Thanks for making it out today. There's a lot of people here. Hope you guys are ready to learn some very interesting things based on our research of search engine hacking. My name is Rob Reagan. This is Fran Brown. We work at Stack & Lou doing security assessments. And we are the lords of the Bing. That's right. So basically we set out to we set out to improve upon search engine hacking and we realized that most tools that exist were getting blocked. Most tools... Most slides don't work when you need them to. But we actually, we realized that we thought it was a shame, really a crying shame that Google hacking seemed to be a dying technique. I had a bit of a weep.  There's no need to cry anymore because we are bringing it back. We sought out to make tools that don't get blocked. We sought out to actually make practical techniques that maybe you don't actually have to go out and scan actively. You can just have something that's running all the time and letting you know what happens. And we also just wanted people to really think differently about the way you approach Google hacking and also to blow your minds, as you can see by the icon. Have a nice blow your mind icon there. So we basically decided that Google and Bing were our favorite search engines. Yahoo is good and that's something we're going to explore more as well but what we focused on now was these indexes because they're the biggest treasure troves on the internet to openly find free information on error messages that are occurring in websites, vulnerable software that's being used in websites. And really, like I said before, we just really thought it was a shame that not many people actively are using Google hacking to find this information and we basically decided that these crawlers are the best to gather this information and they had cache it so that it's forever available to you. And... How many people here have done Google hacking before are familiar with Google hacking? Yeah, I assumed everyone is. I assumed everybody, right? How many people have Google hacked your company that you work for? How many people here have Google hacked a person? You can't Google hack a person, that's just stalking. You guys seem to be familiar with Google hacking for the most part. The types of things we're looking for here is just looking at the old Google hack database, is advisories, error messages, files containing passwords, things like that. Just as an example, looking for some SQL errors being dumped at the screen or some password lists in the URL. These are our new tools. These are the ones that you're going to use from now on. Basically, we're leveraging the Google Ajax API now that doesn't get you blocked. It doesn't violate terms of service if that's something you could... No one at Defconn cares about that.  So these are the tools you're going to use because we have... We're utilizing the Google custom search engine. How many of you have heard of that? What it lets you do is create customized search results. Let's say you only care about star.fedex.com or something like that. Maybe you only want to see results that come out of that. You can set a Google custom search interface that will only give you the wildcards that you specify. And you can utilize that in our tools. And for the first time ever, we also released a Bing hacking tool that actually will give vulnerability information. It's not just giving you kind of like passive footprinting information. It's actually... We made a Bing hacking database that we converted the traditional Johnny Long's Google hacking database from 2003 to 2004 to work with Bing. And enumerate things such as URLs from sites. And also, Bing has a feature that a lot of people I think don't know about that I wanted to make you aware of that you can search by IP address. And this is really interesting because you can see things like virtual hosts to IP address. You can see server farms that are something like Rackspace that has a lot of domains all on the same IP address. I actually was talking to some people yesterday at Black Hat that they had done pentests where they saw at a site administrator actually hosting his personal site or porn site on corporate infrastructure. And no one knew about that because they kind of had that as a closely guarded secret, but Bing knew about it. So you could put in things like just the IP address of your server and then see all the domains that are hosted on it that are publicly available.  I just didn't know of anything that was out there and available for you to use that would utilize a list of open proxies that are known to work to just pull results from Google. And this will indefinitely dump millions of URLs for whatever type of information you're trying to scrape. So either have an army of people ready to analyze it or be ready to write your own tools to analyze it because it's something that's going to give you massive amounts of information. And it also utilizes some things that we found deep in the Google documentation such as the user IP query string parameter. That lets you, basically it's designed for the AJAX API and it's designed for people that are embedding widgets in their site that kind of makes them the middle man proxy between their client users and then people that want to search that site using Google. And we just can specify random value for that to reduce getting blocked by Google. Also, it scrapes the mobile interface which is what comes up automatically based on your user agent when you hit Google from your iPhone or your Android phone. And that we're utilizing because it seems to have less restrictions on getting you blocked. It also is very lightweight. It has nothing like advertisements or other superfluous links that you would be more overhead in scraping this type of information. So just a little background on this.  Our primary tool uses the Google Ajax API as we mentioned which is the approved way of doing it but it does have several limitations notably of which is that it limits you to 64 results per query which is fine if you're just trying to Google hack a small company or something along those lines. It does make footprinting using Google pretty much impossible. If you want to enumerate URLs of an application you're trying to footprint or domains for your company 64 results is going to limit you whereas Google Scrape Diggity while violating terms of service probably will give you a thousand results just like the web interface so it's the primary reason for doing that. As we see on that, they're right there. How many of you guys are familiar with Scroogle? Anyone use Scroogle? A few people. But that kind of inspired us for this because they found other interfaces that were stripped down didn't have advertisements that are easy to scrape. This is just one here. They shut down the old interface but this was actually scraping Windows Mobile or Windows Mobile, Google Mobile which is a nice stripped down interface easier for us to scrape. Like we said, for the first time ever we've created a Bing hacking database that would actually give you good vulnerability disclosures from Bing. A lot of the disparate features between Google and Bing made it that the known Google hacking queries didn't work. Things such as in URL you can't use in Bing. But there are substitute features if you read into the documentation, things like in anchor instead of in URL. Things like the file type are very limited in title but basically this is just something we made for you to utilize and we're giving away for free via our website. So we have close to a thousand queries in the Bing hacking database now and I haven't seen any. The limited amount of painting tools we've seen in the past have just been strictly foot printing type tools not actually finding vulnerabilities. And we're also giving away the stack and loo database which is just a list of queries we compiled from forums and kind of underground lists that were beyond the Johnny Long Google hacking database and the FoundStone database. And it's also stuff that we actually have in turn actively adding to. Change to a desk. Yeah, just banging out stuff. And he's also working on some other stuff from Google code search which I'll tell you about a little bit later. So we're not happy just giving you the old stuff converter. We're going to be continuing to develop new regexes and adding them to this. Yeah, like this first one here, this first example, actually I found sites that they were giving away or they had exposed to the internet their salary information. Basically their pay band of what employees make what amount. Like that's definitely a sensitive information leak that you don't want on your website and you could use this search to find it in Google's index. So now we're going to demonstrate some of our tools to you. We basically decided that all the old tools that we didn't want to use anymore needed improved upon for several reasons. And we came up with this user interface to utilize our new techniques on Google and Bing. They appreciate with the FoundStone database, the Google hacking database and SLDB and allow you to do things like multiple domains. That was one thing that all the previous tools didn't do. You had to do one domain at a time which is completely unrealistic if you're actually trying to monitor a company of any sort of size. Most of our clients are Fortune 100 companies and one of them has 700 domains. It's just completely unrealistic to say I want to do one at a time. And you can also plug in the Google custom search key that's provided as I mentioned before that allows you to filter your results just down to things you care about. So basically for that client, we created a Google custom search engine that just filtered on those 700 domains. Then they could just check every box and just run it against that and make it a lot easier for them to Google hack themselves. But on an unrelated note, how many people are tired of looking at socks that are just normal and you want to get two socks that have pictures of wolves on them or clothes that have pictures of wolves on them in general? You have some wolf wardrobe? Yeah, wolf sweaters. Yeah, that was one of the funnest things about just looking at these results. One of the searches looks for OpenX shopping cart software that's known to have several vulnerabilities in it. And we found a website that actually specializes in selling clothing with wolves on it that's using that shopping cart. So if you want some free wolf clothes, go to people.com.  