. So that means if you don't have the end date, automatically the app will consider the start date until the current date. Okay. So quickly, let us go to, so the time also. Okay. So quickly, let us go to the data store. Okay. Quickly. Okay. So there it is the data store. I want to show you how we, we insert data in data store. Okay. Let me open. This is the data store key. Okay. There we have this key, the legends. We have some list there. We just have the name, the ID and the period there. But you can see we have a lot of key there. Legend underscore some ID there. Okay. Some ID there. Like this. So you can also see we have the image as base one card. If, when you, you are configurates your, your, your legend, the, the image is storage as base one card string in data store. And each key corresponding to each elements for the legend or for it for the reports, you see, you have also for report there. So you can see we have this prefix report underscore our legend underscore, you see. So each item is storage as a new key in the data store. And we have the list self there. So, and so if we come back in there, for example, in the design part, we just get the list from this key. This report, let me show you the report, this key, the report. We just have this list there, but the content, we get it's there. You see. Okay. So quickly let us, let me show you the tools you have used. Okay. So for the tools. Okay. So we have a user fetch and assures. So quickly, let me show you the source code. Okay. Okay. Second. There, for example, there. Okay. Let me open the first, this first function, do you see the screen? Maybe I cannot zoom it. Yeah, we can see it. That's indeed a little small. Yeah, that's perfect. Okay. Okay. So in our code, you use a assures and fetch for our request. Okay. If I'm going to this function, you can see, we have assures for the request. So that is just an example of our request. Okay. So you can see we have also this, we put our key in this file. Okay. We put our data store key there and also the app name there. And we use it in our function, this function. We use it like that. You see. So I want to also notify something in our code stretcher. You can see we didn't have a lot of code there, a lot of file there. And also if I take this file, app.js, we have a lot of code. It is because in the past, in the past, at this time, we, we were, we were need to, to deliver this app very quickly. And the delay also was very small. And also the idea it was, it was a simple idea. Okay. That is why we have begun with this way. That's why you have begun with this way. Now during the timer, the, the idea and the feature was growing and until now. So that's why we have a lot of code in one file. And you can see we didn't have a lot of file in the, in the project. So we plan to the next version to speak to the disk code to make it more light and more optimized. And also we can see we didn't use the, the access to data query. It is, as I always said, in the past, the idea was very basic, very simple. That's why we just take this way to develop the app. So we, of course, we have the link, our repository link. Okay. So I, I will show you the link. Okay. So let, let me go into the link. Let me copy the link. New tab. Okay. Like this. So there is our repository where, where you can, you can see the source code. Okay. So quickly, let me continue. Okay. Okay. So our UI component. So you are using some component of GH2. Okay. And also and design. So for and design, we are using it. Let me show you where we are using it quickly. If I'm come back there. Okay. This component, this organization, you need component three. So it is on design. And also for the legend part, you see the way where we, we are create this component, the period component, it is also also on design. It is because, so the access to, the access to have the period components, but it's not easy like for Ant. That is why we are using, we are using Ant for these components. Okay. So quickly, we have also used the red color. And you see how we are also insert the color. Okay. If I'm come back there, this, this, yeah, this color picture. So we have used the red color to build these components. Okay. So quickly, we are also use a day is just for our data formatting. Now our builder, it is a summer notes. So our builder, this builder, it is summer notes. Okay. And also our icon, we are use a red icon for our icon. So the time is very, okay. I think I done. If you have question, thank you.


So this is second breakfast, implicit and mutation based serialization vulnerabilities in .NET. I'm Jonathan Birch, I hack office for Microsoft. And if you wanna talk to me about this presentation, oh. I'm Jonathan Birch, I hack office for Microsoft. If you wanna talk to me about this presentation or anything else security related, please contact me on mastodon. In this talk, I'm gonna explain remote code execution vulnerabilities I found in several .NET NoSQL engines. I'll talk about what I'm calling a mutation based serialization vulnerability. I'll explain how you can bypass serialization binders and how you can defend against all of that. Also some bonus stuff just for DEF CON at the end. So a lot of my day job is doing security design reviews. I have a bunch of meetings every week where I'm looking at data flow diagrams telling people do it this way instead, that kind of thing. And something I do in those meetings anymore to sort of add value is I'll just open up the repo that I've never seen before and spend like a half hour while I'm talking to them figuring out what are the actual vulnerabilities here so I can talk to them about that too. And so the research that led to this talk happened because last fall I saw an article on a certain orange colored website about light DB and it's a .NET open source library for a NoSQL engine. I thought, okay, you know, I'll just go do a security review of their repo. And so when I did that, I saw this code and what jumps out to me in this code specifically is this line, this call to type get type that's being passed a string. And to me at least that's a really bad sign. But why is that a bad sign? So type get type in .NET is used to convert a string that's like the name of a .NET type into an actual type object. And what that means is that someone's going to be giving you the name of a type. Generally for an object you're going to create. So they're telling you what kinds of objects you're creating, which means they're telling you essentially what code you're going to run.  And so how does that show up in light DB? Well, light DB is a NoSQL engine and generally when an application is using it, it's just saying to light DB, store this object I've got and maybe at this index with these properties, that kind of thing. And what light DB is doing is it's going to put that in a file so it serializes it with a serializer called Beeson mapper into a Beeson stream and stores that Beeson stream in a file. And when the application wants the object back, it deserializes that Beeson back into an object again. So Beeson is just a binary encoding of JSON. So you can take that file light DB makes, decode it back into JSON. And if you do that, it looks about like this. And if you look at this JSON here, it's got this underscore type key in it. And after that it's got the name of an actual .NET type. So what light DB is doing with type get type is it's taking that type name, it's passing it to type get type to actually create the object during that deserialization. So the data in that Beeson is telling light DB what types it's going to make. And that means that this is just a polymorphic serializer behind the scenes. And that means it's got all of the classic vulnerabilities that polymorphic serializers have. But let's explain a little bit what I'm talking about there. So .NET serialization vulnerabilities. .NET serialization vulnerabilities generally happen because you have a polymorphic serializer. A serializer where the data is telling you what type it wants to be. So in this case we've got a box, it's some self-describing data. It says it's a cat, it's labeled cat. When your serializer sees that label, it says well I guess I'm making a cat object and it just makes a cat object and then sets some properties from the contents of that box. And the problem with this is someone malicious can come along and give you a box labeled pain. Your serializer says well I guess I'm making some pain then and you're having a bad time. So if you want a little more information in general on how .NET serialization works as far as for those sorts of serialization exploits, I suggest looking at the Friday the 13th Jason talks from Black Hat 17. But I'll also give you a few examples of what this pain is here. So in general what I'm talking about pain here, what I'm talking about is types that where if you tell an application to create them, they're gonna have side effects that can further exploit goals.  Here's a couple of classic ones. Assembly installer has a path property. When you set the path property, it just calls load library on whatever path you give it.  