This is covering the spread part of the Fandall podcast network We are coming off of a fantastic sports weekend with UFC 300 and the Masters Of course NASCAR in Texas too But it doesn't let up because the NBA play-in tournament is now set to begin tomorrow night A lot of fun there We're gonna break down the way the seeds broke down like down break down each team's odds to make the playoffs where we see Value over a Fandall sportsbook and Tuesday's games by talking to Tom and Vecchio today getting his read on This year's play-in. This is covering the spread right here on the Fandall podcast network and Fandall research My name is Jim Sonnis. I am a managing editor of digital media for Fandall research Join here as mentioned by Tom Vecchio check him out on Twitter at Tom underscore Vecchio one Tom Pleasure to have you on for today. How you doing? I'm doing good. Yeah Crunch time is finally here for these teams Really interesting set of games on both sides. I think the West is a little bit more interesting compared to the East I think we all know who's gonna be probably coming out of the East the West a bit more of a toss-up this year And there are a lot of fun teams in the Western Conference play-in as well So we'll talk about that talk about whether any of the lower seeds can advance and what we've learned from past play-in tournaments as Well by talking to Tom for today But first a reminder to make sure you're subscribed to covering the spread wherever you get your podcast coming up later on this week NFL draft thoughts via Connor Allen of 4 for 4 football. We're gonna talk to Tom on Friday It's about the Stanley Cup playoffs once those are all set later on this week all of Dinger Tuesday thoughts tomorrow here on the show So good week here on covering the spread and make sure you're subscribed to covering the spread wherever you get your podcast You can also find us on the fan dual youtube page and over on fan dual TV plus Now Tom will talk about this year's tournament here in a second But we've had a couple iterations of this NBA play-in tournament and I wanted to ask you What have been the key takeaways from you from those initial couple of tournaments? So you want to apply to betting this year's events? The takeaways are that we're probably in for a lot of unders and that's the trend that we've seen for most of these games and When I'm looking at the spreads for these first four games My initial takeaway was unders in three or four of them and that's kind of not necessarily an exact trend that we've seen But most of the games if we look back over the past few years are rather low-scoring So just I'll run through some of these quickly in 2022 109 to 104 113 to 103 115 to 108 Relatively low-scoring then there's one big game at 132 to 103 We saw the same thing last year where it's one away 102 105 116 105 109 and then 123 to 118 So I think you know when push comes to shove I mean leaning on the unders and that one game to go to the over would be Atlanta in Chicago Just because there's a very clear lack of defense when it comes to the Hawks So I want to start with unders with a lot of things and that may not be the most exciting But this is like prime basketball This is like the high-intensity basketball that we actually want everyone talks about all the regular seasons too long You know, how do we talk about a game in the middle of January and a Tuesday? How do these players get motivated for that? This is the time to be motivated This is the time for tough defense every possession counts more rebounds Lack of scoring like this is the most exciting time. So lots of unders to start things off Now obviously bookmakers know this too when you look at the totals for the opening couple of games We'll dig into these specifically here in a bit But 225 for Lakers Pelicans 223 and a half for Warriors Kings Two of seven and a half for Heaton 76ers and then 218 and a half for the Hawks and of the Bulls When you look at those numbers just first glance Tom Do you think the bookmakers are fully accounting for the intensity here or is there potentially still more value towards siding with an unders? I think times we've been accounted for again if this was a regular season game in December or January Golden State Kings would be in the the 235 range. It would be much higher We again, I've talked about the words before they've kind of gotten better as on defense as the season goes on And again with Miami and Philly would that be up at 240 in the regular season? No, but that would be at like 215 216 error. So that's definitely being accounted for I think You can potentially take liveovers. That's a whole different conversation if some games start off really really slow It's like at least teams aren't just gonna end in the game 85 to 82 So you can take some liveovers, but that's a different story So I would side with unders initially maybe take a live over it in Golden State Sacramento Maybe find a middle whatever might be Okay, so check out the totals see if there's value on the under towards you because as Thomas in the past does seem like the intensity does ratchet up here for sure now. Let's talk about some of the specific matchups here beginning in the West where the top two seeds are the Lakers and the pelicans they'll face off in the first round our first games on Tuesday Lakers minus 550 to advance the playoffs in the pelicans minus four fifth We can bet the yes or the no side for all these teams at Fandall sportsbook Tom When you look at the markets right now to make the playoffs for the West any Values to you at Fandall at the moment The value right now would be going with Sacramento They've the longest odds and it really comes down This is you know, everyone's got to make the decision. Do you think the Warriors have have run their course? Do you think this is the end or do you think that you know? Experience that they have for a decade of being in the playoffs and their core veterans Do you think that's gonna cause them to get or do you think the Kings learned enough last year by losing to the Warriors? Blowing that lead because if the Kings make the playoffs that means they have to a Win the game one against the Warriors and then win a second game So there would be value on the other side of taking a no for either Lakers or the pelicans So it's honestly a personal question. Do you think the Kings have learned enough over this past season to overcome the Warriors? So I do I think they do so my spot would be the Kings I would put like a quarter unit on plus 390 I think there's a good a good spot to target them whether or not it's the pelicans or the Lakers They end up playing against so that's a very very tough matchup as we would see with this one point spread So I would start with the Kings to make the playoffs What makes you think the Kings have learned and have the ability to beat this this Warriors We'll talk about the game in a second the the specific game in a second But what gives you the faith that they are a different team now than what they've been in the past so it's tough to say like last year they beat teams just because they would run up the score to 140 and You know this year I want to say that like you have to learn to win in different ways You can't just win every game 140 230 you have to learn to win games like 120 to 115 So like when you go through that process of like you have to play better defense while still being efficient on offense Because you can't just give away everything on defense and let them score 130 That's part of that has a lot to do with it You know also losing the leap monk isn't the best for them overall But just I'm not confident in the Warriors time and time again They wouldn't be in the spot if they were like some overwhelming favor Okay So we'll talk about that Tuesday game here in a second between the Kings and the Warriors But Tom does like the Kings plus 390 to advance to the playoffs in the West and the East It's the heat in the 76ers who are the top two seed 76ers minus 1800 to advance the heat are minus 590 right now in Fandals sportsbook So obviously that that game between the Hawks and the bulls gonna decide who gets a second shot here as well When you look at the east top any value stand out to you there As of now, it's probably no, okay You know, it's like you said, you know the heat and the 76ers They both get two cracks had to make the playoffs like I said at the top You know, I think we everyone probably assumes we know how this matchups gonna go one of these teams wins They move in they have a second shot. They're both clearly better teams ahead of the Hawks I would take either of these teams very clearly ahead of the Hawks the bulls It'll be a closer matchup, but if Philly somehow loses this first game I don't think anyone's gonna be on the bulls too much ahead of Philly Especially with them be back playing a full compliment a minute So the East is really straightforward as I said the West is far more interesting The East is kind of a stay away until we get the matchups for that real first round So I want to ask you about the Embiid thing because it was a bit of surprise. He didn't play yesterday Is that a red flag to you or no? No, no, it was it's more of just they, you know, they came with the win on Friday Things were essentially locked up and let's just call it what it is and as a Nets fan I can say this there was no way the Nets were beating the 76ers even with the 76ers B team and getting him that extra day of Rest he can rest so it was Saturday Sunday Monday Tuesday rest, which is great for him, especially, you know after the injury I'm not worried about that in any capacity Okay, so no value in the East as over and right now potentially some individual games at some point later on speaking of the games Let's talk about the first games which come up on Tuesday night beginning We got Lakers and Pelicans right now at Fandals sports book the Lakers are favored by a point in this game total is 225 What do you see in this game Tom in the seven versus eight matchup? Like I said more unders specifically, it's probably LeBron a rebounding prop. It's at seven and a half You know when we're looking at this type of matchup, obviously a literal back-and-forth game with the one point spread I already mentioned I love the the unders and basically all these games except Chicago Atlanta and LeBron Rebounds an assist prop is something I'm gonna be leading out. I'm not really on any points props I will say LeBron's point prop is I believe it's 25 or 24 and a half whatever's points prop is that now I will be looking to get under that moves up to 26 or 27 I'm not sure what it's exact exactly at right now If it moves to 27, I'll take the under on 27 and a half LeBron ending a game of a must-win game essentially Borderline with six rebounds isn't throughout that the Lakers need So that's how I'm looking at it. He's had great success against the pelicans this year. He's averaging over 28 points I'm not really worried about the points. I want to be looking at the rebounds slower pace They you know kind of turned up the defensive intensity, especially over the last month or so. I was high with LeBron Davis rebounding prop is I think just a bit too high at 13 and a half Right now that rebounding prop for LeBron is sitting at nine and a half or seven and a half rebounds over is minus 125 for this Lakers versus pelicans