Look at that. Even for the children who use socks. They get them early. Yeah, so basically the fact that that Powered by X cart shopping cart software that's known to have vulnerabilities in the page was what Google finds and as it's indexing the content of the page and then allows us to generate queries to find vulnerable software in use. Yeah. So we got Bing. And the Bing interface, actually, you have to have a SOAP key. We actually provided a link for you to go to the site and associate your hotmail or live account, whatever Microsoft Passport account you have. Just make one up. And you don't issue a key for free. And you just need to plug that in. And as I said before, Bing has a really nice feature that allows you to search by IP address. And as someone that does network risk assessments, we don't even get domain names. We get, you know, an IP address range. So you can plug in IP addresses there up in the top right. You can either specify one at a time, a start IP, end IP, or a class. And it'll enumerate all of those for sites and then dump the results from whatever Google queries you're specifying. We also allowed you to specify any queries appended to the end of all of the things loaded in via the flat files, which you can go to the file menu or Google hack and queries that you want to keep secret. Or if they're just something that maybe no one else cares about, that you just want to use to monitor your sites or whatever you're interested in. And also on the simple tab, there's just an interface to plug in any query you want that would be akin to just hitting the web interface, which I think most people do now. Yeah, so again, this is just the Bing interface and to show that Bing does have tons of information about vulnerabilities. Just doing a simple search on it will give us, you know, some SNAP servers online. Yeah, this is, you know, you're hitting someone's web storage just by finding this and able to look through their information. Cool. Oh, and last but not least, this is still in prototype phase, but the Google scrape diggity, just to kind of illustrate, we could take in either a query or a query file full of regexes from the Google hack database, a list of Google servers, proxy lists, max results, and just to show you to enumerate them for footprinting purposes. That's a quote. At the end of the Perl file extension. Yeah, I mean, obviously, we're not going to demo downloading millions of URLs right now, but this is something that can go beyond the AJAX API 64 result limit. Yeah. So we see 73 results here, clearly about 64, and utilizing it in a way that's that's practical. If I was trying to do an assessment of stackglue.com, I might want a list of every URL that they have in Google for this. This makes it possible. One thing we realized is that, you know, the traditional defenses against this, finding these sensitive information leaks or vulnerable software was to just Google hack yourself. How many people that are responsible for guarding the security of a domain actually do this on a regular basis? Like a few hands. And yeah, and that's, most of the people we talk to just don't do this. And most of the people, if they do, maybe once a quarter, which just isn't good enough. There could be something that happens, you know, between quarters that you can entirely miss because it was added to the index and maybe removed after another, after the Googlebot crawls that site again. You know, other things that people do to protect against this or update robots.txt or put meta tags into their pages to prevent it from being indexed by Google, we also kind of realized that's not really, you know, that's something you should be doing, but it's not something that always happens when new features or new applications are launched on the website. Another thing that people do is they use data loss prevention tools that take a hash of your intellectual property and then monitor anything that's going out via email or anything that's going across the network to see if employees are leaking things, which is something you can do, but also we realized not really good enough to prevent this type of thing. Also, you should be using policies and legal restrictions, but again, it's only so much protection. So to really take it to the next level, to really do prevention in depth, we realized that all these failed and we needed something better. See all the stuff, forget it, it's dead, this is done. This way of doing things is over. It's not effective. As we saw one or two guys raise their hands that they Google hacked themselves on a regular basis. I think they were probably lying. Nobody does it. Probably lying to you. The Wolfsock companies of the world are left insecure and it's just a scary place. So now we're going to tell you about some more advanced techniques that we came up with.  Protect your net. As we said, the tools exist, but they're not convenient, we realized. We realized that you don't get real-time updates, you don't get multi-engine results, you don't have any way to monitor the data and keep a historical log of everything that's found and you don't have multi-domain searching, but that's until now. We're going to tell you a little bit about Google Hacking Alerts and Bing Alerts, which is something we came up with. How many people here have heard of Google Alerts? Do you use Google Alerts? Maybe you get email updates on things that you care about on the web. Put your own name in there and see what's going on with your Google. If you're really narcissistic like me, you do that. So we took the entire Google Hacking Database, NRSLDB, and loaded it into Google Alerts. And we set it up as soon as something's added to the Google index. Let us know via an RSS feed that maybe there's a SQL injection in this site or maybe there's a password file that's been disclosed on this site and it's monitoring the entire web. We have over 2400 queries that are loaded into there and we're getting basically 3000 to 4000 updates a day and finding really interesting things like James Bond's website, vulnerable to SQL injection. James Bond is in trouble. He needs some help. He's dumping MySQL errors right to the screen. Yeah, mi6.co.uk, which is a really dangerous domain to have SQL injection on. This is just the interface where they sell things like James Bond DVDs and T-shirts and other merchandise actually dumping MySQL error messages. And one thing that I realized about this into Google Reader that really makes it beneficial is all RSS feeds that come from Google are going through feed burner. That means they're cached forever. And basically if there was a situation like let's say a user started complaining about this error message on James Bond's website and so the developer's like alright fine I'll just hide that error message. Now the SQL injection is not fixed, as you know it's just become blind SQL injection and let's say you Google hacked yourself at start of Q2 and then Google hacked yourself at start of Q3 you would have missed something like that. You would have missed that they covered up that error message. But setting up a Google alert for the string of MySQL error messages would catch that. And then you'd actually have all this historical data archive of everything that was ever found and you would be able to see that oh well okay we had SQL injection to the developer actually fix it or did they just hide that error message. And that's one of the benefits of actually having it imported into your RSS feeder which I recommend Google's because you get that cache and you get that great searching ability. Also I don't know if you guys are familiar with this but if you do perform a Bing search and you append and format equals RSS you can actually turn Bing search results into RSS feeds then also update. So we took our over 900 Bing hacking database queries and turned them all into RSS feeds as well. And have that piping to us as we could see and it provides nice little snippets in Google Reader Forest there to see what we're looking at for vulnerabilities in Bing.  Franek basically was like I want to know as soon as anything happens to the sites that we're carrying about and he created also some thick clients such as like a Google desktop reader. So this is important so I just want to just restate this just so it sinks in. At this point for both Google and Bing any new site that gets indexed by Google or Bing that matches any one of these several thousand hacking database queries as they get indexed are being sent to us live feeds in an organized fashion. So from this point forward every single thing that meets the Google hacking database or Bing hacking database is being sent to us and organized for us. We're talking it's up to hundreds of thousands of vulnerabilities and climbing by three, four thousand, five thousand a day of vulnerable websites on the internet. And the great thing is we did all the footwork for you. We loaded all of those queries into Google Alerts and we can give you it's available for download right now from our website the OPML file for this Google Reader subscription. That's just the XML file that allows anyone to import these types of alerts into their RSS Reader. So you just download this file you subscribe to all the feeds, they're automatically nice and organized for you, you can start searching this is probably one of the largest repositories of live vulnerabilities on the internet hundreds of thousands of vulnerable websites. Now obviously our intent with this was just a way to monitor our site that we care about but this is also the next generation