It turns out that if you give it an HTTP URL, it will actually go and request the file from that URL. It won't load it, but this is still really useful for getting pingbacks if you're attacking a server somewhere. Object data provider is sort of the more classic RCE gadget for a .NET serialization. It's got properties where if you set the properties on it, you can call any static method on any type in .NET with whatever string and integer parameters you want. So people usually call process.start just to pivot the shell injection. Okay, so that's how .NET serialization vulnerabilities work. Now I'll go back to LightDB and explain what I'm calling implicit serialization vulnerabilities. So here's a remote code execution exploit for LightDB. If you look at this JSON blob here, this is going to be the JSON we're going to put into LightDB. It's got that underscore type key where it's telling you what type it wants to be. It's going to be an object data provider. That's that gadget that lets you call any static method you want. We're going to call process.start and launch calc. And all we're going to do with this JSON is convert it to Beeson and then pass it into Beeson mapper to deserialize it. It's worth noting that when you call the Beeson mapper's deserialized method, you tell it what type you expect and it does not matter. So LightDB will actually respect the type the data says it wants to be. It'll go make it, it'll set its properties. Your serialization exploit gadget will run. It will then try to do a cast that will fail and probably throw an exception, but it doesn't matter. Your code is already run. So going back to how LightDB works. If you remember, LightDB uses Beeson mapper to read its own storage. So the problem here is that anything that can put malicious data in the database file can achieve RCE. It's also worth noting that when a client's using LightDB, they don't know they're using a serializer probably. They're almost never going to call Beeson mapper directly. So this is an implicit serialization vulnerability. The client is vulnerable to the serialization that's in LightDB, even though they're not using the serializer, LightDB is. And this makes that client vulnerable in a lot of ways. First of all, LightDB, when it stores the database file, it just stores a local file. So a lot of applications use LightDB just to write document formats or save files for games. So if you provide someone a document or a file that they're reading with LightDB, you can put an RCE payload in there and it will run code when they open it. LightDB is a NoSQL engine. It also has queries, which means you can achieve query injection and then you can put a malicious record in the database and when someone reads that record, you've got RCE. And there's one extra special exploit technique I figured out for this that I'll come back to. So what do you do when you find a remote code execution vulnerability in a major open source library? Well, you look at all the other libraries that are like it and find the same vulnerability there. So here is essentially the same vulnerability in MongoDB. So here is a JSON payload. It's got this underscore T key, that's the type specifier Mongo uses, that's T. Way the data says what type it wants to be. We're again making an object data provider. We're going to, again, call process.start and launch calc. And again, all we're going to do with this is convert it into Beeson and then deserialize it with the Beeson serializer that MongoDB uses. Now it's worth noting that you also tell the Beeson serializer what type you expect and that does matter. So in MongoDB, it will actually check that the type, the data says it wants to be, is assignable to the type it's expecting to get before it creates it. So if you want to exploit MongoDB, you have to find something in the data structure the application's expecting that's open-ended. So you can fit a serialization gadget into it. That said, it's almost always there. When I've looked at applications that use databases, there's almost always either an interface member on something or just a member of type object that's like a catch-all. And so you just put your serialization gadget in that slot and you still have RCE. Because MongoDB again uses this Beeson serializer to read its own database, it means that anything that puts malicious data in the database gets your remote code execution. MongoDB uses a client server kind of architecture most of the time. So you can have one malicious client that talks to the database, puts a bad record in there. Some other client reads that you're running code on that other client. You can also do, again, query injection. I will say that I was only able to exploit the .NET driver for MongoDB, not Java or Python. I won't say you can't, just that I couldn't figure out how to do it. And then we're gonna move on to yet another remote code execution vulnerability for yet another NoSQL engine. This one is RavenDB. So once again, we've got a JSON payload. This one, the type it says it wants to be is a Windows identity. Windows identity is a JSON .NET RCE serialization gadget. I suggest looking at Wiso Serial for details of how it works. But essentially it lets you pivot to a binary formatter payload which you then use to get RCE. And in this case, what we're gonna do with this payload is we're just going to actually make a connection to the database server and then do a port request to stick the JSON in the database. So RavenDB lets you interact with the database in two ways. You can read or write JSON to it or you can read or write objects from it. And so what you can do is if you put malicious JSON in the database and it's read as an object, that gets you RCE. Now it's worth noting here again that the type that's being expected matters. There's an assignability check like there was in MongoDB. And so you have to actually have some way to fit your payload into the expected types. This again is an implicit serialization vulnerability because RavenDB is using JSON.net with unsafe settings to read its own storage. So anything that puts bad data in the database gets you RCE. And that special attack pattern that I mentioned for LightDB works here also. And I looked at some things that were no SQL but not strictly databases. So here is a remote code execution vulnerability for service.redis. Service.redis is sort of a no SQL wrapper for a Redis cache. So here we've got some JSON. It says what type it wants to be. In this case it's saying it's going to be an assembly installer. That's the one that lets you call load library on an arbitrary path. We're just gonna say I dropped a malicious DLL somewhere for it to read. And then what we're gonna do with this JSON is we're going to stick it in the Redis cache and then read it back. So when we stick the JSON in the Redis cache as JSON, it's just JSON but when we read it back as an object using service.redis it's going to turn into whatever object we say it wants to be and it can run code. Now again, the type matters. So when you're using service.redis you tell it what type you're expecting and the payload you're using has to fit into the object graph you're going to have there. This is again an implicit serialization vulnerability. So because service.redis is using unsafe serializer to read the Redis cache, anything that lets you put bad data in the Redis cache also gets you RCE. And that extra pattern I keep talking about works here also and now I'm gonna tell you a little bit about how I discovered it. And that's because I was looking at one other NoSQL engine in .NET and that's MartinDB. So MartinDB like RavenDB uses JSON.NET with unsafe settings to read its own storage. But unlike RavenDB, it doesn't just let you write JSON. You can only read and write objects from the database. And when I tried to write an object to MartinDB that was just like a serialization exploit gadget would choke on it every time I tried. So I played with that a lot and I found a completely different way to attack it. And that's what I'm calling a serialization mutation attack. So here's a remote code execution payload for MartinDB. This one's a little bit different. So what I'm gonna do here is I'm gonna make in .NET a dictionary of string string. This could be a hash table too, but you need something that's got key value pairs mapping a string to a string. And what I'm gonna put in that dictionary is first a dollar type key paired with the name of a .NET type. In this case, workflow designer, which is another JSON.NET serialization gadget, it lets you do an arbitrary XAML read. Again, look at why so serial for details about how it works. And then I'm gonna do one other thing where I'm gonna set another key value pair where this is the name of a property on workflow designer, which is the one you set the XAML with to get an arbitrary XAML parse out of it. And what I'm gonna do with that is I'm just going to write it to the database. So if you write this object to the database and then read it back, that will run code, it will launch calc. And that's kind of weird. We're writing a dictionary to the database, but when you read it back, it runs calc. Why does that work? So this is using JSON.NET as its serializer. So let's look at how this works in JSON.NET. So in JSON.NET, if you serialize one of these dictionary string strings, like say you have a dictionary where you've got a key name fruit and the value pair, it uses the key names exactly as you provide them. So your key as fruit is just going to go into the serialized JSON as the key named fruit. Now, if you compare that to what an RCE payload looks like for JSON.NET, here's an example of one. You've got that type specifier key, that dollar type, and then you've got a .NET type name as a value for it and so on. And the key trick with this is there's nothing special about that dollar type key. There's nothing special about the type specifier used really in any of the serializers I've talked about. So you can make a key for a string string dictionary named dollar type and it turns out that if you serialize one of those string string dictionaries in JSON.NET or most of the other serializers I've talked about, it just uses the key directly. It doesn't