matchup I want to go back to our discussion about the unders because again, there are two paths to unders There is slow pace and there is intensity and there are missed shots, you know tight defense Do you worry at all about pace here or is it more about the intensity defensively leading to more mistakes leading to more Contested shots. Is that the reason why you tend to lean towards unders? Yeah, it's the latter more than the pace like the even with a slower pace like shots are still gonna get up It'll still be at even if they play super slow both teams will be at like 98 or 99 possessions per game So it's still plenty of opportunities for LeBron and you know his experience I think the the the advantage that they have down low like Jonas valentunas has not been super solid for the pelicans in the second Half it's gonna be I'm not gonna be surprised to see Larry Nance coming off the bench with pelicans alongside Zion Who obviously is fantastic, but I will just take a rebounding prop and what should be a lower scoring game Okay, so Tom is on LeBron's over rebound seven and a half the mark right now Fandall sportsbook with the over at minus 125 second game is pretty intriguing We got the Warriors and the Kings right now and we've seen this one move towards the Warriors It was a Warriors minus one last night. It's now waters minus two and a half We talked a bit about this matchup earlier on where it sounds like you like the Kings to advance Which probably implies some value on the Kings money line at plus 118 What stands out to you in this one overall? So like I said, I like the Kings to advance I like the under and while both of those are true I still think it's gonna be a very close game as we've seen, you know the spread be here I still think there's value in the Warriors side when it comes to player props And that's gonna be going to dream on green who I know can be a tough player to bet on for a lot of people because we're not Only worried about The game overall we're also worried about him getting ejected sure right and he hit He's been I want to say better in the second half of the season He had great success against the Kings last playoffs You know he played six games of that seven-game series. He's a player that is routinely pushing towards Either 10 plus rebounds or 10 plus assists. So it's the rebound plus assist prop for Draymond Green at 13 and a half Again, I like the Kings to advance But I still think there's value with Draymond at over 13 and a half when we've seen some of these recent games He's putting up 12 rebounds and just based on the size disadvantage When we're looking at some bonus down low for the Kings like Draymond has to have a big game He has to play this part in order for the Warriors to have a shot So I'm kind of I don't want to say playing both sides here because I like a player prop from one But I like the other team to advance but I'm just thinking about the game overall where if I'm leaning on the under and They should be operating in rational fashion. Draymond's just gonna do his thing as long as he doesn't get ejected It's wild that it's be such a big part of the analysis with it It has to be I mean like that happens, you know That's part of betting is that like that stuff can happen. Yeah injuries ejections This is all this is all something I don't want to have to take into account But we have we'd like we need to especially the player like Draymond who does have some history specifically against the Kings Literally last year. So as long as he's on the court for 38 minutes. This is a very viable mark for him to get to Yeah, what could possibly go wrong? Yeah, exactly, okay So Tom likes Draymond green over 13 and a half rebounds plus assists at Fandral Sportsbook over there is my is plus one of six That's in addition to the LeBron rebound over number over seven and a half That is minus 125 and also on the Kings to make the playoffs at plus 390 for the play in that is Tom Vecchio, make sure you check him out on Twitter at Tom underscore Vecchio one We'll have him back with us on Friday to break down the Stanley Cup playoffs as those shake down Tom Enjoy the playoff basketball until then we'll talk to you once again Friday. Thanks for having me. Alrighty again Fine Tom on Twitter at Tom underscore Vecchio one where recap last week's recommendations here on the show from the Masters You have C 300 and much more to round things out in just one second First it is playoff time in the NBA and NHL baseballs in full swing and Fandral is your place to bet on every game right now new customers Get $150 and bonus bets guaranteed. That's 150 bucks win or lose bet on everything from slap shots to home runs To slam dunks all on an app that is safe secure and super easy to use What are you waiting for? Download the Fandral Sportsbook app make your first bed and automatic win Fandral America's number one sports book Must be 21 plus in present and select states first online real money wager only $10 first deposit required Bonus issued is novel trouble bonus bets that expire seven days after a seat see terms at sportsbook.fandral.com Fandral is offering online sports waging in Kansas under an agreement with Kansas Dark Casino LLC gambling problem call 1-800-GAMBLER Or visit fandral.com slash RG in Colorado, Iowa, Michigan, New Jersey, Ohio, Pennsylvania, Illinois, Kentucky, Tennessee Virginia and Vermont call 1-800 next step or text next step to 533-4-2 in Arizona 1-88-789-777-7 over the ccpg.org slash chat in Connecticut 1-800-9 with it in Indiana 1-800-522-4700 is a chaos gambling health.com in Kansas 1-877-770 stop in Louisiana visit MD gambling health at Oregon, Maryland 1-800-GAMBLER.net in West Virginia 1-800-522-4700 in Wyoming Hope is here visit gambling helpline ma.org Or call 103-750-50 or 24 7 supporting Massachusetts or call 1-877-8 hope and why or text open why in New York Gotta go back through recommendations and last week here on the show having a time to go through this a lot recently Because we've been very busy on our Mondays, but do have time for today. Let's begin things with the Masters We have branding a doula on to preview the Masters check out Brandon on Twitter I could do a 13 of course can find me and Brandon on the heat check every Tuesday talk and that week's PGA tour event on the Fandral research podcast feed Scotty Schaeffler close things out at the Masters To get the win there. He was plus 450 to win which was pretty short But hey it was short for a reason so he got the win there the outrides brand and recommended were Xander Schaeffler 14 to 1 Joaquin even 28 to 1 Matthew Fitzpatrick 40 to 1 Tommy Fleawood 50 came pretty close Tommy finished inside the top 5 saw the gala 50 to 1 and Russell Henley 60 to 1 so shout out to Scotty Schaeffler for the big win there and Fleetwood giving it a good run with the t3 The regional bets did go well for Brandon. He had been on to be the top Korean at 3 to 1 That was a winner there on played pretty well I was hoping on could have gotten me a top 10 He came pretty close couldn't quite get there needed one more birdie from him It was close, but a good showing from Ben on regardless. He need does win the top Korean market at 3 to 1 Brandon also Ludwig Aberg as the top Nordic player and plus 1 35 and he almost won the whole dang thing I finished second there really good showing by Aberg. He's a lot of fun to watch He's a guy who says he's nervous, but looks like kind of a stone-cool killer. So excited to see what he does Going forward for the rest of this year too But winners in both the regional markets for Brandon in the round one bets Brandon had the Denny McCarthy round 1 3 blow ball plus 110 against Cam Davis and The a V Jagas and couldn't get the win there with McCarthy McCarthy. I think shot a 74 So 2 over on Thursday Cam Davis had a good round there and then also ruined the Adam shank round one match against Davis That was minus 110 so Cam Davis Put in both those to bed But good calls by ran on the regional bets again at Ben on top Korean 3 to 1 Ludwig Aberg top Nordic player plus 1 35 We'll have more thoughts on this week's tournament on Tuesday on the fan dual research podcast feed and Over on fan dual TV plus we had Austin Swain on a preview USC 300 find Austin on Twitter at a swing 3 and of course find him on the heat check as well for UFC every Friday Breaking down that weekend's card in the big title matchup We had Jamal Hill to win the money line there was plus 114 He'll dig it knocked out those so no win there other money lines for Austin went one-to-one He had Jessica and Raj to win it by to win at minus 140 and to the use of to win at plus 120 And Raj did get the win minus 140 one by split decision seemed like a pretty close fight there But they get the win there at minus 140 and then Yusuf was knocked out so no win there On the money line props for Austin. He had Charles Charles, Olavera to win by knockout or submission That is plus 240 he lost by a split decision there And then Yuri Prochaka to win by decision at six to one. He did win but by knockout so Couldn't get the dub there but did get the andrage money line find Austin on Twitter and a swing three other Austin Was also on the show can't call him other Austin Senior editor at fan dual research Austin cast find him on Twitter Austin cast We had him on to preview EPL match week 33 this past week He had the over four goals in Tottenham versus Newcastle at minus 108 and that one went to four goals I think Newcastle scored. I don't know. I remember tracking on my phone on Saturday But it was a four nothing victory so did get over three and a half goals there So winner at minus 108 player props for Austin He had Yvonne Tony to score a goal at minus 135 Tony did not play in this match So that one did wind avoiding get your money back on that one So no bet there final one was we see as to score assistant minus 115 in the Liverpool versus Crystal Palace matchup But Crystal Palace won they won that game 1-0. So No goal or assist for Louise Diaz there Crystal Palace coming through the big upset now Giving man City a pretty good run at being at the top of the table Big upset there. So no win for Diaz But check out Austin on Twitter at Austin Cass Finally for me I had NASCAR this week at Texas talked about a couple of top 10 bets on the show for a pair of teammates and They were both slow Austin Hill 6 to 1 Austin Dylan plus 850 Austin Hill finished dead last So no in there Austin Dylan at one point during this race is being outrun by two cars That did not have right front fenders and yet he finished inside the top 10 So Austin Dylan it did cash plus 850 for the top 10 there. It was a chaotic race, but also Based on past history at Texas and Charlie it kind of expect that so I think I actually modeled it correctly It resulted in a win for Austin Dylan also had Chase Briscoe in the betting guide on Sunday over at Fandor research So a good week overall Kind of bumps I had Michael McDowell and Zane Smith both of whom had a pretty good shot to finish and set the top 10 Couldn't quite get those because of They well McDowell wrecked Zane was in a bad spot as far as Fragi Ricky Stenhouse Jr. Same thing really fast car So I had some bad luck, but still cash two of the five Which I'll be happy about every time did get one out of the two here on the show as well Austin Dylan plus 850 for a top 10 comes through for us here That's all we have here for today on a covering the spread back with you once again tomorrow We're gonna talk Dinger Tuesday bets over at Fandall Sportsbook to celebrate that Don't forget to follow Tom Vecchio on Twitter at Tom underscore Vecchio want to find his work over at Fandall research I am on Twitter at Jim Sonna so you can also follow Fandall research on Twitter at Fandall research Want to thank you all for tuning in for today. Good luck to you with your Monday bets Enjoy the play-in beginning tomorrow. We'll talk to you once again tomorrow for Dinger Tuesday This has been covering the spread right here on the Fandall podcast network