of mass injection tools. Obviously people kind of glaze over the fact that when malware is spreading via mass injection step one is search Google for vulnerable classic ASP pages that have SQL injection vulnerabilities in them but I probably see as malware writers get a little bit smarter about that, they'll actually have maybe an RSS feed that's feeding their mass injection worm so that as soon as there's a new site discovered in the index that it's infected with their attack. I know Rob mentioned this briefly but just to hit it, if you're not interested in looking through Google Reader at hundreds of thousands of vulnerabilities of everything on the internet and you're just interested for just yourself, you can download our Google desktop gadget and just specify your domains as many as you want and it'll take those RSS feeds and filter them for you and give you a nice little system tray alerts that you have a new vulnerability also a droid app coming soon so that you'll get these alerts right on your phone yeah so you actually cannot leave home without our Google Diggity and Bing Diggity hacking alerts so you have to have it with you at all times if you have it on your droid so basically all the problems that we saw with this act of just every once in a while searching yourself is really replaced by just having Google's cron system always just run as soon as new things are added to the index and give you these alerts you're getting them in real time you're getting them off multiple engines because we took the Bing hacking database feature of appending format equals RSS to all of those searches imported those into Google Reader as well and you're getting historical data that you can search you'll never miss a vulnerability on those index you'll basically see everything that happens you kind of get a timeline of what happened when and as I said they're really the most convenient way to do it and one thing that we're seeing and another reason that we wanted to investigate Google hacking was that the techniques were kind of waning and no one was really actively developing it but the search engines were still adapting Bing's coming out with new features all the time Google is having an app explosion in the last five years they've bought a ton of companies they're integrating those and creating new apps Google health is a thing that they have now want their healthcare and health records indexed by Google nice easily searchable interface for us to exploit yeah and there's things like the Google code search which we're going to talk about in a minute we're talking about the Google insights for search basically that's their zeitgeist feature just of what people are searching for now get the trends we identified that this treasure trove of information is really useful for spearfishing we've been calling Eric Schmidt every day he hasn't returned any of our phone calls yet so I mean basically for those of you that don't know he's the CEO of Google and he if you're looking for information on specific people that you maybe want to find their individual email address or their phone number to try to social engineer them or try to basically send them malware via an email and we're also leveraging Google code search how many of you guys are familiar with Google code search about half so what this lets you do is actually use Google to search open source code repositories things like sourceforge things like Microsoft's codeplex and even Google's code the repository that they provide it's just subversion but it indexes all of that code and you can write regular expressions against it things you can search for things such as a select query utilizing request.queryString in the same line and identify SQL injection, identify remote file includes identify cross-site scripting and we realize that this is extremely valuable information I just want to skip over that demo basically we're finding that we can develop these regular expressions actually I found things like someone's tennis match scheduling software for them and their friends like okay that had SQL injection and no one really cares it's just them and their friends scheduling tennis matches not much you can do with that but we're also finding popular open source software like PHP commenting systems, PHP forums and blog software and verifying the vulnerabilities are indeed legit and then if they're used by a lot of people it's worth publishing an advisory over that and adding a query that would find those sites that are vulnerable to our SLDB and this is another thing we have an intern just chained to a desk doing and so we're seeing one thing that he found he actually reads Chinese which was helpful because he found a site that is a blog software that's vulnerable that has a powered by this blog name, version number at the bottom of the page and then you can also so you can search for that string and then you can search for inurlmember.asp which is the vulnerable page and we're seeing thousands of results of people in China using this blog software that's vulnerable so it's kind of a two-stage process of using Google code search to look for SQL injection software to begin with finding a vulnerable blog software then developing a regex for powered by that blog software and then finding I think for that particular case it was over 25,000 people who were actually using that blog software that we knew was vulnerable to SQL injection and conversely the blackout side of this is that this is going to be another evolution of the way mass injection attacks will spread you'll do that same process rather than doing the good guy thing and publishing an advisory and putting out something to help people find these sites you can just search the web and mass-inject them how many people have heard of blackout SEO? it's search engine optimization basically the concept of getting search results for certain terms that are searched to the top of the results ideally in the top 10 Google results and you're going to get the most visitors blackouts are using this technique to actually take whatever is the popular search term of the day maybe when Twitter comes out Twilight comes out a lot of people are searching that when the World Cup was out it was identified that a lot of malware links were rising to the top of results for the World Cup was it like some kid you grew up with on Fox News talking about the Twilight results yeah some kid I grew up with he got himself a spot on Fox News as an internet expert and he gave a short segment on when Twilight came out about blackout SEO and basically said the defenses were to eyeball the URLs and Google results and see if it looks okay or not which is possibly the worst device that you could possibly give yeah there's no way you can tell these links are actually trying to attack you maybe you're expertise a little bit better than your mom's but your mom doesn't know that the fake AV software that her computer box is telling her that she needs is something that she shouldn't install but one thing that Google provides is the Google trends and Google insight for search to kind of get an idea of what people are searching for the most so this is the technique that these attackers are using one thing that was identified was that since 2004 is it that lyrics was the number one search term yeah and I guess that makes kind of sense I mean you're in a car you hear a song that you like you know it's Lady Gaga you know poker face or something like that and poker face and you go home you want to know the name of the song obviously it's poker face but you type in Lady Gaga the couple lyrics that you heard that you remember and the word lyrics and click go and lyric sites come up and that's how you find the song that you can then illegally download or buy the CD so this is just a perfect example this was a couple months ago people wait they waited for a job exploit to come out within a number within a few hours of an exploit being released these people put up Lady Gaga and Rihanna fake lyrics websites and then they use search engine optimization or black head search engine optimization to make their their fake lyric websites come up top in the Google results so if you went home heard poker poker face or any Rihanna song typed it in to Google all the first pages of results if you clicked on any of them automatically owned your computer's taken over exploiting this java book within a few hours of it coming out so obviously the solution to this is that artists just need to sing more clearly so that no one has to search to understand what the lyrics actually said which is not always easy I mean you can get it could work against you with incorrect lyrics like I've become a wet dream tomato have you guys heard of that elitist key song in Jay-Z the Empire State of Mind the New York one next time you listen to it next time you listen to that song it's still on the radio a lot when she comes in with the hook or you were going to hear from this point on is I've become a wet dream tomato nothing you can't do you will not hear anything else from now and I promise you like that I won't put my day job so actually rather than artists singing more clearly which might be a difficult task some of the defenses that you can utilize are things that the major the search providers and browser providers are already building for us they're trying to protect users by building the Google Safe Browsing API which is a blacklist of known malware and known phishing sites that if you've ever gone to a page that said this is a reported attack site continue at your own risk that's something they're integrating into search results especially useful for anyone that's utilizing Black Hat SEO techniques to get those search results to the top they're going to protect you from that but sandboxing software is another thing that's becoming much more useful anyone here use sandboxy? I do, yeah you guys do my friend Oscar told me about it I know he uses it basically you're going to run your browser or any application for that matter in