filter it out even though it matches its type specifier. So what happens there is that you're essentially colliding with the syntax of what that RCE payload looked like. You're making it just output data where it's going to be the type specifier so when this object gets serialized and then deserialized, it mutates into a different type entirely and you can choose whatever type you want. And this doesn't just work for dictionary, it works for hash table, j object, expando object, and like 50 others, just go look around the .NET for things that have key value structures. And because of this mutation attack, you can do a lot of attacks on serialization that usually weren't considered possible. So say you have a website that takes some key value data and this is a screenshot from a certain website you might recognize that did not have this vulnerability but does let you enter key value data where you can choose both the keys and the values and you send that to a web front end with a form post and on the web front end, they're going to make like a dictionary or a hash table with the data you sent them and later on say that dictionary or hash table gets serialized to like a database or a cache and then later on after that, it gets read back from that database or cache using an unsafe serializer. Well, in that case, you can provide key value data where you're using that type specifier as the key name and when it gets read from that cache on some backend server, you can make it so it mutates into whatever object you want. It's now your serialization exploit gadget. It's now that pain and you've got remote code execution whenever that happens. So I was saying that was that extra attack pattern against all of these no SQL engines. Here's how that works against light DB. So light DB, you can make a dictionary string string. You put your payload in there. So you've got that underscore type key specified with a type name, in this case, assembly installer. So we're going to do again, a arbitrary called a load library. We're saying we're loading malicious DLL and all you do is you write it to the database and read it back. Now this hack is kind of magic. It doesn't matter where this is in the data structure. If you can control two key value pairs in some part of some object graph, if it gets saved and read back, that gets you RCE. And this actually makes a lot of attacks really ridiculous and easy. Like there's some application that's just asking you for a couple of string pairs and later you get RCE when it gets read from the database. And this kind of attack works with a lot of serializers. Here's a list of all the ones I know. These are all the dot net serializers I know where this sort of mutation attack works. You'll notice these are all JSON and BISN serializers. This doesn't work for binary formatter because it doesn't use anything like this kind of syntax. And it's also worth noting that this doesn't work against MongoDB's serializer. You'll note that there's different requirements for this to work in certain cases. Some of them you have to control the first key value pair. Some of them there's that assignability check. Some of them there's other like specific unsafe properties you've got to set. So there's a lot of variability in how exploitable mutation can be. For example, JSON.NET like most popular open source library in the world as far as I'm aware. You can get mutation attacks against it but it's a little bit tricky. You have to control the first key value pair because that's the only one it'll read the type specifier from. It has to be deserialized using unsafe settings. It has to be serialized in such a way that it doesn't double up the type specifier. And in general, I would suggest experimenting with this. There's a lot of weird special cases and nuances but sometimes you can make this work and you can use this to exploit things where the serialization is just not something you can touch. The serialization happens on the back end. You can't see the deserialized data. Maybe it even gets an H max stuck on it. It doesn't matter. On the other hand, there's serializers where this just works all the time. So if you've got JavaScript serializer with a type resolver, it will go out of its way to make the exploit work. It doesn't matter if you've got other entries in your key value storage. It doesn't matter if your type specifier is the last thing in the list. It doesn't matter if the assignability doesn't make sense. It'll just run the code and it'll just work. You can also do kind of a blind scanning technique to find these vulnerabilities. If you've got websites out there that you think are running on .NET and might have some back end cache or database, you can just stick key value data in there. You can use that assembly installer ping back trick I've talked about and you can wait to see if you later get a request back to your own server. So you can stick data in services blind, use maybe unique URLs for your ping back so you can see which one to talk back to you and then maybe later on when it gets read from the cache you'll get a request and you know there's an RCE happening there. You can defend and get these attacks in a bunch of ways. If you're writing an application, the best thing to do is don't use a polymorphic serializer and I'm gonna say that a lot in this talk. Don't use a serializer where the data gets to tell you what type it wants to be. If you have to for some reason, you can try using a serialization binder but I'm about to tell you how to bypass serialization binder is so kind of grain of salt there. So here's how to bypass serialization binders. In general, if you're talking about using a serialization binder for security purposes is acting like a filter. What's happening is during the serialization your binder is going to get asked about every type that's directly referenced in the serialized data and it'll say okay, this is the type I expect, go ahead or if you're doing it right you throw an exception when something type you don't expect shows up and that means if someone throws pain at you you say I don't know what pain is you throw an exception and nothing bad happens. So if you're doing it right your serialization binder looks sort of like this. What this is is just an allow list of all the expected types. It's a string allow list for both the assembly name and the type from the assembly name and if you see one that you don't expect you throw an exception. The problem is a lot of times people don't do this. Usually what you see for a serialization binder is something more like this where you have some assembly you've written yourself. You say well I trust all my types there's no crazy serialization gadgets in there. So if the type says it's coming from my assembly I'll just allow it and I'll use type get type to actually get the type out of there. And the problem with this approach is say your assembly contains a type like this. This is an initialized list type we're going to invent that just derives inherits from the just generic list type in .NET and we're adding another property to it. That seems pretty harmless but if you've got a type like this in that assembly that you're trusting you can export it like this. So here's a JSON payload to bypass that serialization binder I just showed you. The type it's saying it wants to be is initialized list that type I just mentioned but the type in the template for that is assembly installer that one that lets you do an arbitrary load library. The trick with this is initialized list is the type you're getting asked about that comes from your assembly so that binder is okay with it. And you'll notice that assembly installer is only ever referenced inside the template here but when this values part of the JSON blob gets deserialized it'll still make an assembly installer object it'll still set its path property and you're still doing load library so your RCE is still working. There's a trick here that when you serialize this with JSON.NET it'll put another dollar type entry in there for the assembly installer but you don't need it. It can figure out what it's supposed to be if it's not there so you can just take it back out again and then bypass the binder. There's another trick you can use to bypass serialization binders that I'm calling contagion. So, for JSON.NET and a lot of other BSIN and JSON serializers you've got that dollar type entry that's saying what type it's supposed to be but that object you're creating has members, properties, constructor arguments that have their own types and you don't have to specify the types of those in the JSON. If you serialize it, it will but if you don't the serializer will just figure it out. So if there's some serialization gadget you wanna use and it's a member of something that's a member of something that's a member of something that you can get past the binder you can use that one object that has it in its tree somewhere to get it past the binder. Here's one example. So, Windows Identity that I mentioned before is a JSON.NET RCE gadget it lets you pivot to binary formatter and you could have a serialization binder that specifically block lists that and if you do that you can still get it by. The way you do that is you use a Windows authentication event or ex-object. So if you serialize Windows authentication event args it has a constructor argument called identity whose type is Windows identity. So when you serialize that the only type going by the binder is this dollar type because the only things that the binder gets asked about are the types explicitly listed in the JSON. But when the identity part of it gets deserialized here it'll still