Am I doing my thing now? Yes? Wow. It's an R being here. Hi, my name is Stök. Oh, no. Hi, my name is Fredrik Alexander. Most people actually know me more by my hackle hand than Stök. And I'm going to welcome all of you to my talk, weaponizing plain text, unscathed sequences as a forensic nightmare. And leading up to this talk, I was kind of told that you need to have this table of content that explains things that are going to happen because otherwise people get bored and really sad. But I figured that we got 281 slides to go through. So, screw that other thing and just head straight into it. Thank you. So, I spent a good of time of digging into this vulnerability class CB150 that's been dormant for the last two decades or so.  And that's what this talk is all about. But I used to travel the world to all these live hacking events and create educational videos on YouTube. But nowadays I fight cybercrime over at TrueSec.  So, I realized that I'm really passionate about getting log files because that's kind of the whole part of creating a good timeline. So, I figured that maybe I'm the only one, maybe some other people like log files too. So, I went on the application formerly known as Twitter and asked, are log files important? And I got a bunch of really good answers coming back. And the short answer is kind of like, yes, log files are important because logs are a vital component for maintaining application reliability, performance and security. But it also seems like the common ideas that logs don't lie, people do.  And what happens if you don't? Because imagine this for a second. You are now the incident response lead of a global logistic cooperation. It's four o'clock in the morning and you're sound asleep in your bed dreaming about boats or maybe containers into docker and stuff. When you get this rude awakening call from your manager that's pissed because you got breached. And since you are the incident response lead, it's your responsibility to call up all those tired people that work in the incident response team and get those starting with collecting all the logs that you need to be able to create a timeline.  You're happy. But just to verify that you got any data in there, you decided that maybe I should just cat the file and see what's in there. In the beginning, everything was great. It contains the things that you wanted but then suddenly out of nowhere, boom! You're getting an ad for a restoring service and they're nice enough to provide you with a calculator so you can do the math for how much it costs you.  And the reason for all this is it has to do with ANSI escape sequences and what got me all into this is this CVE here. And I was just going to read this straight out from my monitor because I didn't remember it all. Effective version of this package are vulnerable to arbitrary code injection. There we are interested, right? This is a possible shell escape sequence injection vulnerability in racks, lint and common logger components. Carefully crafted requests can cause shell escape sequences to be written to the terminal via racks, lint, middleware and common logger. Middleware, okay? These escape sequences can be leveraged to possibly execute commands in the victim's terminal. What do you got here with me? Excuse me, tiny sterk. What do you mean possibly? Either you cannot run arbitrary commands, right? Yeah. Thank you for that giant sterk for pitching in and helping out here in the presentation. Well, you're actually right. It depends, but it apparently depends on the terminal that you're using. And there's a shitload of different terminals out there today. And some of them come built into the software that you're using like BS code and Docker. Then you have like third-party stuff like iterm, kitty and other ones and stuff that people built on their own. They have the ones that get shipped within your operational system like Windows terminal, terminal.app, GNOME, VTE and other stuff. And then you've got all the stuff like external. So we also got this when we're in the cloud. Maybe you don't know this, but if you're going to try to use like a digital ocean to connect to your droplet or you're going to do some recovery console stuff, that is actually like an X term thingy connecting to that over TTYU, able to interact with it. It's a terminal. And I wasn't really interested in the possibly part. I wanted to execute commands in the victim terminals, but I had no idea where to begin. It sounded cool. So I did everything that every self-respecting researcher do. I googled what ANSI escape codes were. I had no idea. And I quickly realized that people actually like to customize their terminals in the weirdest kind of ways, especially if you're using ARC. And this is the thing that got me interested. Like, oh, cool. You can change colors and stuff. But I also realized that in 1978, the Gilstrand boys dropped their banger album. We're going to have some fun tonight. But even though it would release the same year, the VT100 terminal, and connecting that using serial cables to a big VAX system, it's probably not what those guys thought would be fun to do on a Saturday night, even though I personally would think that was kind of cool.  And it can do stuff like you can move the cursor around, you can remap the keys using these, and you can actually print stuff. Interesting. But you can also build whole UIs. Like, all this UI here is built in ANSI escape codes. Positioning of stuff, colors and output and all that, refreshing, clear screens. All that part of something called the control secrets and standards. This is a standard for X-Term and it's vast and it's super hard to understand. I know you're all super smart. I wasn't. So I'm going to go through the basics with you. And the first time I started looking into the documentation, it said CSIPM character attribute something, something. No idea what that meant. But it's this. So all it actually is is printing out something that turns into green. Cool. And the reason why this works is due to this funny thing here called the escape character. That's important to remember. And it's also non-visible escape character. And it comes in many shapes and forms because the reason why they didn't print out exactly the command is because it depends if you're using octal, hex, unicode, decimal, or ASCII. All of these are the same sequence. It's different kind of ways to portrait it. And I also realized that bash likes octal, Python likes hex, Java and JavaScript likes unicode and PowerShell likes decimal for some reason. And this escape character here is the one that starts the whole sequence. It needs to start with that.  Next one is the parameter, the number. So we'll go 32, which is green here. M is to change whatever continues output turning that into green, which is the string we have here. And then we're just going to close it off with another escape character, another control sequence introducer. And this is the important part. Here we do zero, M. And that means we're resetting the terminal back. Because if you don't do that, apparently this is going to happen.  Hulk smash. But we need to terminate this using a string terminator or bell character.  That is it being interpreted as the bell character. So we got escape sequence as being shoved in there. So I thought, okay, cool, that's fun. I can put color someone's screen. Fancy. What happens if I put that in something called a bad log and see what happens, and then interact with it. Well, if I'm using Vim, it's going to show the exact what the escape character is. It's this one here. And that's cool because rendering, it just shows it. Say for nano, if you're using that, you're cool. And if you're using a browser, instead it's going to show it as Unicode. So that's also interesting to know. It's getting interpreted differently depending on the system you're using. But if you cut it, colors are going to get displayed. Grip, tail, or get the same thing. Even if you curl it, boom, fun stuff's going to happen. Because all these systems interpret the sequence and renders it. And at this stage when I ran this through curl, I'm like, shit, what just happened? What just happened? And I started to think, where can I stuff this? Where that would interact with other people's stuff? So I figured why not do it in a text record? Because DNS is always the source for all e-bill. So I put it in there. And I ran this look up on it on OSX. Nothing happened. And you can see here, the extra slash in front of it means that it's escaped. It's beautifully escaped. This is a real good thing. If you're doing it on Windows, though, it's a different kind of story. So it depends on what kind of OS you're using. Big ups to David for showing that. That was real cool. So I was starting to ask myself, okay, cool, that's fun. But is this even a security issue? Seriously? So this kind of feels like this self-executing thing where you're like, okay, I can put colors on my terminal fun times. I need to figure out who would this be an issue for? Where would this be an issue? How would this be an issue? And what would be the consequences of this? Well, the weird wasn't that hard to figure out. Apparently, we had the common logger thing. Log injection would be the way to go. And who would it affect? I reckon DevOps, sysadmin, IR, forensic people, or anyone that interacts with a log file using a terminal. And we can take a quick break here. How many of you have ever catted, grept, or jqed a file that you parsed from some other software? I love you. So to do this as the scientist, we are researchers, we're professionals. Log injection when it builds is occur according to OAS, when data enters an application from an untested source. Yes. The data is written to an application or a system log file. Cool. I needed to adapt that. This is kind of written to do XSS stuff, so I figured that, okay, to successfully have this as a measurement, I needed to be able to detect new log files or events by forging a log. I needed to be able to inject the escape sequence. And I needed to somewhere for make that run in someone's terminal emulator. And I also needed that injection to execute some kind of stuff. And I figured which would be the best test bench for this? And Docker, obviously. Because it loves to send whatever logs to stand it out. It has this real log that's running through. There's actually a terminal rendering stuff. And it comes with a really nifty, getting started kind of app. Good stuff. I'll go for that. So, and also a way for you, if you want to attach or work with Docker, you would use Docker attached inside a terminal, connect to it, or Docker logs to do like a tail and see whatever happens inside your container. I'm like, mm-mm, seems tasty enough for me. But I also realized that I couldn't just take this print f thing and stuff it in a browser because, hey, shit, you can't do that. No, no, no. So I needed to URL encode it. And for good measure, we added a new line in there because everyone knows that if you're triaging some kind of bugs, new lines are very important to show that it's actually able to inject some kind of false log entries. So I figured why not see, let's see what happens if I curl this and just send that straight in. And I was really excited when I realized that, oh, nothing came back. Then I started looking at the log and over here it's like, oh, ho, nothing comes in, return in the response, but new line has been entered. The color has been rendered inside the log that's being displayed in real time, which means like on the first try, more or less, we checked all the boxes to prove it's a successful log injection because we're injecting new lines. We are enabled to run escape sequences that will be viewed in a terminal emulator, in this case Docker. And I'm able to inject commands that the terminal emulator could execute. In this case, we're changing the color. Because remember, even though that was the only line that I put in, we can create this because it's all about the limitations and creativity of whoever decides to design this.  