a sandbox that's protecting right access to things on your system such as anything that you download it's going to say you want to recover this outside your sandbox or if anywhere malware were to actually exploit your system it's protecting from things like such as rights to the registry such as name pipe access or anything that's sensitive on the system and if you were to get infected by something you can just throw that sandbox away so you browse all the malware Rihanna lyric sites that you want all day and then just throw the sandbox away when you're done which is really the way to go and it seems to be the trend I think in the last week or a week and a half alone Dell released their own version of a secure browser using sandboxing Adobe released their next version of Reader is going to have a protected mode that's utilizing sandboxing and I believe Office 2010 has a sandboxing mode as well so this is really the you know as good of a defense as eyeballing up your URLs and Google results is to see if it's if it's good or not sandboxing is really the way to go and really this seems to be the trend basically that malware writers are unleashing things on the web maybe because they have a decided purpose one example just last month was some guys in China wanted to release this malware that would steal passwords to some online games in China and it got out of control basically as I said like the fact that people glaze over that step one is search Google for vulnerable websites it started hitting things like the ad providers for Wall Street Journal and for Jerusalem Post was another site that ended up distributing this malware that was trying to steal Chinese game passwords and this is a common problem that I only expect to increase especially as they get smarter about scraping the results and scraping the new vulnerable websites from Google and it's important to note I read like 20 articles on this and all the ones you read are very vague about how this actually started I mean if you see in the bottom right there they believe they compromise the total number of websites of 7000 to 114000 websites it's kind of a big range of I don't know how many there are let's say a billion gajillion, I don't know but they don't really cover how that happened to begin with and it's our belief that people are utilizing either Google or Bing or things like that to find 100,000 vulnerable websites to begin with before they do these mass-equal injection attacks and as we said it's great that they're providing these black lists of known domains that are spreading this information but one idea that I had was how can we mine that information to monitor our websites because the fact of the matter is most website administrators have no idea when they get out of that black list this is something I found on the NetSec list on Reddit it said that this guy says some dickhead emailed me a few weeks ago and told me that my site he said it was malware basically saying that his site was in the black list and when people were visiting it in Chrome it would say reported a tax site he said no way this is possible but then he actually checked it and realized oh yeah it is saying that why am I on this black list and I just thought we have all this capabilities and all these features in Google and Bing to be able to identify what we're linking to and what's linking to us why not have something better than dickhead alert system to let us know this is the existing defense the dickhead notification alert system some dickhead emailed me and told me that my site is serving up malware basically like I just wanted to investigate what would be better than that what can we do for the average person to know if they've been added to these black lists and so one of the advanced techniques we came up with was to protect your neck something that we're calling malware to get at this point and Google or rather Bing has a great feature called link from domain that you can get all of the offsite links all the sites basically that you'll dump all the URLs on your site that aren't linking to that domain so let's say we want link from domain stacklue.com that has every external host that we're linking to and I wanted to take those results and compare them to URLs that are in this black list see if they're see if any of those URLs are phishing websites or malware websites and that would help you get kind of an alert system together to let you know if you've been a victim of one of these mass injections and even to get that information more real time we can still we can use the append format equals RSS onto those Bing results to actively monitor any new links let's say you have user generated content on your site like a commenting system or a forum and anyone's allowed to add a link I came up with this idea when I was doing an assessment of a site that was kind of like MySpace it was what MySpace was supposed to be it let venues and artists and fans log in and upload music and basically share information about concerts and after they fixed all the cross site scripting that I found they also still wanted to allow external links they still wanted to let people link to whatever they wanted and I just thought about there's some risk in that that you might be utilized as a phishing platform especially with your large user base and especially your prime target for distributing malware as well so you should actually integrate some code into your app that uses the Google Safe Browsing API to identify any new links that users are adding but they basically were like well we don't have time to do that we're going to launch the site anyway you could utilize something like just Google's crawler or Bing's crawler to let you know of any links on your site that are in that blacklist so how many of you guys are familiar with what happened last month with the Wall Street Journal incident not many people right I'm surprised about that 100,000 websites compromised and nobody's heard about it basically just to give you a quick visual of what it is is they had 10,000 or 100,000 or whatever you could imagine a number of websites scoped out for SQL injection and they waited they waited for a browser bug to come out I believe it was an Adobe Flash vulnerability as soon as that did what they did was create an exploit for that they SQL injected all 100,000 of these websites appended to every page you know include this piece of JavaScript that's an offsite link that exploits this browser bug so that anyone who went to any one of these websites the next day including the Wall Street Journal if you went to that website it linked you to this piece of malware that exploited your browser and popped you so everyone who went to those websites that day automatically gets their browsers out so it was one to 10,000 to God knows how many people went to those sites and there's still tons of them actually if you just Google for these links these offsite links and if using our tools malware diggity you can sit there and monitor what's linking off of my site and compare it against these lists and not have to have some dickhead email you that you know that hey by the way everyone comes to your site is getting owned or fake AV installed you can now get a you have a new offsite link and by the way it's in this malware list maybe you should look into that it's a little better than the existing defenses and this is just a demonstration of the results for like I actually this this worked really well for monitoring new links on Twitter that were distributing malware phishing I was getting a lot of hits based on comparing those URLs to what's in the blacklist and that's just one example of a good way to use this technique also yahoo has a site explorer that lets you see inlinks to your site so I thought it would be interesting to see take a known malware URL like the URL for the Wall Street Journal injection was robint.us so if you could just and put that URL in yahoo site explorer and it's bot had gone out and indexed all of the sites that are linking to that so we know all the ones that are infected that that's also use information that you can gather and if you want something a little bit more professional a little more enterprise that's actually going out and crawling your site and identifying things doing things like JavaScript the obfuscation and analyzing all the content on your site actively Armorize has a new thing called hack alert but if you want something free and crude you can use these techniques from Bing that we were providing and so basically we identified that it was possible to monitor our external links and our incoming links and then compare those to the blacklist and then detect infections and then alert you to that but my friend asked me is it possible to get people added to the blacklist and I was like hmm that would be devastating because the black hat side of this is that you can if you show the next slide identify the links that are in those blacklists and mass inject your competition via comment spam or if they have any user generated content or forums and then basically let's say you want to wipe out all the other distributors of wolf socks on the internet so that you're the primary retailer of wolf socks you could have your competition blacklisted and then their page rank goes to zero and basically they're not going to show up in the top results of google anymore if people do click the link they're going to get warned that it's a reported attack site and you can't go there anymore and basically this is something that companies could profit from this technique is actively being used the algorithm that identifies the links that belong in blacklist is a closely guarded secret and this is something I want to test some more to be able to identify how you could get someone added to the blacklist but I could see this as a service line that the Russian business network might offer saying like we'll take out your competition or as mafia techniques they could say something like either give us money or we'll add you to the blacklist