make a Windows identity object it'll still set its properties you still get RCE. So that's a lot of problems. What if this has been fixed? So, I am with Microsoft I practice responsible disclosure I told all of these people about these issues in January or earlier. Everybody except MartinDB made some sort of fix MartinDB as far as I've checked last still hasn't. MongoDB's fix is pretty solid. I don't know how to bypass it they added a pretty strict allow list on the types that can get created during the serialization. It seems good. Everybody else here added a block list. LightDB also added an assignability check so that puts them about on par for MongoDB before they made a fix. I just showed you how to bypass block lists. I can bypass all of the fixes for LightDB, RavenDB and service.redis. Like I said MartinDB didn't get fixed. I told all of these people, look I can still bypass these fixes. They said we're not making additional fixes. So there's remote code execution vulnerabilities that are live right now for all of those libraries worth looking at. The mutation attack I mentioned against jason.net is not being fixed. I talked to James Newton King, the maintainer for jason.net about this. He said essentially it's supposed to do that. So that behavior is not going to be changed. If you've got some application that's using jason.net it might be vulnerable to mutation. Similarly JavaScript serializer, the .net serializer I mentioned that works really well for mutation attacks will not be fixed. I talked to the .net team about this. They said we tell people don't use JavaScript serializer. We tell people don't use type resolver. So we're not going to fix them. Just don't use them. So best practices to avoid these issues. First thing I keep saying, don't use a polymorphic serializer. Don't roll your own. It's a really bad idea. Don't have that data. Let you tell you what type it wants to be. It leads to all kinds of problems. Don't call type get type. Because if you're doing that you're probably writing a polymorphic serializer even if you don't realize you're doing it. Similarly in Java don't call class for name. Also remember that you can't use an unsafe serializer anywhere because mutation attacks. If it's on your back end, if you've got an HVAC it doesn't matter for mutation. You can attack like deep copy tricks. A lot of people use serializers to just deep copy objects. You can get RCE out of that because of mutation which is kind of silly. So don't use unsafe serializers anywhere. This one kind of hurts but maybe don't read untrusted data from NoSQL. Mongo might be okay but it kind of looks like every other NoSQL engine I've looked at. You can get RCE if someone can write bad data and you can read it back. Now I only really looked at .NET NoSQL engines but there's kind of a pattern here with NoSQL where they say just take this object and then later on you can tell the NoSQL engine I want the object back and I don't care what it is. Any time you have that pattern there's a polymorphic serializer in there somewhere and you can probably get RCE out of it. If you want a research project or want to go find libraries that are vulnerable maybe look at Java or Python NoSQL engines. Don't try to use serialization binders. It's possible to write a good one but nobody ever does it. Everybody screws this up. I see bypasses for these all the time. In general you're better off architecting your application so you don't need a serialization binder in the first place. And now I'm going to get into the bonus stuff that's just for DEF CON. So I've been talking about .NET framework exploits but what about .NET 6 Plus? Everyone seems to think that's different. It's not going to have these serialization vulnerabilities. So since 2016 .NET has had a couple of different flavors. There's .NET framework and then there's .NET. That's what they want me to call it but .NET 6 through 8. Those are the ones people use right now. All these exploits have been .NET framework exploits so they're the ones that are in YSO Serial. But what about .NET 6 Plus? Can you do this sort of stuff there? There is this myth that .NET 6 Plus is immune to serialization attacks. So here's the CVE Mongo opened for the vulnerability I found and it's kind of an eye chart there but I'll underline the important part here and what they said was it must be running Windows hosts using full .NET framework not .NET core. That's not true. Similarly if you look at YSO Serial they have a bug there which is is there any gadget for .NET core and no one has found one there. So admittedly exploiting .NET 6 Plus is harder. A lot of the exploitable types, the gadgets that people use in .NET framework just aren't there in the framework at all. There's also this whole issue where .NET, .NET 6 Plus whatever we're calling it actually divides the framework into three parts. There's .NET core, there's ASP net and there's the Windows desktop part. And depending on how you build your application you only get some of the DLLs that are even visible at all. So you can only use gadgets from the ones that are appropriate to how you built your application. So the ASP net core app types and the Windows desktop app types won't be found by type, get type. You can't deserialize them unless you've built with an ASP net app or a Windows desktop app. But you can still deserialization exploits. So object data provider is still there in .NET 6. It's still there in .NET 8. You have to have Windows desktop loaded for it to work but if it's loaded the payloads I've been showing you for object data provider they just work fine. There are also some serialization gadgets that do exist in .NET core app and now I'm going to go to the parts that aren't on my slides because I think I've got some time left. So I told you earlier how you can get a paint back with assembly installer. There's a similar trick you can do in .NET 6 in .NET 8 and so on and there's a few types you can use to do that. One of them is assembly dependency resolver. Another one is system.io.fileinfo. The trip with both of those is they will call create file whatever string you give them. So assembly dependency resolver has a constructor argument which is just a path and it'll just call create file on that path. The file info type you can set the read only flag on a file with it and you can do that however so you can also use that as a payload to do DOS because you can make files on the server read only but when you do that it'll also call create file on that path. Now there's a thing with create file in Windows where if you give it an internet SMB URL or a webdav URL it'll go talk to that. It's happy to do it. So if you've got an SMB server on the internet or a webdav server somewhere you can use those gadgets to get a paint back to that server. Now a lot of times if they're doing their offset correctly S and B outband will be blocked on the server you're trying to attack and sometimes the webdav redirector won't exist in the windows install. So it's a little bit iffy but in my experience usually one or the other of those works. So you can still get a paint back essentially by using assembly dependency resolver or file info setting the read only flag and then giving either an internet SMB URL or a webdav URL. And that's actually all I had. So are there any questions? Oh thanks I saw one over here. Sorry can you tell me that one more time? Sorry. Okay the question was do I have any examples of the vulnerable games? I don't remember which ones they are but what you can do is go on GitHub or like if you go on to NuGet. Okay so two approaches. Go to NuGet look at our projects that are dependent on light DB and then look at where those get used or just search on GitHub for uses of light DB for things that look like games. That's how I found a bunch of our examples of that before. Yes over here. Sorry. You said that after you're reading the object it will actually initialize the object injection right? So how did you find that in the first time? Because it's not something that you typically think about when you start this research. Okay to clarify was the question how did I realize that the vulnerability was there in the code that I was looking at to begin with? Yeah because you said I can control the key I can control the value and then when I read it it will initialize the object injection right? Oh okay so as far as that goes if you're looking for a polymorphic serializer where people are rolling their own which is a really bad idea in general what I look for when I'm doing these sorts of code reviews is calls to type get type that are just being passed a string especially if the string somehow comes from user data. Type get type being called on a user provided string almost always is either unsafe serialization or someone doing really sketchy with reflection invokes and both of those are probably RCE. Does that explain it? Yes it is, thank you. Okay in the middle here? Okay the question was did I look at DB? I did at least okay the question was did I look at DynamoDB NoSQL? I glanced at it. I did not do an in-depth test. It did not have as easy of an exploit as the other ones I looked at. I won't say it's safe. And then there was one over here? Okay the question here was the assembly installer exploit that I'm loading malicious DLL with and how can I make sure the malicious DLL is there present on the system? In that case the assumption is you've got some other exploit that lets you do a file drop. Something I should explain is the cases where I was using assembly installer exploits that's because the string is shorter than the object data provider ones. Object data provider works for all of these too so do lots of other .NET gadgets. Assembly installer I feel like honestly is more useful for doing a ping back to an HTTP URL because that lets you do that blind scanning I mentioned. And one way in the back you might have to come forward for me to hear you. So the question was whether automapper and fastmapper that also use that sort of reflection under the covers are also vulnerable. I'll admit I haven't looked at those. I'm honestly not quite sure what you're referring to so maybe we can talk a little bit more about it after this. If there's no other questions I'll finish there. Thank you.