They wanted me to provide more impact. So I'm like, okay, I can do that. I started once again, and I stumbled upon this great research from 2003 by H.D. Moore. And it found a really, really interesting cool way to just misuse the terminal and use it against them in a way. So what happens here is that they were able to use something called OSC2 sequence where you will actually put this on a command line and that would change the title of the terminal you're in. And if you're currently like using a terminal, you're changing directories and stuff, and it just updates there inside the title that I've seen that we're connecting to shell it changes it. That is actually the sequence doing that. But that wasn't enough. They digged into the deeper parts of the whole documentation and realized that in this CSI, CSI code here, 21T, you were actually able to report back whatever was put inside the title and push that to the command line. That could only mean trouble. Because even if this stuff would be put on the command line, and in this case, you needed to have a social interaction with the user. The user needs to be fooled into pressing enter.  But that's been fixed for ages. 2003, if you want to feel old, is like two decades ago. So I started searching some more and I found this really nice write-up from Evil Alive Jekyll and Aske that did some cool research on all these different web servers back in 2010 where they're using the same kind of sequence here. But we know that's been fixed, so can't do much with that. But then in 2022, Evitar Gerzi released some story for crashing the name, don't know how to pronounce it. A cool way to create a DOS sequence when they were able to read a bunch of stuff into the title and just creating crashes. And I'm just tasting buffer overflows here for the future to come. But that's been fixed, too. So here I am, feeling like an epic fail. Can't do the arbitrary command injection. That seems so cool that the person talked about in the CBE. So I did the thing. The thing at the end is the only thing you do. You reach out to the original poster and ask them, can I ask the RC park? And the answer back, I didn't write any. I used this paper as a reference.  So here I am, super excited, but all I got is old stuff. And speaking about old stuff, this is what I looked like in the 80s. Now I'm kidding, I'm probably more like this badass here. And if you look at the angle of the arm here, that's very important because it's exactly the same angle as this gentleman here in this band poster.  And not only that, he's my dad. So I'm very grateful to him to put stuff and give me access to computers at an early age. Thank you. But I'm starting to look at this picture. I'm starting to realize that I'm actually, maybe I'm looking more like Lars said that what's on the same tour as my dad when he met my mom. Anyway, the standard is vast and he's deep and he takes a lot of things to go through. But that wasn't enough for the fine developers and users of terminals of today. No, they wanted more. Because the oldest different terminals have different kind of functionality. And you know, with more features, we need more stuff. So they invited something called proprietary escape codes, which is a local edition of the standard. It works in certain terminals, not all of them. Some of them are being shared internally and some work over the whole bar. And what that does is gives you the opportunity to, you know, make it fun, twirl a thing, maybe in your title, get notifications and all these other cool stuff that's in there, maybe even change your background, fancy stuff. But they some thought that it was a great idea to always run some processes with arguments. Why not using escape sequences? I mean, that's a really bad idea. But luckily enough, it's just rare to find stuff that runs a really bad idea to nowadays, because it's old and it's been fixed. So I needed to find something that was like adapted by everyone. Everybody loved it and trusted and they thought it was nice that we could weaponize. Why not? Because we are tricksy hobbit sisters. And I found OSE 8. I'm not cool. If you ever run PowerShell and you mess that up, you'll get this prompt coming back, say, you suck, click this link and somebody's going to tell you how to do it. I'm like, cool. That seems doable. And the reason why that works is because you have this answer escape sequence that gives you the HTTP thing and then it has the title or whatever you want to print out and you close it off and it turns into this link inside your terminal. That's great. Initially, that was only allowed to use URI like HTTP and HTTPS. But recently, the fine people over at Windows terminal decided that we should allow file 2. That's even a great idea because what could even happen if you typed in CMD there and clicked it? I wonder. Fun things pop in inside user space. And even though this is kind of filtered in a way where you can start CMD but you can't use any parameters, I'm willing to guess that some smart person in here are going to figure out how to bypass that, put a link in in pop shells. It's definitely doable. And the fun thing with OC8 is if you don't terminate it correctly, you remember what we did with the green when it all went hulk everywhere? If we don't terminate it correctly, the rest of the output started from that injection is going to be one big link. Everything is going to be a link and if you click that, some terminals will be very nice for you and just block that out with a warning. And I'll figure that. Okay, that's cool.  So what happens if I put that inside Docker? Well, everything is going to turn into one big link there too. And that one has a protection in. But it's not everywhere. This turns into a protection because the injections can be put in different places and then suddenly you can click links and you can use the manual and how fun this could be. But that wasn't enough for people because, you know, text is cool, but inline image support, that's definitely something we need in text space. So the Windows terminal people that decided to adapt the inline support for it in the recent build where you're able to do you have six cell and inline support inside the terminal. That's great. I see no problem with that. I think that great. I just wonder what's going to be inside this log file. So can I get a raise of hands when many of you wants to see what's in that log file? I love you. And it's not what you thought it would be.  There we have OC 52, which is great. If ever use T marks or anything and back in the days, you weren't able to copy paste between shells sucked. Now you can. The reason is OC 52. And what it does is that it's take this sequence. If you have something base 64, 64 coded, it's going to put that inside user space clipboard. Super sweet. Great. I wonder what happens if we do open a something calculator app and a new line on the end because we need that new line. If you put that into CSH and paste it, this is what's going to happen. It requires the users to do something. And you press that boom. Okay, it pops calc. But if you do the same thing in bash, bash honors the new line. So if you just paste it straight in there, it fires it directly. There are room for improvement here, though. So I figured I wonder how can I test this in different spaces? I did this kind of basics for string with these commands in it and said, I'm curious what's going to happen. And I started to paste that in different places. Docker that fire directly about that was nice. These code it did it differently depending on what kind of shell you're using. And even in some cases, gave you this warning, which is super good. Of course, with your own people. Terminal app honors it runs it directly. And even inside Windows terminal, you will get even this preview of showing things that are bad.  So why not just add seven lines of nothing and see what happens? Well, it's nothing in there. So and we everybody knows that nobody's going to scroll down. And what happens if you add 400 lines in there? Nobody ever going to scroll down. Or you can even in this add some kind of those ULA things, then people just press okay. So with that in there, it's going to case just running it. I think that's pretty cool. It's a decent thing. So I think it's okay. So I have this sort of thing for Windows terminal getting one for bash. Let's create a polyglot and see what happens. So I figured that why not have a little bit of an SVG in there. You stop that one off with a good old hash mark at the end, do a curl command.  So and then we do a power shell kind of mix where we do seeing CMD the cost power shell and stuff because they wanted to work in whatever kind of environment you end up in. And we want to ex filtrate stuff to know what's happening. So here's hash that's important and then eventually this last one here. And code that into one big basic support thing and just send that to bad log, cat bad log and then start pasting it in places. Well, it obviously worked there. This removed all the info in the beginning. It's going to pop here too. And even if you go to the browser, you paste that in. You have some JavaScript running, which is great. Then you can just refresh it here and you'll see that, okay, it's running who am I and then different other kind of stuff in there that's just ex filtrating stuff for you inside the request. And this is just being dormant in some poor bastards clipboard by just interacting with the file.  