and this is just something that's kind of unexplored that information that you can easily gather from the search engines I think could be utilized to do something like that I could tell you how I would use it if you google for Fran Brown you will not find our research or me in any way you will find the Fran Brown College of Beauty so if I can get that knocked off the google page results I'm going to use this search engine deoptimization future predictions so just to wrap things up with where we think things are going because things are rapidly changing they've been a little stagnant since 2004 2005 but we're kicking things back off again as we mentioned earlier I believe there's going to be continued data explosion google index health records to phone records to open source code to anything that could possibly index and make providing easily searchable interface to so we're going to see a lot more data index real time streaming updates I also believe that we're going to see renewed tool development both on the hacker side as well as the security side so we're stepping things up on the security side but we're going to start seeing things like more automated google worms real time detection and exploitation people are just sitting there waiting in real time finding these vulnerabilities on google and automatically exploiting them and then finally I believe that google involvement as well as well as being involvement well they'll start getting involved more google has been getting a lot of a lot of heat from security from losing their custom authentication code to China allegedly and stealing everyone's wireless in Europe that they're going around so there's a lot of heat on google right now from a security perspective and I know it's led to them hiring a lot more in the security department I think this will be lower on their priority list but I think they'll start getting more involved in the google hacking and being hacking side of things and just to share I don't know if you guys have ever messed with this interface just regular google if you expand the side and go to updates and they are providing you can see what was indexed and what was going on in twitter and google five minutes ago or at 2 p.m. this afternoon google is providing real time streaming updates of this information so we're going to start seeing more and more real time uses of this information in exploitation so I will be available for questions after the talk I hope you appreciate what we shared today


The goal is just forgiveness. The goal is the happy dream, as the Course teaches us, you know, we're not to try to set any kind of goal. Don't set God as your goal. Set forgiveness as your goal. Set the happy dream as your goal. And then people will say sometimes, like, well, if everything gets so happy, then why would you even be here?  When you link your mind with the Holy Spirit, then everything involving the script is given, including the disappearance of the universe. So in other words, you don't even have to worry about anything. You don't even have to worry about your Truman Show scene. I mean, good afternoon, in case I don't see you, good afternoon, good evening, and good night. Isn't it great to know that the Holy Spirit's got that tucked in there as well. And it's all like autopilot. All you have to do is allow your mind to yield in to that place of non-judgment. Watch your happy dream. That can't be that difficult watching a happy dream. Then the Holy Spirit, in conjunction with your mind, makes the final decision, you know, the final bow. And as it says, the body can be gently laid aside. This is how it can be. Well, that is really good. That sounds really good. A happy dream, and then the body is gently laid aside. However, I also should remind you that when you lay the body aside, you lay the whole cosmos aside. There's somehow this belief that somehow the body gets laid aside, and then Jesus went off somewhere, and then this world kept happening. But it didn't. It's a hallucination. It's not really here. It never was anywhere.  You can lay aside the whole cosmos at once. Of course you have to. Reincarnation is kind of a belief, just another construct. Somehow you have a soul that seems to come into a body and then seems to go out and go somewhere, but there is nowhere to go because time and space and place and location are all just constructs too. So it's really great. You don't have to worry about leaving a legacy. Isn't this great? I mean, that's another great relief. Spend the whole now. There's Margaret's philosophy. She's got it. Spend it all now. Use it up. Don't leave anything in the gas tank or the propane tank for later. There's no need. And how different that is from all of our old strategies of preparing. For years, at the beginning I was doing this. I said, how's this going to affect a concept like a retirement account? The Holy Spirit is your retirement account when you really think about it. It's charge of everything. All your fringe benefits. They don't ever run out until you really have run the course of the ego.  So poof. All in an instant.


Hey weirdos, thanks a lot for checking out my video here. I wanted to give you a quick update as to what's going on the next few days and what you'll see, or in this case, not see. I am for the first time in numerous years, over a decade, taking a vacation. We're going to take the next few days and do some things that we've just been planning on doing. I won't tell you what that is just yet. I might be vlogging about it though, it might be fun. But in the meantime, you're not going to see any new videos for the next few days. However, I am going to continue creating the podcast. So what you're going to see is something that is just a podcast version of what I create on Spreaker.com, which will then just automatically upload to YouTube. So you're not going to see video versions of what I do, but you'll still get the audio, which is mostly what people tune in for anyway, right? So the Daily Dose of Weird News and Weird Darkness both will continue being posted. They'll just look a little bit different because they won't be actual videos, at least not for the next few days, all right? So I got to take a vacation once in a while. Now's the time to do it. I hope you understand. And hey, you know what? If you like the podcasts, well, you can go ahead and subscribe to those. And that way, you'll get them all the time, you'll be able to listen to them on iTunes or iHeartRadio or whatever podcasts software you use. And you can get those at the various websites, WeirdDarkness.com, DailyDoseOfWeirdNews.com, DarrenOnTheAir.com, you know, and you can find them all, of course, at MarlarHouse.com. So just wanted to give you a quick update on that. So you're not totally surprised and wondering what the heck is going on with Marlar. I'm OK. I'm just taking a vacation. All right. Love you guys. Thanks a lot and keep it weird.


Right here Adrian Peterson is the reason I love football. I know I'm a Lions fan and it's a Viking But you didn't have to say it but the first highlights. I ever saw the first football ever saw Adrian Peterson I'm pretty sure we all have that one guy who got us into the sport and after that I was basically like yeah I'm gonna dedicate every Sunday for the rest of my life to this sport Adrian Peterson just got a limited and it's actually a brand new type of limited or really a new type of card called legend x I don't fully understand how it works yet, but I can guarantee you one thing We will be pulling this Adrian Peterson impacts today and we will be using him So I'm gonna quickly learn exactly what that legend x means I assume he has some extra awesome x-factor something like that. This card's insane He's the fastest hat back in the game. He also has 89 truck 88 break tackle 92 change direction crazy Jill I mean it's Adrian Peterson man By the way, Adrian Peterson himself has confirmed that he goes by both ad and ap ad being all-day and ap being Adrian Pearson So if I say one or the other you can't sit there and correct me so you can see it right on your screen there You're actually guaranteed the legends x limited in this legends x launch bundle That's a whole lot of words to say I'm getting Adrian Peterson no matter what today So this bundle gives me three eighty four plus legends fantasy players 387 plus and my choice of one of two 90s, and I believe that one of those is guaranteed.  We'll know though.  Let's get it quite frankly. We don't need Adrian Peterson at all This team has insane depth at running back But Adrian Peterson is truly like one of my favorite players of all time The two people who got me into my favorite sports football and basketball was Adrian Peterson and Dirk Novitsky And in the living room we have an Adrian Peterson and Dirk Novitsky poster up. We don't care Also a huge thank you to one of the longest running sponsors on this channel It's dr. Squatch now dr. Squatch makes incredible men's hygiene products and their flagship these bars of salt like pintar right here are So amazing I've been using pintar for probably four years now and for the first time ever They have an absurdly good offer on their bars of soap if you buy three you get three free And there are tons of cents just to name a few there's wood barrel bourbon I got cool fresh aloe my favorite for vacation you get sunburned like I do they rum right here If you do the math on that deal that shakes up to four dollars per bar of soap, it's buy three get three free This is for new customers only now to take advantage. There's a link in the top of the description There is no promo code just use that link in the top of the description massive shout out to dr. Squatch once again Like that link and enjoy the rest of the video. All right. This is 387 pluses could be 90s There's two other 90s available right now. One of them is will shields.  What? Oh my god That was the only guy. I couldn't even remember.  Whoa, there's Michael Strayhan will shields and Peterson This is an 87 plus and we just nuked the will shields.  