The following is a presentation of TFNN. Trade what you see with Larry Pezzavento. All now toll free at 1-877-927-6648 or internationally at<PHONE_NUMBER>. Now Larry Pezzavento. Okay, looking good Billy Ray feeling good Lewis. We're going to be looking at the first chart is the semiconductor three times bullish index. I've never heard of this thing. It's the SOX XL. One of our friends was asked to take a look at it and as you can see it made a high in 2022 at 75. Then it dropped a slight correction down to five and now it's had a little bit of a rally. I would be thinking it's not going to get much higher than the 382 retracement here up about another $15 would be my guess. The next one we want to take a look at comes from our friends up in the northern part of the Americas which is Canada. And we want to take a look at the let's try this again. Larry want to look at the Australian dollar, not the Canadian dollar. Let's get this up here. Here's the Australian dollar. As you can see here, we're at some major support in here. Now this is related to the futures markets because they are very heavily involved in agriculture and stuff. And as you can see, we've had these big APCDs here, the rally back to the 61% retracement, the seven or eight weeks that we stayed right at the 382. And now we're hovering down by the 61% retracement. So it's you're still not seeing any chart. Are you joking me? Let me try it again. Hold on. I'm doing everything the same. So bear with me. Hopefully I tell you these technical parts of these things are the things that make me go. Let's see if it's working now. There's the Australian dollar. I don't know if you saw the other chart or not. If we're not seeing any charts, folks, I don't know what to do because I'm not, well, you know, let's see. We're seeing now. Okay, that's good. So you can see that we have a lot of resistance up here. If we ever get above this, it would be very, very bullish. But right now it's heading down. The big thing that's happening today, folks, is the big sell-off that we're seeing in the grains. I mean, they thought the hot weather was going to come in. And we said we'd have to wait because it looked like we were going to go lower. And of course we are sharply lower getting near some really good support levels. I'm going to try to work out a special program here for all of our subscribers only. And that's going to be on the grains. I hope to do it this week. And I've done a lot of homework on this. And I want to share with the subscribers for 24-7 and the newsletter and stuff, because I've really looked at these things very, very closely. And I think we're seeing something historical happening in some of these things. But we'll have to wait and clear this with TFNN to see if we're able to do that. Our guest tomorrow will be, I'm hoping, well, let's put it this way. I know we're going to have Stan Harley on Thursday and Bob Miner on Friday. I'm hoping to have Jeff Huge on tomorrow on Wednesday. So that's what the theory is or the hope is that we're going to have things that we're looking at. And I want to share just a couple of other charts that I think are relatively important. We talk about this debt cycle. I'm going to bring this up here and show you the last time we had one of these really crazy ones. This came from someone that sent it to me from on the internet. The chart is correct. As you can see, the debt cycle really doesn't mean very much at all. They already know that, that the Fed's not going to go bankrupt. We've already rallied two full handles in the Treasury bonds since Sunday, since they started this thing on Saturday. So that's all that is, is just a short-covering rally. The bonds are still going to see higher prices. Let's try that again. Lower prices, higher interest rates. The cycle that we've made here in bonds is going to last at least five to eight years, maybe a lot longer of higher interest rates. So whether that's going to happen or not, but they respond to the news in a heartbeat. So when you see those things occurring, you know, you'll know that, my goodness, why is causing all this? Well, that's why I'm a technician, folks. That's all I'm trying to do. Just to give you an example, last night, when we were going crazy, and I just want to get this up here and show you, because you remember on the show, I said I would be shorting it if we got at that magical 43, 14,367 level. And that's exactly what we hit here on Friday. And then, of course, Sunday, it gapped up, my stop was 40 handles, and it gapped up 40 handles, and then went another 50 handles higher. Now it's just basically come down to fill the gap is all that's done. But see, when these patterns fail, oh, my goodness, you know, you really have to pay very, very close attention to them, because the upside on this is unknown because, you know, we only have this GPU thing that's not new, but now it's in the news along with the AI. I mean, where were they six or seven months ago? I mean, John Jameson's been talking about this stuff for at least a year that AI was going to be a big thing, and now it's here. So we're going to be able to see how this works out. He's going to be introducing, he and I, well, I'm going to have a website that we're going to sponsor for John. Well, I'll get into that at a different time. But let's talk about Bitcoin for just a second, because we've had several people ask about it on a long-term basis. Here's what we've seen here. We topped up here a couple years ago at 67,000. Then we came down to the 16,000. We rallied up to just above the 382, and we're hovering right near the 382 right now. This is not a tulip bulb, folks. A tulip bulb goes straight up and straight down. This thing went from 67,000, and now it's at 28,000. Remember, it was trading for under a dollar at one time. So a dollar to 28,000. If you're on a vacation and come back and you own it at a dollar and they tell you it's 28,000, just don't let them tell you it was at 67,000. You'll be relatively happy. So that's neither here nor there. So let's pay attention to that one. There's a couple of others that are interesting. This is one that shows you what the value of the S&P is compared to the other 493 stocks in the S&P 500. Look at this. This is truly amazing, folks. This is the S&P with the seven stocks, and here it is without the seven stocks. Now, that to me means something. I'm probably wrong. Just an old country hick from Tarrot, Indiana, but boy, I know charts and that tells me that there's some distribution going on here. There's a few stocks that are making this thing go up, and if that ever slows down like maybe they would have a down day, holy moly guacamole, that would really be exciting if that happens. We've seen this happen before in the dot com bubble, if you'll remember, and then also right before the real estate collapse. We had something like that. The dot com bubble was a once in a generation time. At least I thought it was until I looked at those seven stocks. It's really quite amazing. Another way of looking at this is this comes from a friend of ours over in the UK, and I wanted to bring this up and show it to you because it tells you pretty much the same thing that if you look at the weighted value of these things, we've actually been going down, with the exception of some of those stocks that have been absolutely going up. Remember, the Dow Jones and the Russell are certainly going down. We're going to take a little break, folks. 7, 9, 2, 7, 6, 6, 4, 8. Currencies, commodities, and bond markets are as important as ever right now with how they're driving the volatility in equity markets across the globe, which is why it's a great time to try out Teddy Kegstad's Tiger Forex report. Teddy Kegstad breaks down the Forex markets every Monday using his 30-plus years of experience as a trading veteran of futures, forex, stocks, and options. Teddy releases his weekly Tiger Forex report every Monday morning with coverage of all the major currency pairs, including the Dollar Index, the Euro Dollar, Pound Dollar, Dollar Swiss, Dollar Yen, as well as many more, and he also has weekly coverage of the crude oil market and the 30-year T-bonds as they both influence forex markets tremendously. When you sign up for the Tiger Forex report, you also gain instant access to Teddy's 60-minute Webinar Archive. He just hosted Forex Strategies and Fundamentals What is Behind the Tiger Forex Report. For all the details and to start your 30-day Tiger Forex Report subscription today, visit the front page of TFNN.com. TFNN Educating Investors. Steve Rhodes started his trading career as a student almost 20 years ago and the student has now become the master. Steve won the prestigious Timer of the Year award in 2018 and barely missed that mark again in 2019, finishing at number two for the year, an amazing accomplishment. Steve Rhodes is committed to sharing his techniques and knowledge with anyone who wants to learn and he shares his vast amount of trading knowledge every day in his Mastering Probability Newsletter. Steve's