It's not limited there. Obviously, you can extra tree stuff like sending things out and do reverse shells and all that. I didn't go through that in this demo. You are smart people. You know what to do. But if we're doing this, we might just want to hide our tracks or just mess things up because we can. And there's different ways to do this. You can do use everything from just moving the cursor to certain precision. You can clear the screen. You can erase stuff or clear the scroll back buffer. And to showcase this, I'm just putting like 50 lines here on the screen for you. And then we're just going to run the command and it's empty. And that's perfect to have a proof of concept of myself. But what happens if we run that inside and say this Docker instance that we send in the reset screen and just go back? Well, this is what's going to happen. It empties the log file for you. And every time you load it, all the way up to that's getting rendered, it's going to clean it anyway for you. So you need to sanitize and clean that out. Fun. And that is somewhat annoying. Before anyone that's using that that's really annoying. But it's not annoying enough. We need to do some brick stuff to really be annoying. And why not use the standard? Like we have this print screen functionality. We gave us the opportunity if we're typing that one in it will send in the printer prompt for you. Imagine getting that every minute or so. It can be annoying. But you can also do this cool thing. If you instead of doing the zero I, you can do five I because back in the days we used to have a matrix printer next to our computers that are like having a paper copy of said log. We don't have those anymore. So we can just send anything out to this buffer that doesn't exist, which means as you can see here, if you send it in all the commands, it's going to send it into Ruby and it's still going to render.  So that's really annoying. And it's the only way to get rid of that is to close the browser. But it's not annoying enough. No, we need to be really annoying. And one way to do that is to use the mouse tracking functionality. It was great if you ever like install some kind of, I don't know, slackware or something or whatever. And you're in that CLI mode and you suddenly realize my mouse works and I can click on stuff. That's cool. That is the reason because somebody's tracking what kind of where your mouse are in that state. And if you run that on the terminal and move your mouse around, it's going to report all this stuff all the time. And if you click it's going to execute whatever kind of happened there.   You can just combine those things together and just create a lot of interesting stuff. But let's stumble upon this one here. It looks so sweet. And it's perfect. Repeat the the preceding graphic character X amount of times. And that is perfect. You want to measure like how big the terminal screen are. And so in this case, let's see that we wanted to repeat this 10 times. It's going to do it 10 times for us in the output of the terminal. But one simply wonders.  And since this is not a single character, this is unicode. You get five characters for the price of one. And my recommendation to you is to do not run this in prod. Things will break. I can't open this Docker container again without it crashing. And when it crashes, it kills Docker desktops. I need to start it all over again. That can be somewhat annoying. Thank you. So it breaks most terminal. And some terminals, even like the one I have on my phone here, it crashes that one. So it's just a, once again, I'm starting to think, OK, that's cool. I wonder what happens. What can I do to weaponize this? Maybe if I put it in my service signature on a host and then request a let's encrypt certificate, I wonder if the bots will come running.  Real fun. OK, you've got a Christian, scary looking kid. No RC. No, no. I know. I wasn't able to do any kind of arbitrary command addiction. Sucks. I got malicious stuff and not really bad stuff. So these were dark times in the middle of my research. The light came in the shape of David Leadbeater.  Sorry, part of my French. At Blue Hat 23, called Houdini the Terminal, where he doesn't provide just one. No, he brings on six remote code executions in terminals that are live today. I'm like, mm, tasty. David, no stuff. And he's doing that, but I'll use kind of the same thing that H.D. Moore back in the days with this CRLF injection. But he's using something called Device Control Request String. I'm not going to try to pronounce that. Dekrush. If you want to check out his G3po, he's really, really good. He's got a lot of cool stuff there. And he's speaking tomorrow here. So please go visit that talk. I sure am going to be there. And the Yield Sunboys is definitely going to be there because he's going to release some banger stuff, and you don't want to miss that. So this is all David's work, but I'm going to show it now because, hey, why not? So I figured that he had this thing provided. I needed to put that in a way that I could infiltrate other. So I basic for the string here. More or less, this is kind of what it does. It sends in a bunch of control sequences and stuff. I'm not going to bore you with that, but more or less, what does it ask you? What kind of color you have on the screen. But we're feeding that with other stuff instead and then adding new lines and voila, about fun stuff. So if you're using version of 3.17 of iterm, which is not the newest one. It's been patched now. And you're interacting with the logs using this docker. What's going to happen if I paste that inside your terminal and you're running that live tail? I'm going to pop calc for you. Why not? Super simple way to just make sure that things break. So update your items, people, if you're playing around with that. And the reason why this is working, and I love this, is simply because what David figured out is that he could sneak in X03 here, which is control C kind of thing, or control X. So you're escaping out of whatever thing that's running. And imagine what happens if you're trying to escape out of a docker attached sequence. It's going to shut down the docker. And after that, we're adding whatever command that we want to run. And then simply, we're going back again and tells the system, could you please report back for us whatever kind of color that we're running? But we already tainted that with other stuff. So it's just going to boom, which is great. And for me, David was this kind of Mike Metzger moment for me when he did that stuff.  And nobody thought it would even remotely possible.  So that was kind of the opener. So I started to look at this OSC 5113, which I thought was like, hm, Kitty has this proprietary escape code. I wonder what that does. And what I figure out real fast is that test here reflects back in the flow. So I'm starting to think, what happens if we add a new line and open a bit of calculator there and send that away? Well, let's see what happens. What's going to happen first is it's going to give you a request.  You say, no, but you got a calculator. Because he's adding new line and he's honoring them. Time is running out. Thanks, babe. The other one here, and I know you said, yeah, but you pressed no. What happens if you press yes? Well, if you get out, it's the same. No escaping here. Yields time, boys.  I thought that was sweet. So now I'm getting hyped, and I'm all happy about it. Then this shows the whole proof of concept. Is it actually possible to execute commands in the victim terminal? And the short answer to this is yes. But whose fault is it? This conversation has been going on for like the last 10, 20 years, because every 10 years or so, somebody's going to poke around at this stuff. And they say, and the terminal developer's going to say, it is the developer's fault.  The app people say, no, it's the terminal people. They need to stop using escape sequences at all. It's a terrible idea. But we all use them all the time. And then this is the third part. It's these super angry old developers are sitting in the back. I see you. That thinks that everyone with a brain knows that you can't just cut a file or click on an email link. But that's simply not true, because we are a cybersecurity professional, some more malicious ones. And we need to protect our users, especially our shell users, because they are also our privileged users using these systems on a daily basis. And they should be able to grep cat, or JQ, whatever shit that's running inside the terminal without any issues, especially if the downloading files from a third party took care of them. And the only way to do that is that we need to sanitize our input and escape our output. And if we don't do that, it's going to be consequences. And I think that we're kind of cool. What happens if I took this web page and stuck a bunch of different kind of escape sequences in there and see what happens? So I created this evil.terminalinjection.com site. So if you curl that inside your terminal, any of them, you can see what happens. It's not going to do anything bad stuff for you. It's going to pop a calc if you're vulnerable, but I'm not exfiltrating your data. You can just right click the source and see what's in there. It's cool. And if you run that on some systems, it's going to be all right on other systems. When you do it, it's not going to be as such a right. So it's kind of trusted things, but they would break stuff. So if we're doing black box testing on this, the whole game, if you hunt it for bugs, it's going to 400 or 500 errors. Because 200 errors usually ends up in access logs, and those are well sanitized and nice and all. So the easiest way to do this to break stuff is to take whatever kind of thing you have here. This is an API JSON request. You have a key and some value stuff.  Sometimes it will break, and you will get some information coming back. And if it does contain something like unescape stuff, because this one here is a big chance that it actually ended up in the error log, this one here, though, is properly escaped. So it's a good job on the devs. But yeah. But sometimes you put that stuff in, and it's going to sanitize with a backslash. So why not put some invisible characters and hex in there? The result is going to be really interesting, because then it might just render anyway. Because you're bypassing the whole backslash scenario. OK, this is very prone to false positives. So sometimes the developers are really good at just filtering the kind of output counts out. They're stripping the error message. And they're even not displaying any data. We saw that in the beginning. It was an error, but nothing happened. But it smashed the log. Boom. So even though you need to take that into consideration, and even though if you see like 400 errors, they're rarely logged. So 500 errors is what you're going to be looking for. But this seems to be everywhere. Everywhere I looked, it just pops and scrambles. And before you create this nuclear template and go all burr all over the internet, hoping that it's going to end up with somebody's log somewhere, to verify this, you will need to have access to the access logs. And just dig into that, because otherwise it will be false positive. Because if I wrote the logging system and I didn't log in the output, you can say that it renders, but it's not. So time's running out. Let's recap real fast on this. People forget. The old is the new new. There's way more things that's going to come in this area. I hope you are intrigued now to start poking in this. And let's create a community around this to see whatever fun stuff we can do. And it's like everywhere. Like I told you, I created this nuclear template. And when I ran it, it rendered in there. That can be problematic.  But by tomorrow, if somebody decides to put a bunch of creativity in it, that means your log files, do you still trust them? I'm at Stöckfried, all social media. Thank you for attending my talk.