Thank you 90 will shields Hey, Adrian Peterson can run right behind him. I'm cool that yeah He's about half a million then Adrian Peterson's almost a million and he would definitely be more expensive except your you know Everybody who's opening this bundle is guaranteed to get him So not a lot of surprise factor on it But this is another 87 plus all we're looking for is an 88 89 or 90 baby and it's a great pack Okay, so Frank Harris that's dog water But if this one wants to clutch up clutch up clutch up I do like the boy Fred Taylor and you know what I'm saying that obviously this team could use an 87 full back It's it's not often that you get a good full back option anyway So Adrian Peterson can run behind Frank O'Harris too. All right. This is the final 87 plus fantasy Starts with Richard Sherman not exactly what we're looking for and it goes into Lincoln that funny enough that might actually be our best option We have Charles Cross at left tackle by right tack. Oh, we have tonsil. I forgot about that We have the limited Laramie tonsil. Oh, no Sherman's probably the move here over Kendall Fuller Yeah, cuz Sherman's big. Yeah, I'm gonna go Richard Sherman here and then of course so now we're guaranteed Adrian Peterson I wonder if there's a different animation for the legends X So there's the Adrian Peterson that we're guaranteed and then it does give me two more options But there's no way I'm taking someone that isn't Adrian Peterson unless I could I pull him twice technically that revises good though That revises are really good Legend X Adrian Peterson. Oh, I'm excited. This team has just the greatest running backs ever So we've been using that angry runs Chris Brooks that angry runs ability is not that good and Chris Brooks was not that good So I'm actually really excited to bring in Adrian Peterson here Adrian Peterson is faster more acceleration Way more agility slightly lower carrying higher catching better change direction. Hopefully he makes him look like a bum Let's learn what this X factor thing is though So it's a legends X X factor evasive legend X eight plays on once activated grants Steerable spin and juke moves backfield master legend X eight plays on once activated hot routes improve route running in Catching from the backfield and then that's it Interesting. Okay, so first and foremost you got to activate the X factor Then you only have it for eight plays which tells me it's probably not that hard to activate What would it take to activate evasive rush for six one plus hours? So it's actually just like angry runs except it's on for eight plays. I'm gonna be honest evasive. I'm not that big I've never been that big on this ability, but I really like backfield master backfield masters nasty to activate backfield master six consecutive catch targets Like I gotta throw to Adrian Peterson six straight times. That's excessive. All right. I'm just gonna go with evasive then I have to throw them six straight times. Am I reading that right?  I don't think we need that. I'm gonna go freight train in jukebox It's a cool concept. I just don't think either of these abilities are good enough I'd rather spend the two AP and just get jukebox always and backfield man I think I gotta throw it to him that many times He should stiff arm and truck people kind of on his own accord and then jukebox is just to get those faster Juke's we'll see if we can see if we can get weird with it. So here's the lineup We have a brand new right guard and 90 overall wheel shields. I wonder if I should actually be considering giving him an ability I haven't used any offensive line abilities this year. He could get nasty streak post up He could get identifier which I haven't used this year and I would be excited to use I'm giving him nasty streak and Adrian Petersen is gonna follow that man to the promised land So we're gonna deactivate Cooper cup and mid in elite and we will be activating jukebox on AP for two Nasty streak on will shields for two and the team is ready to go Here's the squad that Adrian Petersen's got look at the interior line is awesome.  No, it doesn't matter what I do this team is so stacked All right, y'all let's have an amazing Adrian Petersen game. What is Adrian Petersen's single? He has the NFL record for the single game rushing yards Adrian Petersen has most rushing yards in a game against the Chargers in 07 with 296 yards that is a diabolical number. He had 296 yards three rushing touchdowns one reception for 20 yards What's the fantasy points on that?  Gino Walker Hey, B.  He's got oh my god a few moments later He just fumbled on the opening play and I wasn't even looking that was Vaughn Miller on the edge, too First in ten big pancake block Adrian Petersen out in space. I ran that so poorly that just that could have been a touchdown I'm gonna go right at the middle here cut this up AP is gonna take two. Let's go with a lead dive here Oh, I still have Shannon Sharpe at fullback. That should definitely be Franco Harris, but maybe sharp a Shannon Sharpe It did not look like he was gonna be able to get that dude How did he get all the way there like three dudes out of me just kind of jump forward now Let's let de hop get a little just let de hop get a little action on the hitch here. I don't know that's a tight window That's a tight window. I'm run committing here if he if he passes. I don't care. This is an Adrian Peterson video He goes with fullback dive. We stuffed it. Oh my god.  I'm run committing. Please pass.  Oh If I gotta run that edge, he's gone second and eight same thing, but we're following. We're not coming back. Okay? Oh my god, okay opens up jukebox stiff arm 32 all right, we're gonna go stretch left side on third and two Oh, the block is not there on the edge, but he turns the corner big block. No. No, did I do that wrong again, too? Shit second and 16. Let's attack the middle. Oh great blocks.   Oh Come on AP. He's almost got freight train already and he's got a touch an easy touchdown right here That was a cake walk. It's about to be 16.  I'm gonna give him a dub He's he's excessively grieving not calling plays. Take your win, buddy I want to play our beautiful top three. What do you got sir the biscuit? Oh, he's got the Justin Fields to this guy plays He's got the competitive fast Justin Fields, Randy Moss Pickens and a hundred audibles there. Oh Come on. I wanted a big hit there second and nine nice work. All right. Let's just guess pass Let's send a little blitz. What do you think an Anthony Walker? Make up it's Patrick gets home. I Don't know what he's got. He's got nothing fourth and 18 Get there. No, you're right on him. Just tackle him.  Hey another break up. Nice work What a ball Justin Fields a nice pass first single down to the three Wow, those were some superb blocks. We had no shot on that He's in the end zone dude I'm only sad for Adrian Peterson because he used four minutes on that drive 11 plays 83 yards for minutes I just want to get your Peters and his yards first in 10 a pee baby good blocks George Kettle Oh, my car Parsons flew off his block though. Nice work half back off tackle second and seven. Let's see it Oh my god, great block Peterson jukebox.  Yeah big jukebox juke another Three rushes 50 yards lead dive up the middle great block from will shields Oh, and I just need a little block out of the hop there.  I have not passed the ball yet. Oh my no way. Oh, that should have been a touchdown He done with Barry missed a little bit. We get a third and five here. Do we continue to believe in the run? It's been so effective. I don't see how we give up on it now. Oh my god I need to choose you know Gino Smith on the read option. He kind of yeah, he sees it, but it doesn't even how are you not in come on AP one more, baby No, I don't even know how he got that tackle cut it up No, I got met by Ray Lewis for the goal Hey, you know what it was a hell of a drive is a hell of a drive AP You can throw it. Oh, that's funny Dude, if he threw that it was a pick six fourth and seven one thousand audibles here Pick that off I could just swatted it, but this is more yards rager in Peterson now Holy shit, what was that juke was that a jukebox thing that was nasty First pass player of the day go to DHOP wide open Dude this user plays he's making are so impressive Okay I'm going for two. I'm going for two two point conversion He's actually making such good user plays make it so many good tackles like that He's got a whip route and a dig and a corner. We do not keep them in bounds Dude, that's lame. I shade it outside and those double cover He's got a touchdown Nice play this guy's definitely good. He's got the Justin Fields.  Nice work Gino.  We're going for the rundown. We're gonna make this a manageable fourth He motions over Good blocks We're almost at a hundred we're not we're not at 300 though, which is what I wanted Just a lot of bodies out there two yards. We hit the 100 mark. Oh my god.  He lit me up on this last time, right? Yes that postro But yeah, she must say that's overthrown because if it wasn't I might have been able to pick it off Lying what kind of physics was that he's on a den run to the edge and he's able to lose all his momentum Whoa, I've never seen that animation that realism isn't exactly the name of the game See that's kind of more like what momentum looks like when you're running somewhere and you can't stop yourself Whatever somebody get home More pressure. Oh my god, we can win the game. I'm shocked by this play call I thought for sure he'd be going for that making a crazy amount of adjustments over there, but they're working Those are good adjustments. Just gonna go stretch to the edge use that jukebox Adrienne Peterson is gonna go for 30. He's got freight train. He's got freight train See now he's gonna run commit though. I don't want to lose his ability this quick Let's pass get into George Kittle take a clean six yards. There's George Kittle beautiful It's literally just George Kittle and Adrienne Peterson. It was my fifth pass.  