award-winning newsletter, Mastering Probability, is delivered every trading day with updates throughout the afternoon. Sign up for Steve's Market Newsletter, Mastering Probability, and you'll receive access to seven of Steve's educational webinars absolutely free. At TFNN, all our newsletters come with a 30-day money-back guarantee so you have absolutely nothing to worry about. Visit TFNN.com and try Mastering Probability 30 Days Risk-Free Today. TFNN Educating Investors. Tom O'Brien founded TFNN over 20 years ago to help educate investors just like you. Tom's Daily Market Newsletter, Market Insights, is published every morning when the markets open to give you the competitive informational edge you need to succeed. These newsletters are packed full of Tom's advanced technical analysis and are geared to deliver comprehensive strategies for a successful portfolio. Get Tom O'Brien's newsletter, Market Insights, today and try all of our products and newsletters 30 Days Risk-Free with our money-back guarantee at TFNN.com. TFNN Educating Investors. Free at 1-877-927-6648 internationally at<PHONE_NUMBER>. Okay folks, here's the natural gas. We've had this on our watch list for quite some time. We sent a special video out on it on Sunday looking for the market to get down to 225. We just hit 227. So we're almost at that little red box that you see over here on the right. That's your completion of the ABCD pattern. And of course your stop would have to be down here about eight or 10 points, roughly $500 on this. But you can see it's just been absolutely a perfect symmetrical Gartley pattern with the ABCD pattern forming ABCD coming in right here. And if you went back and looked even farther, this is just a four-hour chart. If you went back and looked farther on the daily, you'd also be seeing another number coming in here at the 50% level of the low that we made down here at 196. So this is going to be a real interesting one. And we're just two points away right now. Those of you that like the price of beef right now, get ready because it's going to go a lot higher. It looks like we've got all new highs now in all options of the cattle market going strong. Of course, hogs have dropped by 30%. So that'll help take some of the sting out of it. But the price of beef is certainly going to go a lot higher, as you can see. And how much higher? We don't know, but it's going to be interesting. Now I wanted to just mention to you about the stock market. And this is one of the videos that we sent out. You can see there. Well, you can't see it yet, but you will soon. This was when we were looking at the market last night on Sunday. This includes Sunday and Monday. And you'll notice here, there was the first retracement that we had right here. This was the one from today. Let's try that again, Larry. This was yesterday's 382 retracement of the high that we made when the NASDAQ was up 250 points. This was making a 382 retracement. We sent this a good 30 minutes before, well, you can see, 30 minutes or so before the market hit that level. And we went above it by 10 points, $50, and then dropped off the face of the Earthwell. We dropped off and made a giant APC down there. It dropped over 350 Dow points to get to the Potspot because it was up 200 and some at one. And then went down to about 180. So it went down and bounced, and now it's bouncing around down this level. So that's what we were watching and telling the folks, look, there was a bifurcation in the market. We had one market, the NASDAQ that was going crazy. The S&P certainly wasn't. We had a sell order at 42.45. It got to 42.44. So we missed it, but of course we got the 382 retracement back at 42.35, and that one turned out okay. But all we're doing is we're monitoring the market for patterns that will limit our exposure to risk, and that's really what my job is, folks. I'm just stopping thinking. My accuracy rate is around 60%, but the thing is I'm not going to risk a lot of money on some of these things that are falling out of bed or going straight up. I mean, I'll sell a market that's going straight up, but I'm going to have a stop in because I don't know how high up is. Just like when it's going down, I don't know how down is. So that's pretty much what I'm paying attention to as we're looking at some of these things. But what I'm seeing in the grain markets is truly startling. I spent a great deal of time with Rich Anderson here over this long weekend, and Rich will be our guest here coming up at the break. So let's make sure that we stay tuned to what Rich has to say because his specialty, him being a farmer and a rancher, he certainly understands what these markets are doing. So what we'll do is, when the break comes up, if you have any questions, call in<PHONE_NUMBER>. We're going to spend some time with Rich talking to him about the grain markets and also the oil seeds, which includes the soybean. So stay with us,<PHONE_NUMBER>. Gold Report As a precious metal, gold is still king. It continues to hold the most effective safe haven in hedging properties across the global major trading hubs of the London OTC market, the US futures market, and the Shanghai Gold Exchange. The Gold Report Tom O'Brien publishes his weekly Gold Report every Monday morning for subscribers, consisting of coverage of the XAU, HUI, GDX, the dollar, bonds, the South African Rand, as well as 25 different mining equities with specific buy-sell recommendations. The Gold Report New subscribers get a 30-day money-back guarantee so you have nothing to risk. Subscribe to Tom O'Brien's Gold Report newsletter now at TFNN.com From the most aesthetically pleasing artwork to patterns in the stock market. To stay on top of stock patterns you can take advantage of, sign up for the Fibonacci 24-7 newsletter at TFNN.com. When you subscribe, you'll get a weekly report from Veteran Day Trader Larry Pezzavento on stocks you need to pay attention to, and you can trust Larry's analysis. After all, he's got 45 years' experience as a day trader. Larry will also provide daily charts, videos, and data on the key markets that he's tracking. Expect notifications from Larry on market movement you need to act on at any time. First-time subscribers also get a 30-day money-back guarantee. If you're not satisfied, let us know and you'll get a full refund within 30 days of signing up. Subscribe to the Fibonacci 24-7 newsletter today TFNN.com Educating Investors Sharpening your skills as an investor is like getting better at playing a musical instrument. You have to practice, sure, but you also need excellent instruction from experts. At TFNN, you'll get advice and guidance from the authority in technical market analysis, and it's not just dry, tedious text either. TFNN airs live financial content streamed live on TFNN.com and TFNN's YouTube channel with Tiger TV, live every market day from 8.30 a.m. to 4.00 p.m. Eastern. For free, each host is an experienced trader and gives their tick on the market while taking calls and questions live from around the world. From the moment the market opens until the closing bell sounds, Tiger TV has eight different shows with expert hosts to help you make the right moves with your money. Watch online at TFNN.com or on TFNN's YouTube channel and become the investor you were born to be. At TFNN, Educating Investors. This segment is brought to you by Think or Swim. For more information, just click the Think or Swim banner on the front page of TFNN.com. OK, we're back, folks, and we have Rich Anderson on the line. Rich, how are you doing? Doing great, Larry. Doing great. I guess we got a little rain over the weekend instead of hot weather. Is that the story? Well, basically, you know, the market sprung up Friday on the idea that the forecast was for no rain to speak of. Well, today, forecast changed. Now, this is the forecast from 8 to 12 days from now. On Sunday night, it was, you know, on Friday afternoon, they were looking at the 6 to 10 day forecast, and we're just that time of the year. We're kind of on the shoulder. The weather is going to be a huge difference, and that huge difference, you know, based on what we see in the weather the next three weeks, there isn't necessarily going to be a whole lot of rain between, say, Nebraska and Indiana, and that could affect the corn. But, you know, the government's got a USDA 181-plus yield, and I think we're going to need to take four or five bushels an acre off minimum just to make that difference. The other thing is, I sent you a message last week about how China was concerned. I think I sent it to you on Thursday, China was concerned about the COVID, the XBB variant. They're running approximately 65 million cases a week. Looks like this will carry out into the end of June before it peaks. They've just approved their first mRNA vaccine. Their previous vaccines were very low efficiency and effectiveness. And so the concerns about demand from China, Dalin exchanged last night was down on corn or on soybeans, oil and meal. The weather in Brazil is basically decent other than Paraná might affect, they might have a freeze that could affect the corn crop, but Monte Grosso's basically they're a month away, but their crop is going to be fine and they're harvesting the beans like crazy. The only thing that over in the Black Sea, the Russians are only allowing the expectation of three ships a day, which is the lowest since they started this deal with the Russians, and on top of that I think they had some attacks on the Dessup port. So that's kind of unknown for the wheat market, but on the same token the Russians offer wheat lower and lower. So it's hard to get a bullish surprise right at the