So here's the dreaded task. This is what I like least about pastel painting, is putting the pastels away once you've worked on a piece or two. And these are just my little tray system that I use. I have a few of them, but if I end up filling up more than four of them, I typically know, okay I really need to put these away. I have a pretty decent supply of pastels still in my my working pastel palette or workshop pastel palette, but I really do need to get some of these put away and cleaned. Okay, I don't I don't always focus on cleaning them because I sort of clean them if you've watched my videos on the side as I work if I have a dirty one, but sometimes I just get a little too dirty and I need to clean them. So what I'm going to do, I thought this would be a neat opportunity, why not maximize my dreaded time and spend some time with you guys, hopefully helping you with a lesson that that will help you guys out. I have a video where I have talked about the color wheel and what is warm versus cool. This is something that I discovered in one of my past videos. I wanted to really be able to just describe the color wheel and warm versus cool colors. So I found an appetizer tray, as you can see I've moved them out of here for now, but it was the perfect way for me to arrange the colors families in this appetizer tray. But what I'm going to do today is use the color wheel just to kind of have a little test. So let's get ready and have some fun with trying to let you guys guess what is warm versus cool while we put away some of these pastels. So let's get started. So what I typically do instead of taking for example like this little palette of colors here and walking over to my collection of pastels and going okay let's see I've actually I've cheated here I've actually already I've got a habit of arranging them in color families so that when I go to put them away it's just a lot easier than here let me find one that's mixed up. This one here is a little bit more random instead of going oh let me go to my yellow and oh let me go because my pallets are kind of far apart. So it's a lot easier for me if I just go ahead and gather up pastels of a particular color family such as these here and I'll kind of work with them arrange them I put them back in the tray and then I go to just the green section it's a lot faster for me than going back and forth from one end of my pastel palette to the other. So again this is a great opportunity for us to determine cool versus warm colors and yes you can have cool greens and warm greens you can have cool blues and warm blues I know that sounds crazy you can have cool purples and warm purples so what is that and how do we determine what is what well it's not all that hard with our color wheel we can kind of see the fact that it's arranged in a circle is really beneficial let me see if I can zoom out here just a little bit all right I got my little kitty cat down below me she's about to knock my easel over or my tripod over okay so let's divide this color wheel into two sides all right if you were to cover up this side these are going to be more of your warm colors okay the reds oranges and yellows most people know that that's pretty easy right this side over here is typically I'm going to even cover it up even more it's typically more of your cool colors blues and now we can see where we got greens and purples even on that side too so how do we know which we're working with greens now so let's just stick with that which greens are warmer and which greens are cooler well if we think about our divided color wheel here's here we are on the red orange yellow side if the greens are real close or closer if you thought of this like a choo choo train if they're closer to the the cars on this train okay they're going to be warmer as they start getting further away from the warm side they're going to get cooler okay so that's what we mean when we say cooler greens all right and while we're at it we can do the same thing with the purples we're on the warm side here you go with these little train cars here these are closer to the reds and the yellows the warm side so these are going to be more like warmer purples and these will be your cooler purples okay that's really not all that hard is it so if you can make your mind think about a color wheel and how far or close is it to the warm side then that's going to help you a whole lot in determining what colors are cool and what colors are warm all right so let's get started on dividing these out and I want you to study this real quick all right if you were to instantly look at what you thought were warm greens okay once again closer to the yellow side okay these are going to be your warmer greens so let's take a look okay that's pretty easy to tell right we've got some warmer ones here here over here I'm looking through my glasses and through my camera so it's a little harder and I'm also going to go ahead and throw in here not just warm versus cool but warm or high chroma versus neutral okay and all that means is a high chroma color would be something I don't have a ton of them on here but these have more color to them see how they're brighter this one's a little brighter here it's not super bright let me find one that's really bright here is a high you can identify that little baby easily right that's pretty high intensity in color and that's going to be more of a cool cool green or you could say a warm blue all right so let's not get too crazy with that but the neutrals in here are the ones that look a little bit more dead I have a palette of mine where I just keep my neutrals because neutrals in a painting really are going to make your color stand out more you don't want all high chroma intense colors in your painting if you had all of that it's just going to be too busy and nothing's going to make a statement okay so but let's go ahead and get started with this so pretty quickly I'm going to divide these up and you see if you can agree with me on these I'm going to go warm cool for greens and neutrals okay so let's get started here all right we got a little bit of an idea going here some of them are so dirty you can't really tell what color they are oh no look at that I did have one that was more of a high intensity or high chroma color in there man what a difference it makes when you clean these little babies off but obviously this one is more of a warm green because it leans more towards this yellow side of the color wheel or the warm side of the color wheel right so now we can see that some of these a lot of these are darker greens down in here and you can see that they're cooler and darker this one I actually should have put this one kind of up in here these are kind of more of my neutrals you see how they're kind of like dead looking this one's actually a really dark dark dark green it almost looks black that I like to keep in there these are I mean they lean a little neutral but they still have a little bit of color to them that was just a little dead looking but this is still a nice it's got a nice color to it and I don't know how these are coming out on the filming but um so yeah again I need to clean these off so you can actually see these colors better let me do that real quick so you can see them better okay and the way I typically work is I I like to arrange my palette according to value so I usually go with my lighter values I just I'm in a habit of doing that up to my darker values alright so that's kind of how I do that so now we've got our our neutrals I'll do those kind of in the middle these are the same this one's a little different yeah see how that's darker you can't really tell until you put it down there well actually this one's lighter I should have put this one down further in here right in here it's about the same as that one we've got this one look at what a pretty color that is I like these neutrals alright so we've got kind of our our neutrals in here in the middle there's my dark and now again I've got a whole lot of these dark teal cool blue colors going on over here that I grabbed from various palettes and they're so dirty I'm having a hard time figuring out what colors what but this one's actually a lighter value here darker here this one's probably about the same yeah and this one's probably gonna lean more down a little bit lighter than those okay so we've got our our worms our cools and these are all mostly darks and kind of our neutrals this one's not a super neutral this one kind of leans over in here a little bit it's a little cooler this one's a little cooler than for example that can you look how much you can tell the difference when you sit it right next to each other I mean that is very obvious that this green is cooler than this green alright but this green is warmer than this green okay because it's got more yellow in it and that's all color is one thing that does help you as a past dollars even though we don't mix colors a lot together like an oil or acrylic or watercolor mixing colors helps you understand this warm and cool principle better because you know that if you've got a cool green and you add some yellow to it it's gonna make it warmer alright so so hopefully this helped a little bit I'll I'm gonna give as much instructions with the other ones that I do but I'll speed it up and you can kind of see me arrange them now what I'm gonna do is I'm gonna just put these back in an empty tray take them over to my working pastel set and put them all away after I kind of clean them off and everything alright so now I'm gonna do the other colors for you to see me dividing them okay wow look at how many blues I collected over my past few paintings and I wanted to allow you to see a little bit of the other palette that I had down here or palette this other set of pastels that I'm working with to put away so that you can kind of see how the warm and cool works with the next color family of the blues now you can see that actually some of these are falling in over here they're kind of those cooler greens you can call them a warm blue or a cool green okay cool green because it's further away from say the yellow would be way down that way and these over here you can't see what I'm pointing at these over here are closer to yellow the further you get away these are becoming more of a cool green okay but the blue would be on the opposite side of the color wheel the closer you get to the worms the yellows you're gonna have a warm blue so you could call these I haven't finished arranging these but these in this family like these could be either cool blues I'm sorry cool greens or warm blues okay so I'm hoping that's making sense to some of you guys it all has to do with the relation of where it is to the warm side or the cool side of the color wheel so I'm gonna arrange these real quickly and hopefully you start figuring this out okay so now you can hopefully see how the blues whether you want to call this a teal blue or turquoise type of colors are closer to the warm side where the yellows are okay so they're gonna be well they're gonna be cool a warmer blues but they're going to be cooler greens I really hope this is clicking for somebody you know what I'm gonna do when I'm done with this I'm gonna put them in my divider tray and you'll be able to see easily what I'm talking about here all right so now the blues this is the set of blues okay the blues that are getting further away from the yellows okay they're getting even cooler okay so these blues in here are cooler than these turquoisey blues okay they're further away from the yellow and now these are getting even cooler now what happens is because the color wheel makes a circle okay that went all the way around these colors are going to start leaning more towards purple because what do you get when you mix blue and red you get purple okay so these blues are getting more red in them okay they're getting closer to that red side of the color wheel so these are going to be your warmer blues I happen to love one of my favorite color is a like a prim rosy type of a blue it's like just that neat little cross section between a blue and a purple it's so beautiful to me so so hopefully these little laying these out this way is helping you understand the difference between warm and cool I know the last video I did it's been a lot of videos back but when I used this appetizer tray color wheel I had a lot of people so my goodness I finally get it but I still have a few of you commenting on now on trying to understand the warm versus the cool okay so now we've pretty much got our blues I mean typically we think of blue was a like a blue like this you know or maybe like this just like a pure blue I always have a