That's a nine yard rush right there Get home Peterson first in ten It's okay, just take the sack keep the clock ticking second 15 going right at the middle Don't let him adjust. Just snap it snap it snap it snap it snap it snap it. Yes. Yes. Yes Jukebox freight train. Let's go Third and three need three yards go go Snap and zone yeah low-key. We don't even want to end zone that early second and goal going edge cutting it up If you're in Peterson break it tackles. It's a couple yards third and goal and he's not gonna call a timeout five four three two One snap it edge and zone not quite For the game Same formation. I ran all the stretches out of I think he was expecting something on the edge We're gonna make it 21 to 17 as fucked up dial But I actually feel bad, but I'm about to send I'm about to DM this guy give him an Xbox gift card to some Now he's going for everything. Oh Wait, that was the literal worst thing he could have just done wide No, no, don't quit. I need to see a stats Shit, dude, you know what's crazy real-life agent Peterson was infinitely Real-life agent Peterson was infinitely more effective 31 attempts 160 yards to touchdowns And 5.1 average yards per carry is still insane even if I was spamming dude The crazy thing is he knew he knew exactly what I was doing We still average five yards per carry that was a diabolical bullshit right there And I actually feel bad right now and we just got the field pass Jason Kelsey. No, I'm Markey's pouncy He's better do but Kelsey does have that ability that makes everybody block better. All right guys. Hey, I hope you enjoyed that That was like my dream come true right there. We won no time left with Adrian Peterson 31 carries 160 yards I love you guys. Thanks as always. I'll see you in the next one. Peace


So my name's Seamus. We're going to be talking about how to live an amazing year this year, right? I'm pretty bored. I'm trying to have some fun here. Hence the naked dude and some random lady posing on success magazine. Yo! My name is Alex and I bet you, like me, want to have an awesome year every year. So in this video, I want to share a couple of the questions that I ask myself. Every year where I do an annual review both in my personal business and life mastermind, but also the small number of coaching clients I do have every single quarter and then every year we do an annual review and a quarterly review. What worked? What didn't work? What are the habits I thought would help me reach my goals and what actually helped me reach my goals? So in this video, I want to share with you 15 questions to ask yourself at this new year to see what you can do differently to hopefully reach your goals in this coming 2018. What's up guys? I'm Alex Hine, author of Master of the Day. Now welcome to my two creepy friends right there and right there. That's an acupuncture doll. That's Gabrielle Bernstein. I think on success magazine. I just thought this would be fun and super weird and I'm fun and super weird. So let's do this. Now for me, the most important question is number one, did I have goals? Number two, what did I thought would help me reach those goals in terms of daily habits and rituals? And number three, did they and if not, what do I have to do differently? I mean, that's literally the whole bedrock of my book Master of the Day. It's one of the little tiny daily rituals that I thought would engineer this result and did they or did they not? So the very first question is what went well? You know, maybe you realized like me, you know, I thought that this would be great for my health. So with your fitness plan, did you think that eating a certain kind of food would help you reach your goals? Well, did it? With saving money, did you think that by budgeting, it would help you spend less money? Well, did it? Question number two, what did not go well? So for example, for me, I had horrible sleep all last year, sometimes sleeping three four hours a day. That was a result just from burnout, from overworking way too much, way too much stress. So that really did not go well. I had a lot of health problems for someone that despite having long-term digestive issues, I have no other issues. I don't even ever get colds. I'm so consistent with the gym and eating right and yet I went haywire last year. I messed up in a really big way. So what did I think was going to help me improve that? I thought that it was a matter of just trying to just be less stressed and maybe just taking it easy, trying to slacken my classes and it wasn't that simple for me. It was a lot more complicated and it took over a year of certain habits and rituals and really dropping the RPMs to see things improve for me. So what didn't go well? What were you trying to improve last year and it just didn't improve? Usually fitness, finances and relationships are the things I see come up quite a lot. So what did not go well? And I'm gonna give you a worksheet down below to do all of these two. Question number three. What daily habits did you think would help you reach your goals and did they? Now for me, this is the secret sauce because habits kick the crap out of goals any day of the week. And what I mean by that is I may have the habit, for example, of saving a certain number of dollars per month so that I can pay off my student debt before I graduate my medical program, okay? So that's a big goal. I want to save however many thousands of dollars per year to try to pay off as much as I can each year. Well, how do I turn that into a habit? For me, what I did was I had to automate a certain withdrawal every single month into a different bank account and then that goes to my student debt fund. Along the same vein, for me, my sleep was the number one habit I had to get back on track. To do that, how do I turn that into an actual ritual? For me, the ritual was at 10 o'clock every night is my complete shutdown from work. And I can do anything I want as long as it's just in a relaxed position, so reclined like on a couch here, and it's not on a screen, so it could be reading a book, it could be journaling, it could be reading an interesting medical book that I'm working on from one of my classes, anything, just not working, not being productive, and not with a screen. And then the corollary, did those habits help you reach your goal? And here's what I like, number four, what was the biggest risk you took that worked out? The reason why I had this question is that I'm a big believer that smart risk-taking is almost always, when it's in the name of growth, will make your life better. For me, all the most amazing things that happened in my life came because I took a risk and the way you define risk is gonna obviously define what risks you take and how often, but for me, for example, a risk could be asking out the pretty girl or the pretty guy you like, that's a risk. You'll feel embarrassed or uncomfortable for a little while, and if they say no, you'll feel weird, and they will too for a second, but so what? That's it. The upside is maybe it's the person you marry or you have an awesome relationship with. The risk I took when I decided to write books and put them on Amazon where people could say this was about as useful as a poo-flavored lollipop, like a person can write that anonymously on my book forever. That's scary. That's really scary if you take pride in your work, and there are some reviews like that. Maybe not the poo-flavored lollipop reference, but there are some reviews I'm like, ah, Jesus. What? Like could their life be that bad? They had to write a review like that? YouTube's a great example. So what was the risk you took last year? And if the answer was, well, I don't know. Maybe you need to take more risks, more risks in the name of your dreams, and more risks in the name of growth. Question number four is what was the biggest risk you took that worked out? So building off of this risks thing, you have to show yourself that taking risks does work. It does improve your life. Maybe the risk is on trying a new diet plan when you've given up hope. Maybe the risk is going to a country you were scared of. You have to show yourself that things worked out. So reflect. What did you try new that actually worked out? And it was pretty sweet. Question number five, what did you ship?  Ideas don't matter. Philosophy doesn't matter unless you produce something in the world that produces fruit, produces results. And to be clear, what I mean by that is almost in a creative sense. What is something you wanted to bring into this world that you did? You know, it could be as something as big as a book. It could be you just decided to put a drawing of yours on the internet, on Facebook or on Instagram. And the reason why this is such an important question for me is because I always want to be in the habit of producing. When you look at the world, the people who are the most renowned, who contribute the most to humanity, and if you want to think financially, the people who make the most money are always producers, not consumers. Right? Who gets more money? The YouTuber that produces videos every single week or the person who watches them? The producer, of course. They have all these connections, they have ad revenue, they have products, they have books, whatever. It gets me in the habit of producing in my life. Producing could be producing results like in the gym. Producing could be a physical piece of art I always wanted to make. It could be starting a business. For me, this question is related to what are just cool creative things I want to produce in the world that add value to the world? Question number six, what were the biggest lessons you learned? For me, this is obviously a humongous question, right? I believe that the reason why we live the same life over and over every year is because we don't reflect on what we're doing differently. What do we have to do differently? How did I mess up? What do I have to do now to make sure I don't mess up again? That is the million dollar question and honestly, it's kind of the only important question, right? I said I was gonna get fit. Last year nothing changed. Well, I messed up. That's a fact. What had to happen differently? All right, you know, I said I was gonna eat healthier, but then on Friday night when I went out with my friends every week It was Buffalo Wild Wings and a bunch of beer. What do I have to do differently? Well, you know what this year? I need to do the non-sexy thing and track every day what I eat and drink. Maybe the lesson is something else like it was personal development related or self-esteem related. Just reflect back. What were the biggest lessons learned? Question number seven, what were three big personal development changes you made? Again, this builds off of the biggest changes, but I like to specifically ask three because it forces you to find three ways to improve. You know, for me last year, the biggest personal development change was not rushing.   