moment. They're talking about the lowest rainfall in Chicago at .42 inches since 1992 when they had .3 inches. Well, if you remember in 92 you had the Pintudo or whatever volcano, and you had all that volcanic ash, particulate matter in the atmosphere, and that affected things, but then that kind of dissipated, and the 92 crop got rained at the right time in July, and they had a good crop. The crop that year by the way was 131.5 bushels an acre, but the genetics of our seed today is so much greater that, you know, that that's not a comparison. The index funds are at the lowest they've been since like October of 2019. Well, every time the interest rates get raised you know, the guys takes up out of the index market because they don't see any potential and then you've got the Shanghai market in China saying something probably wrong, and you've got the copper market, which is you know, has a PhD in economics saying, you know, the demand is highly questionable at the moment, so we're going to have to wait for weather to get excited. I will say this that you know, when you go and make new lows if they don't keep their money on the table and close them there and follow through and kind of like the hogs last week, you know, they sold off sharply on Thursday and Friday and now they're still recovering today. If they can't hold them down here, then we're at value levels for the moment and there's just too much uncertainty going forward, so I think that's going to be kind of interesting. That's mostly what I'm looking at. I'm still looking for opportunities. I like to see a flush in rents, you know, where the markets make new lows and can't hold that those are when you get the snapbacks, but we don't have any at the moment because, you know, you don't have the index ones going in decent chance of battle raise interest rates at the meeting. The base book comes out I think tomorrow on employment Friday.  It might move a tent. It's a non-issue. So I'm looking for those opportunities. I can tell you when I look at the board and I see that July corn is roughly 70 cents, 69 cents higher than these, you know, that's still showing us good demand. But China's been trying, since March, March is when it started with the bean market and then three weeks later the corn market in China started to weaken significantly and Chinese have been trying to change their free directions to use more wheat than corn and meal so that they could put pressure on the U.S. basically because we're, you know, this pit for cat and that's kind of what's going on. So we need a demand story. We've got a supply story right now and that supply is more than adequate. It's going to come from some other event but the next three weeks we've got good soil, everything started looking good, the crop looks great. But three weeks from now if we haven't gotten any more rain than what seems to be on the forecast then there'll be a great deal of concern and of course the markets are and they just made that. Well Rich let me ask you a question about supply and demand. I mean we had wheat just a year ago this time at almost $13 of bushel and now we're under $6 of bushel. Isn't that a sort of like a closing sale? I mean how much lower is wheat going to go? I personally have the indicators on my chart that I used and I'm looking at a weekly chart now to give me a bigger picture tell me that it's been flushed out and we're probably at value but once you're flushed out and you're at value you still need to see the buyers step in and the index buyers aren't stepping in because they're afraid interest rates are going to go higher and every time the interest rates have been going higher they've been reducing their long positions and the Russians keep offering cash wheat in the Black Sea. We need to see them stop offering cash wheat in the Black Sea at lower and lower levels and then it'll catch hold and catch fire, Kansas City at $7.84 and that's almost $2 higher than the Chicago and likely in get to $2.50 to $3 higher than Chicago so that's where the real weather problem is is in Kansas City It's a demand thing and you've got Russia offering lower and how about a cattle market? They're breaking out to the upside higher beef prices than we've ever had, isn't it? Yep, yep they're just the consumer seems to be willing to spend money on going out to eat on experiences going, you know, I mean some of Taylor Swift's concert tickets cost $10,000 you know, so that they're spending all this money and they're spending on food and partying and that's what and the cattle crop you know, the herd keeps getting smaller every year and that's what's going on there Hey listen, thanks for joining us Rich and we'll have you on again soon and stay safe, okay my friend? When I see a fire star trade you'll be the first to know That's it, send those fire signals right over to me buddy, Rich Anderson folks Anderson Capital Management, we'll be right back You might think that if you want to be successful at trading in the stock market you're going to need a crystal ball after all it's impossible to predict the future, right? Like any endeavor in life before you decide it's impossible get some advice from the experts you might find that it's not so impossible after all for daily market overviews that give you direction on the key indices selective stocks and commodities subscribe to the opening call newsletter at TFNN.com The opening call newsletter is written by Basil Chapman creator of the trading methodology known as the Chapman Wave The Chapman Wave up down sequence gives you an edge in identifying price turns finding the peaks and valleys in stock prices get the opening call newsletter by Basil Chapman in your inbox every day first time subscribers also get a 30 day money back guarantee if you're not satisfied let us know and you'll get a full refund within 30 days of signing up for TD Ameritrade trading investors Are you looking for a way to consistently add winning trades to your portfolio? Tom O'Brien is here to help Tom O'Brien has been successfully trading markets for over 30 years a frequent contributor to TD Ameritrade Network and CNBC Tom O'Brien founded TFNN over 20 years ago to help educate investors just like you Tom's daily market newsletter Market Insights is published every morning when the markets open to give you the competitive informational edge you need to succeed These newsletters are packed full of Tom's advanced technical analysis and are geared to deliver comprehensive strategies for a successful portfolio Get Tom O'Brien's newsletter Market Insights today and try all of our products and newsletters 30 days risk free with our money back guarantee at TFNN.com TFNN Educating Investors Biotech is booming but for how long? Whether you think the Biotech bull has room to run or has run its course trade LABU or LABD Directions daily S&P Biotech 3 times bull and bear ETFs Visit Direction Investments.com slash Biotech today An investor should consider the investment objectives, risks, charges and expenses of the direction shares carefully before investing The Prospectus and Summary Prospectus contain this and other information about direction shares To obtain a Prospectus or Summary Prospectus please contact Direction Shares at<PHONE_NUMBER> The Prospectus or Summary Prospectus should be read carefully before investing An investment in the funds is subject to risk including the possible loss of principal The funds are designed to be utilized only by sophisticated investors such as traders and active investors Distributor Foreside Fund Services LLC This program is brought to you by Vista Gold Traded on the NYSE American and TSX under the symbol VGZ A couple of updates folks This is from the newsletter went out over the weekend This is the July soybeans weekly chart and if you notice here on the fry right corner where the 382 is marked there at 1294 and a half that was the 382 retracement of the low that we made back here two and a half years ago You can see the last time we had a 382 retracement So it was right here that led to the large ABCD pattern right here we've had this huge sell-off so it's actually trading about four cents above that right now and then if you remember just a few minutes ago we were talking about the natural gas and let's get this up I want to say I got to bring this to your attention folks because you know these don't work all the time but when they do work you know one out of six or whatever that number is six out of one, five out of 12 I don't know anyway there was a number right there 225.70 that was the exact low so far we're three cents higher than that right now so if you did either one of those trades make sure you put your stop a penny below that that way you won't have to risk anything at all and that's what it's all about it's not how much money you make it's how much money you don't lose that's the key to what we're watching here as we look at some of these things unfold regarding the cattle market I want to show you we've been expecting this to occur so just give me a second to get this up here we hit those levels here Monday because we were pointing to get up near this 168 level which we have done that today so we've broken out to the upside hogs on the other side have had that tremendous move to the downside they've rallied nickel since making the low but here's where we are here in the cattle market this may be a completion move we won't know that I have to have some type of a sign that the markets retraced or have leased at stop going up you know what your risk is at that point right now it looks like the cattle should make about 169 I haven't even checked them lately but wow they went