hard time finding like a pure blue because I I always tend to see what other colors are in it but um but now you kind of see where is it leaning towards on the color wheel and you can understand warm versus cool all right let's do another one okay so here I have the purples that would be if you were looking at the color wheel we just did the blues my color wheel is backwards we just did the blues if you add more red you get to purple ignore how I should have this going the other way okay so we still got which one of these has more red and which one has more blue okay so see if you can look at these and see it's pretty easy to see that these will dark ones I love these dark darks these obviously have more red in them okay this one has more blue in it than this one let me let me make a mark let me do one with a little closer and value actually don't have one just the same value but let me make a mark of this one and then mark this one this is still a purple a lavender but it has more red in it than this one so this one's more weighted to the blue I think this one actually is a blue it's a dark dark it's kind of like a dark green that needs to go wherever there again you can't tell till you this is a dark I think it's the eggplant Terry Ludwig eggplant it's very dirty you can't see it but it's like a it's almost like a black and it's going to be probably a little more like in here all right so let me go ahead and just arrange the okay are you kind of seeing how these in here are closer to the blue and these would be closer to the the reds first before we get to the reds we're going to get a little bit more of a pinkish tones in here so hopefully that's helping a little bit I actually had more purples in another tray so maybe this would be a great chance for you to kind of see where you think they go how about this one here this one is one more it's more neutral than some of the others okay so it's it's a little blue but it's it's still got some red in it too okay so it's it's kind of in here maybe all right how about this one it might be hard for you to see these where does it fall let's move them it's not quite as blue this one actually needs to move over a little bit over here it's probably kind of like right in here somewhere it's got still got some blue in it you can see it's not compare that one to that one you know this is definitely got more blue and this has got more red okay how about some of these are kind of the same this one yeah I got a lot that are kind of this one's in the more reddish this one's more blueish okay a little darker in value right in here another one you get the idea I'll just start putting these away now whoops can you see here these two it's on the wrong side it's pretty easy to see this has more blue this has more red okay so this one is more over in this side okay and this one here it's a this is a nice purple it's kind of a nice in between purple okay it's not really red and it's not really blue alright I think that's it in these except for this really dark dark one I have okay so now let's move on to the pinks all right so here's most of the pinks I have I had in my leftover pastels from painting so I'm gonna scoot it again a little closer here to the Alexa I wasn't talking to you Alexa what's your name sorry let me ask your question Alexa what's your favorite type of art there's nothing better than depression is nice she's got my vote of approval okay now I'm going to arrange these now what are we doing here we've got purples over here or blues that have more red okay and so which way we're going closer to red but we still got the blue the ones in this section of pinks they're gonna be closer this side are gonna be the ones that have more purple in them purplish blue the ones that move this way are gonna have more red in them still moving away from the blue to the red okay so let's see here I would say let's identify them pretty quickly here I can see that this one has more red in it here this one right away I can see has it's a dark dark kind of reddish this one too but still a little purplish oh that's really dark okay see this one has more red can you see it in it and this one too all right so they're going to be more over here we'll still try to do them according to value I hope I have my who these are these some of those little neon colors that I really like these by the way are tricky when it comes to value take a picture of them they're usually darker than you think take a picture of them with your camera with next to some other pastels convert it to black and white and you'll be amazed at how how much darker they are or darker than you think okay this is getting a pink that has some more reds in it we love that color so that's salmon color in that pretty now let's compare this one to this one you can easily see how much we clean it this one lanes probably of all of these this one lanes closer to the red okay that's a red all right orangey red kind of okay see it next to that one whoo you can see all right so what would these be would they be warmer reds or cooler reds I'll let you think about that for a while I love this color oh look at that I'm running out of it and I can't remember which pastel company made it think this is the same yeah I tend to grab that one a lot this is a lighter value but darker than that it would fall in between those that one would be there these would be here this one would be here sort of getting the idea it's tough for me too sometimes so general idea there okay can we see how these reds lean more towards the blue they these are starting to get to where they have more red in them you can just see it you know more red less red okay and how it can be tricky sometimes but hopefully this is helping it just became pretty obvious that I don't use red as much as I use other colors because I don't have as many to put away but I'm gonna add them right here real quick but I just want to show you how we've been working here we were at we started with the greens the warm greens we moved through the greens we've got cooler cooler greens got to blue started to get our blues getting a little warmer warmer warmer because the blues are going this way and now we're starting to get into our we got into our purples that have more red in them now we gradually got into our pinks and what that division we just saw there was kind of between the pink and the red here so that's where we're moving now we got out of the pinks okay because all of these lighter values of these are all going to be in the pinks okay so now we're going to get into the reds and the oranges all right so let's get started on those okay so what have we got here we know that the yellows instantly are going to be further this way okay so let's go ahead and move these yellows again they're dirty I can't even tell what they are so that's one hard time placing them it's a little lighter value this is a darker value than that okay so we got our lighter value here darker one here here's the lightest yellow for sure it's down here let me move this up a little okay lightest yellow okay look at that buttery yet lemony yellow that's so pretty okay then we've got more of these see how that one's darker okay we got this one's lighter I think just just these are close but think this one's more like in here and that one's there yeah okay now this one is like it's got a little more orangey so it's a little closer can't get it even come off yeah this is orangey this is similar to this one here and it's so dirty I can't get it cleaned off but it's more orangey okay so and this is more like a mustardy kind of a yellow I like that that's a nice nice pretty yellow I love that okay and then just so you know what is a dark yellow hmm what is dark yellow it's a brown that's really what dark yellow is this is brown okay so here's our more of our yellows and these lean a little more orange what would be the oh my goodness how did this is even hard for me sometimes the coolest yellow would be moving the yellow that moves furthest away from the worms okay so these are going to be warmer yellows because they're closer to the reds the cooler yellows are going to move more towards this area they don't have as much red in them so of all of these this would be their coolest yellow okay it's not as orangey as say for example this one right here you can see a little more orange in that one right there okay alright so now we get these are the funky ones these little peachy ones these are just kind of a paled out oranges okay so we've got those this one we can see is really one of the only true reds that I had you see that red there if I pulled these back over here okay this one is more like if I had a whole bunch of reds if I'd have been painting a whole bunch of poppies this is where they would have ended up in this red section right here okay but I don't have a lot of those this one is a red but um it's uh it's not as bright red as that one okay so it's kind of in here and these are all kind of like brick reds okay so they don't have quite as much yellow in them as some of the other ones this is like a really really nice orange here we're going to go over here with this one so that's pretty much it I do have some more neutrals left over right here these are just some kind of um they're almost like a taupey color I had used for something they see how they just kind of are dead in color this one right here and you can't tell this actually has a little bit of a lavender shade to it even your neutrals have a color family base to them they're just really doled out or grayed down or whatever okay so anyway so let's go ahead I think it's a neat idea if I put these in the appetizer tray color palette for us to kind of see how it works it really is easier to see in a circle okay so I apologize that I have these little paper towels in each section that I had used before that you know they're already kind of color coated huh might be messed up if they came out but um this one was missing so I just added one so what I'm going to do is I'm just going to put our color wheel right here in the middle oh and these are opposite of the color wheel so we're just going to ignore actually let me just switch them got my red got my filets I've got my blues I've got my greens got my yellows okay that's all I needed to switch right there okay so let's get started all right let's go ahead since we're we started out talking with the warm colors I'm going to go ahead and add my yellows here I'm going to do my yellows from light to dark going from the inside to the outside these are kind of yellowy oranges okay okay so what's going to be over here we've already got our oranges are kind of like right in there okay and then it even kind of got more to these so these are more we don't have a lot of the reds here look at that but I'm going to go ahead and put my my pinks in this one okay see how these pinks are closer to red and the pinks that I'm going to be doing now are getting closer to the purples normally I had my pinks in this one you can see we got those in there now these normally would have been in here I don't have enough to spread them out so now I'm going to go ahead and go to my purples just look at all that beautiful color wasn't this fun I have fun any time I work with color and learning more about color and color theory is only going to make your art better and more professional looking so I hope this lesson really helped you get stronger in that respect and please subscribe to this channel if you like this video and you want to get others and also join our Facebook group Monet cafe art group where there are so many other artists of every level learning and growing together and as always happy painting please come back soon bye