I only have 30 minutes to do this. I only have an hour. But think about if you were to live your life 12 hours a day with that internal feeling of I only have one hour. I only have 30 minutes. I only have 10 minutes turns you into a nut job, right? That's exactly what happened basically last year. So think about what are the changes you have to make to you as a person because I'm a big believer that we attract success by physically changing who we are in terms of our mindset and our habits. That's a Jim Rohn idea. So think what are three personal development changes like portraits about you that you have to change to get better and along those three personal development changes question eight is What are three things you can do differently? So we kind of talked about things you can do differently already, but here go into more detail on what are a couple things You can do specifically that are going to be different. That will help you reach your goal Question number nine. If you did not reach your goals, why didn't you? You know, if you didn't save the money you thought you were going to save Well, why not? What happened? What were the things? Did you not track daily the habits? Did you not even set habits? Did you not review and reflect what was not working? Did some unexpected thing happen in your life? Somebody got sick. You got into an accident medical bills. I don't know What happened? So yeah, I like to use this a lot to try to figure out Well, what did I think was gonna work with my habits and now with the coming year? What do I have to do differently my habits wise? Because I obviously didn't reach my goals. So what am I gonna do differently? Question number ten. What are three things you want to achieve this year? So I personally always break my years down.  That's just completely a myth There's no there's no guarantee in life. And so what you can't control is what you do every day What you can't control always is the outcome. So that helps bring the focus back to today and that hating yourself If you're not reaching your goals Question 11 next year my perfect day looks like this. I personally in my Yearly and visioning document. I write down the vision of what my perfect day looks like because to me it's all about Engineering, what do I want to do on a date debate day-to-day basis? You know, it's not about for me achieving the goal so much like I get it when you don't have a lot of money You need more money. You need to reach that goal. I feel that a thousand percent But what has worked well for me is instead if I think about the day Just what is the average day that really excites me? That's more motivating to work towards than it is to say I want a million dollars I want to have a book or be a youtuber or have this great relationship Just thinking about the coolest day possible Motivates me quite a lot So I actually write out that vision of what I want the day to look like and then I begin working towards that and reverse Engineering it now these next four questions are what I call the God question round and it's all about some of the Deeper kind of soul questions about life if you want to go there So these are all about the soul or deeper questions about life if you're ready to go there They might blow your mind. They might blow your soul and change everything So question number 12 is am I deliberately on the path that I want? I'm a big believer that setting conscious goals is the most important thing a person can do But there's two words there conscious goals saying I just want to become a millionaire is not a conscious goal. Why? Why?  That's not a penthouse. How much is that 1500 a month? How much is my spending my groceries my car lease or my car payment and then like a nice vacation per year for $5,000. What is that cost for most of us? It's like 70 grand so conscious goal-setting is Really really really really being honest with yourself about breaking down. What is that ideal life look like and so to me? Am I deliberately on the path that I want is am I doing the life and the things that excite me? Am I going after my passions? Am I going after am I in this relationship because I really love the person and I'm happy or because I'm afraid of Ending it and being alone or I'm afraid because it's not the right person, but I'm still in there because That's scary to end that Deliberately being on the path you want is consciously thinking is this the life I'm trying to create and then having the guts to actually go for the life you want to create Question number 13 is my ladder up against the right wall now This is a build-off of number 12, which is ladder up against the right wall is am I pursuing the goals that I want? For my life in a conscious way again There are so many artists in the world that become friggin lawyers because they follow daddy or mommy's advice And can you imagine they might have been one of the most amazing artists or marine biologists or doctors in the world in history? But they didn't go after what excited them the most their intuition and their passions Can you imagine if instead everyone went after the thing that they love the most to do and that's not easy I know trust me. It is not easy. It's it's gonna be a lot of work, but Your ladder the ladder of success that you're climbing or you can are you climbing the right ladder towards the right goals?  Or your parents think you should are you really doing what you want to do? That's what this question is designed to help you think about Question number 14 gut check What does gut check mean it means? Removing all this intellectual masturbation What do I? Intuitively what does my gut say I should do next okay? That could mean For some reason setting goals this year you may realize you want to move to California from whatever the East Coast You don't know why it's just kind of calling to you gut check might say You need to end the relationship with a guy or the girl that you've been dating or married to That's what your gut may say Gut check may say you need to work less hours at work or else you're gonna kill yourself You're gonna die of a heart attack Gut check might say that the gut check is all about intuitively. What do I know needs changing in my life? No rocket science no analysis no personal development Just like this a role and we always know that's the thing we always know we know when we're so overweight We're a ticking time bomb We know that we're ruining our family life because we're spending too much time working We know that what we're passionate about sometimes, but we're too afraid to go after it gut check is put your gut on the table Put it on paper get it all out there and the final question here 15. Am I happy? That's it right. It's like at the end of the day. You still have to sacrifice You still have to put off things today for tomorrow. We don't live in a world where you can just focus on today But are you happy like do you want to keep doing what you're doing every day for the rest of your life? That's an important question to me. It's a very important question Do you want to keep doing this right? It all comes back to reverse engineering your great day and then building on to that Perfect day and trying to do that all the time. So if you're not happy, what needs changing? It's just supposed to be a self-reflective question Am I happy or am I not and again? You could spend all day intellectually rationalizing and going through it in your mind and Proconless, but at the end of the day, you know whether or not you like your life It's that simple and you're gonna know whether or not it has to change and what has to be changing on a day-to-day basis So that is the way I do my annual reviews and my quarterly reviews In fact, I build these into daily and nightly rituals, but the reviews are usually just monthly or quarterly and then annually And again How we structure our days is how we structure our lives right that famous quote And so if you can make today your masterpiece as John Wooden says the coach Then basically you can make your life your masterpiece And I think the only way you can do that is by consciously deliberately Structuring it to build out whatever life you want. So again, I included a worksheet there below Just click on that little link punch in your email. It'll send you that that's the easiest way for me to do that And before you go, I want you to leave a comment there below. Let me know for you. What is that? What's that? Let's just do one thing. What's the big thing you're working towards this year? Just let me know right there in the description and otherwise I will catch you soon Now to stay in touch come grab this free guide on my site It's a new weight loss and personal development challenge. I put together for this year punch it in there You'll get that with a bunch of emails as well. That's the best way to stay in touch Also, if you like this kind of daily ritual based goal-setting philosophy This is based on my book master the day You can see it in the description or on Amazon and if you send me a receipt to Alexander at modern health month calm I'll send you a free two-hour bonus video course. Alright, so go do that and I will catch you in the next video