even higher than that they hit oh no hit 167 has been high in the cattle so that's really all you're watching here at that so anyway the soybeans are sitting right there at that between down 30 some cents on a Tuesday like this with all the rain they're probably not going to hold this level right now but looking at all the grains I'm going to be doing this video here tomorrow and I'll probably do it tonight I'll get this video out to 24-7 folks so you can get an idea of where we are on some of these we are currently long November beans from 1195 they're 1193 right 1155 they're 1153 right now and then we also re-bought the corn at 28 2618 and we have a stop right below that it's moved up a nickel from that level interesting times to say this least so it's going to be very interesting this is the type of move in that I'm looking at here in grains that you don't see very often but when you do see it it's worth paying attention to it because the market folks at $12 a bushel nobody wanted to sell it it's one half of that price now and nobody wants to buy it stop and think of one other time this has happened to us in recent history do you remember the old story about negative interest rates when we had bonds at 172 before they went to 116 do you remember that story you got to get in there I'm going to let you take care of your bonds and we're going to charge you a fee for it and we're not going to guarantee that you're going to get your money back boy that sounds like a really good deal they had country after country after country believe in that malarkey now I am not from Harvard I'm not from MIT I'm from Indiana State Purdue and also Indiana University and also my one month school of medicine where I lasted six weeks that's it but other than that I do keep my eyes open on these charts and when they try to feed you you know corn and tell you it's full amen young not the same thing now here's one on the currency basis that is really really cool looking and I really like this one here hasn't completed yet but it is very very close and that is the dollar yen and as you notice here on the dollar yen we are really close to this level right up here it's a perfect ABCD you remember when we got up to this level right here that was the 382 on the big move and then we broke down and now we are making this small retracement here which comes in at the 61% retracement right up here just a little bit above where we are now just about at just about 142 I think the last I saw it was like 140 80 so we are really close to that so that's it well I just noticed here on the old Bloomberg that the Nasdaq is only up 20 after being up 250 on the day so as Basil Chapman always says it's early and that's what happened this morning when these happened it all started folks if you were watching the dollar and I sent this out an hour before it was happening I got lucky on that one that's 3 out of 3 wow that doesn't happen very often alright let's take a look here there's where we were there's a 382 retracement there was it there it was Sunday night when it gapped up several hundred points there was the first retracement and then this was the one yesterday right before in the middle of the night there you'll see it right there on the 29th and then of course the 30th we've come down and we've dropped all the way down to make a new JBC to the downside so this is still very negative in the Russell never moved at all all it was move lower and it's continuing to move lower now I personally believe we see a rising t-bonds today to a 127 that's a two-point rally and that's also indicative of the people believing that the debt cycle is going to be corrected yes it will be corrected and it'll be done probably in the last minute but it's all political folks and that's you know I tell you that's a bad part of these elections I don't know if I can take another 10 months of the Bologna that I hear on TV it just is absolutely just knocks me off my socks when I when I hear of what's going on I have one other question someone asked me about is what happened here this was the the trade that I was doing here on Friday right as you will get this up here take a look at it because I think it's important to see and I said to the folks this is not for you to do not do this trade this is when we were setting at the 61% retracement on the weekly now this is a four-hour chart if we go back and take a look at that weekly chart you're going to see exactly where I was and where I had my stop and I had no idea what was going to happen on Sunday that they were going to do the debt thing supposedly that's what did it but it could be NVIDIA or some of these others but what happened was right there and open 40 points higher that stopped me out and it went up another 50 points higher and so you know all I did I sent a video out and I sold I told the people I said watch for these 3A2s and they had one in the S&P at 4235 and we had a really nice one in the Dow Jones at 32210 and they both worked great so sometimes they work sometimes they don't that's it right back<PHONE_NUMBER> if you're looking for potential trading setups in the stock market then Rocket Equities & Options report is a newsletter you should try Tommy O'Brien delivers options and equity trades when the markets present them using a combination of fundamentals and technicals sign up for Rocket Equities & Options report today with a 30-day money back guarantee so you have nothing to risk for all the details and to start your subscription visit the front page of TFNN.com TFNN educating investors you might think that if you want to be successful at trading in the stock market you're going to need a crystal ball after all it's impossible to predict the future right like any endeavor in life before you decide it's impossible get some advice from the experts you might find that it's not so impossible after all for daily market overviews that give you direction on the key indices stocks and commodities subscribe to the opening call newsletter at TFNN.com the opening call newsletter is written by Basil Chapman creator of the trading methodology known as the Chapman Wave the Chapman Wave up down sequence gives you an edge in identifying price turns finding the peaks and valleys in stock prices get the opening call newsletter by Basil Chapman in your inbox every day first time subscribers also get a 30-day if you're not satisfied let us know and you'll get a full refund within 30 days of signing up TFNN.com educating investors everything in the universe is governed by the Fibonacci sequence this mathematical principle is responsible for everything from the most aesthetically pleasing artwork to patterns in the stock market to stay on top of stock patterns you can take advantage of sign up for the Fibonacci 24-7 newsletter at TFNN.com when you subscribe you'll get a weekly report from veteran day trader Larry Pezzavento on stocks you need to pay attention to and you can trust Larry's analysis after all he's got 45 years experience as a day trader Larry will also provide daily charts videos and data on the key markets that he's tracking expect notifications from Larry on market movement you need to act on at any time first time subscribers also get a 30-day money back guarantee if you're not satisfied let us know and you'll get a full refund within 30 days of signing up subscribe to the Fibonacci 24-7 newsletter today TFNN.com educating investors there's no cash or added costs when you join our community of traders sign up today and become a part of this educational community of traders just visit the front page of TFNN.com don't forget you can listen to TFNN live on your mobile device 24 hours per day go to TFNN.com then hit watch Tiger TV that's TFNN.com then hit watch Tiger TV folks I'm gonna put up the chart here you'll see the treasury bonds because we've had this big sell-off and now we're having a relief rally you'll get this up here now you'll be able to see you'll see it's burning the past two and a half weeks each of these each of these little tiny rallies have only been three A2s and then we're having the larger one now coming due to either today or tomorrow so watch that tomorrow up there 127-20 in the treasury bonds that should hold it the trade at 180 and then we went down to I believe 116 rallied up to 130 we were hoping to get to 140 and change we only got to 136 and now we've dropped quite a bit back and now we're rallying back bonds are in a very long-term bear market that means interest rates are probably going to be going higher so if you get a chance to buy a house with a really good interest rate and get it if you pay cash that's even better so let's remind ourselves that markets go up and markets go down if you remember that chart that I started today which was the semiconductors it went from 75 to 5 and we've seen this happen many many times before stocks that were well look at Netflix at one time 700 and went from 700 to 160 now it's back to 400 so they're having a lot of volatility in these things and that's what we're looking for but we're going to see some great things happening this is the growing season now for grains this is the time when you get all the rain and the sun and whatever it takes to make these markets move up and down so we'll be watching them very closely here over the next few days so stay tuned tomorrow our guest is going to be the wolf trader himself Shane Smolian a very happy camper because his Miami heat is in the NBA finals which should be a lot of fun to watch those games unfold here so live every day in an attitude of gratitude and may God bless and we'll see it tomorrow and I'll be doing the update in just a few moments