Everybody for us tear ripping at 20 22 legacy football hobby. This is six box number 20 Random team style. I'll show the results on screen. You can always find them at late sports cards.com. There's a link in chat, too Let's see what we got. Good luck everybody. Just a mixture after this Personals were resumed tomorrow night after group breaks everybody Thanks for filling up everything really really quick tonight. Honestly everything was sold out by like 530 not even John Metschie sauce gardener Bronco Shannon sharp 93 of 199 Rob you excited about the Steelers now that uh Pickings did well yesterday pickings and pick it Tolbert Walker Chrome rookie as a likely Ravens All the Steelers fans around these parts think they're going like 17 and oh dude. Yep Trey McBride Sam Howell I'm a Patriots fan admiral Washington's good Jones Wanda Robinson Taekwun Thornton rookie auto Patriots 109 of 149 Russian has a howl and Dawson actually There at least the top 10 team in there Laftice pick it you've got Texans Brandon cooks 49 of 150. Oh, you would have known what I said Trey McDuffie Bailey zap silver rookie rams Kyren Williams Sounds pretty good, but I don't I don't want that from Sonic though Datsun brisker Jerome Ford Browns rookie auto. I don't think I've had Sonic and it tastes a good in like years Christian Watson Breeze Hall under the lights Carson strong Eagles rookie mini non-numbered Garrett Wilson Thornton Matt Corral. There you go Panthers 9 of 50 on the rookie. Let's present WNBA supposed to come out Push back Chrome rookie Khaled Gordon bears Like Matt Jones is the 85th best player in the NFL according to this like come on Pickings London, I know according to what exactly it's like voted by the players Hmm See who else Tucker got in Booth Jackson Desmond Ritter now Falcons 110 of 299 Cousins is still in there really Haskins Khalil Shakir under the lights Justin Jefferson Vikings the top 100 is so weird Just like what are we basing this off of like obviously every court every every starting quarterback will be in the top 100 If you want to do it that way we're talking like most valuable But apparently it's not because not every quarterback is up there. Yeah Pearson strong Then you would just be like all right which contracts are good which contracts are bad essentially Carson strong Derek Stingley Seahawks rookie Kobe Bryant Mini 40 of 75. Yeah on Patriots fan. I guess we'll see if we can make the playoffs this year Yeah, I mean that wasn't like a slate to you about Matt Jones. I know I just but I don't think he's 80 I don't think he's a top 100 player in the NFL If he is he didn't show it last yeah, he has hit flashes a good rookie quarterback season, but They also got absolutely destroyed in the playoffs like Like like never before CD lamb Cowboys number 41 of 50 on the mini It's like one Thornton Carson strong Brandon cooks number 81 of 100. Yeah, that's what I mean I'm saying hope the Patriots make the playoffs AFC is just stacked in general. So the wild card race is gonna be crazy Hill and Wilson AFC West like every team could legitimately make the record Walker got Carl Aftis orange rookie 90 of 149 The North has the Bengals in the Ravens the East has Bills dolphin should be better. Jet should honestly be better. Yeah, we'll see will they I don't know I'm pumping the brakes, but I mean if they if they won like nine games. I don't think I'd be that shocked Yeah, I'm with you a curtain Warner dare to tear for the Rams 20 Can't read that 60. It's the worst place to have these numbers 32 of 65 you get a right angle there to tear Rams Kenny pick it then he got the Colts to 39 of 299 Isaiah Spill or Chargers rookie Titans, I think the Titans took a step back. Yeah, but I'll still compete for wild card They should He leaves at Carl Aftis defense is solid off the run game is good pure strong rookie for the Pats They usually equates to play off switch, right? This is your stuff outside of like the Jaguars and like maybe the Texans. There's like no atrocious team in the Fc and even they might not be like yeah, they might have bad records because they're in the AFC Dotson McDuffie Fc you have like two divisions that have three bad teeth well Reese Hall jacquain brisker There's two bad teams the NFC East. Yeah, that's right McDuffie rookie for the Chiefs mini 49 of 125 There's two of arguably bottom three teams in the NFC South Dobbs Watson to 199 legends Barry Sanders Lyons 124 of 199 To really bad teams in the NFC North That corral Danny Gray out of Pierce three rookies One really bad team in the West and one like so-so team niners or no C West. Yeah, I can see that Hutchinson or Jabo silver under the lights Mahomes for the Chiefs Rams are still gonna be good can especially bring in an Allen Robinson Crystal Lave sky more Spiller Davis Peyton Manning for the Broncos number 86 of 125 Eagles could I just think how boys will under the lights James Williams Lyons. I Honestly, I would not count Washington They they got to have a quarterback emerge have to you got once there now 250 points random to all the ends Yeah, they're like decent do they have enough on the offensive side of the ball? I don't think so I think so the NFC though. We were saying this that is the NFC and it's probably gonna be pretty top-heavy Like Packers should probably easy win the division even though like If your defense is still decent still Rogers Bears are gonna be maybe the worst team in the league guide And how will Chrome rookies thingy for the Texans? In London Pickens Jackson Carl Aftis pick it a Kyren Williams 93 of 149 rookie Otto Rams Duffy zap Darnell Mooney 164 of 199 bears brisker Dotson silver rookie David Bell Brown Christian Watson Breeze Hall Roger Whirly hollow fame auto 10 of 100 Cardinals Pierce Dobbs silver mini bears V less Jones jr. Walker and Daxon Hill and quad bold and Cardinals 50 of 100 As best statistical seasons with the Cardinals what ring did they get there though? cares dude cup chrome rams Ravens legend for sure, but also Cardinals like I'd say like he were when he goes in all fame Yes, one of those things were like does the wing outright does the ring outweigh like all the stats Yeah, all that he did in Arizona. Yeah, they went to the only Super Bowl with him Son has since we'll check here got Chris Godwin bucks 168 of 299 I wish they would have won it I think everybody does Damian Pierce pier strong silver not silver, but bronze 63 of 100 rookie Brian Robinson jr. Washington strong and stingly The physical packs are trash I hate opening these Garrett Wilson Taekwong Thornton rookie mini Chiefs George Carlaftis. That's orange six of 125 Steelers taste people 122 of 150 Jameson Williams Isaiah likely silver Carson strong Eagles rookie John Mechia Mod Gardner Jalen Tolbert Travon Walker Shannon sharp Broncos 66 of 150 Tray McBride Sam Howell chrome rookie Nicoby Dean Eagles much basin here Justin Jefferson 95 of 100 Vikings Blondale Robinson David Bell chrome rookie Isaiah likely Ravens Space in here. There's a Kenny Pickett All basing here Mini on top of this one. It is a Devonte Adams Raiders bronze mini 61 of 75 Coalations a little weird here Dotson McDuffie Cowboys 20 Romo 17 of 199 Stingley Pierce Taekwong Thornton Carson strong rookie orange for the Lions Aiden Hutchinson 112 of 149 Dexon Hill Garrett Wilson Tray McBride 88 of 149 rookie Jersey Otto Or 88 of 249 rookie Jersey Otto Cardinals. You want trout fishing? You picked 101 trout round, which one did you hit? Yeah, which one did you hit Ron? Pure strong Hassan Haskins rendez-barber buccaneers 17 of 299 forget that was like so long ago. I know it's like 40 breaks ago Ritter Hamilton That's been ridder rookie Otto Falcons Number 14 of 20 You go Falcons nice hit. I saw enough of the preseason. I'm just gonna go ahead and draft Sam. How might as my quarterback Oh, yeah, that's all enough. I'm gonna see I'm gonna draft him as a second round Trace McSorley With the way he showed out in Arizona true Pearson Neil John Williams Broncos mini 36 of 125 Juan brisker Johan Dotson my home is 146 of 199 Bad idea actually Christian Wilson Breeze Hall. I mean if they let him run it'll be over great. I think we're watching you remember here stops Corral Gray No autos yet Jerome Ford Kyron Williams shot Alexander 14 of 100 Seahawks James Cook Brian Robinson silver Kenny Pickett under the lights Steelers is a likely Kyle Hamilton Paul Krauss on the hollow fame auto 32 of 49 Vikings I do not know James Williams Desmond Ritter silver mini Robert Quinn Bears Tyler Beatty Tyler Gordon Jalen Tolberg rookie 88 of 150 Cowboys Impressive in his era to lead the entire Interceptions it's kind of wild Sounds rigged to me Evan Lloyd Malik Willis new Kobe Dean rookie Chrome for the Eagles Conspiracy that's what that is and foil hat Kobe Bryant cave on thivedo America gotta get your tin foil hat Give it to you when you when you become a citizen Trillin Berks got Kyron Williams Rams rookie auto Crystal Lave Skymore Joe Burrow Bangles 118 of 299 Hutchinson Ojabbo Cave on thivedo 73 of 199 rookie Giants right one more. Good luck everybody I mean looks good over here. I have no indication over here Drake Lon and Tray McBride that anything's going wrong Lions rookie mini James and Williams Number 60 of 125 there you go Lions No drop frames recently. Very strange Lions rookie mini 125 of 299 James and Williams Will Shakir Drake Jackson Crystal Lave The Saints rookie dual Jersey auto you go Saints 70 of 100 pure strong Hassan Haskins silver rookie Damian Pierce Texans Stingley Pierce It's like one Thornton Carson strong Fred Taylor numbered 50 of 125 Jags Jackson Hill Garrett Wilson chrome rookie Carson strong Eagles Ruckert Walker Evan Neal Giants rookie auto Kobe Bryant that is a mini for the Jets Elijah Moore bronze number in 73 of 75 Kyron Williams Jermaine Johnson orange rookie Eagles Jordan Davis 168 of 199 Ryan Robinson Hamilton James Cook Aiden Hutchinson 10 of 25 Nice one Lions on the rookie chrome there. It's a yellow cracked ice Nice one Lions Nice trail ants dare to tear 49ers 18 of 65 Niners Gardner Williams Kenny Pickett numbered 88 of 100 Steelers Fran Tarkenton Just not not number just turn around what's happening here Chrome rookie Davis price for the Niners Sam Howell rookie Tolbert now do it. Let's do points random. Yeah, Washington's decent team to get how old Dodson Brian Robinson jr Good team to get just didn't hit this time got points random here 250 random to all Good luck Go six times two and four one two three four five six Adam M quick recap Got Evan Neal Giants rookie auto non-number Crystal Lave Saints numbered 70 of 100 dual Jersey auto Kyron Williams Rams hollow fame Paul Kraus 32 of 49 Vikings Falcons Desmond Ritter numbered 14 of 20 that is a nice hit for the Falcons Jersey auto Trey McBride Cardinals 88 of 249 Roger Whirly hollow fame Cardinals 10 of 100 Kyron Williams Rams 93 of 149 rookie auto Browns Jerome Ford rookie auto and Patriots Taekwondo Thornton rookie auto numbered 109 of 149 and that's gonna do it. Thanks again. Everybody the mixer is up next


People ask me on the street when I moat, how is it that British Columbia has bucked the trend that we see nationally and internationally? How is it that we have managed to balance our budget? How is it that BC alone amongst the provinces is able to maintain a AAA credit rating? And the first thing I say is it's a tribute to British Columbians themselves, who have insisted that the government spend responsibly and manage responsibly. We've accomplished that, which is why we have those balanced budgets and we have the ability to make choices as we are in this budget and that people are helping us make. But we've also done something else in partnership with British Columbians. We've diversified our economy. There are people watching this who are involved in things like aerospace and technology and of course forestry and the natural resource sector and the agri-food sector. But more than any other province in Canada, we have a diverse economy and we have the most diversified portfolio of customers, not just in North America or elsewhere in Canada, but around the world. And it's something that we have applied ourselves to very, very purposely and in partnership with the private sector. And yes, we've taken some of your money, taxpayers' money, to help in that respect, but the benefits present themselves now and particularly at a time when we are hearing so much protectionist talk from south of the border, that will serve to insulate us not completely, but significantly from that protectionist talk and those protectionist tendencies. So British Columbians should give themselves a pat on the back for the steps that we have taken collectively to achieve the best economy, achieve that fiscal strength and protect families from the situation that has developed internationally, those turbulent fiscal waters that are arising once again. But there's more work to do and the budget coming up in a few weeks will help set the stage for that future work.


The term is latency. It is defined as the time from the discriminative stimulus until the response occurs. Latency. Also referred to as response latency. The longer the latency, the longer it takes from the time that a prompt occurs, or a discriminative stimulus, to the behavior happens. The shorter the latency, the quicker it occurs. The quicker the behavior occurs in the presence of the discriminative stimulus. So as soon as the discriminative stimulus turns off, you have a response. That would be response latency has decreased dramatically between words. If I increase my response latency between words, you would probably not listen to my definitions. Thank you.