Oscar de la Jolla, the former superstar professional boxer, has lived in some pretty luxurious real estate so far. This includes a pair of lavish homes in Bel-Air, Pasadena, and even a training retreat he designed himself. Fresh off a welterweight title win, Oscar dropped $3.35 million for a contemporary style home in Bel-Air back in 97. After completely redesigning the home, he put it back on the market for a whopping $18.5 million. More recently, Oscar moved into a top-of-the-line condo at the Montana and downtown Pasadena for $2.6 million. In addition, Oscar designed Big Bear training retreat that Tito Ortiz purchased and was listed for $1.65 million. Today, we'll take a look at some of Oscar's impressive homes and real estate. In these videos, we don't reveal any addresses, and even though I've done a house tour of my own place, please do not show up at any private residences because it's not safe for anyone. Oscar De La Jolla has already killed it in his professional boxing career over the years garnering a net worth of $200 million. After retiring from the sport, Oscar has transitioned into a highly successful boxing promoter and investor. De La Jolla's good looks and charisma led him to other business interests including a Spanish-language boxing show on HBO, a clothing line, and various other merch deals. Oscar even recorded and released an English-Spanish Latin album titled Oscar that got him nominated for a Grammy Award. De La Jolla authored a children's picture book, Super Oscar in 2006 as well, which received a ton of positive reviews. Outside the rank, he became a promoter, as I mentioned, as president of Golden Boy Promotions, which is a boxing and MMA promotion firm based out of LA. You name it, the guy did it. Talk about versatile. First making bank from boxing, salary, and endorsements, Oscar was nicknamed the Golden Boy. His amateur career included 234 wins, 163 by knockout, with only 6 losses. Oscar made his professional debut by scoring a first round knockout victory. At age 28, Oscar was the youngest boxer to have won 5 world titles. De La Jolla enjoyed a 17 year long career with 10 world titles and 6 different weight classes. He defeated 17 world champions and was a top moneymaker for professional boxing, thanks to becoming a marquee fighter for HBO cable TV. Oscar so remains one of the most celebrated boxers of his era, so today we'll take a deep dive into the many luxurious homes owned by the former champ.  Be sure to hit that subscribe button to ring that bell. We post a new video daily. Today we're checking out some of the properties of Oscar De La Jolla, including his bell air, Pasadena homes, and more. I saw some of you guys were requesting this house tour too, so you don't want to miss it. If you liked this video, we've also done house tours in the likes of Roger Federer and Hulk Hogan and we'll link to some at the end. As usual, don't forget to follow me over on Instagram to chat and now let's get into this video. Back in 1997, fresh off a welterweight title bout against Hector Camacho, Oscar dropped $3.35 million dollars for a contemporary style home in Bel Air. The home was completely redesigned during his ownership and was listed again in 2015 for $18.5 million dollars. In total, this lavish mansion features a whopping 8 bedrooms and 9 bathrooms within over 10,300 square feet of space. The luxurious mansion is heavily guarded, stashed behind two sets of iron gates. The two-story home is located on a hillside in lower Bel Air and is accessed by a 300-foot driveway.  The combo of herringbone wood floors, vaulted ceilings, and gallery walls decked out with chic paintings just added extra touch of elegance to the home. The estate was full of luxe features including a formal living room with cozy fireplace, flat-screen TV, and grand piano. Not to mention the space comes complete with a step-up wet bar and a wine room. It also shares a large wall aquarium with a formal dining room. More goodies to add to the house include a separate wing designed for entertaining with a theater room that is packed with plush seating, a massive projector screen, and additional bar perfect for hosting. Steps away from the theater, there's a games room complete with billiards table, and an enclosed sunroom with a ping-pong table for more games to be had. In addition, Oscars former residents had a home gym that put regular gyms to shame, complete with dry sauna, jacuzzi, and his or hers change rooms. But what else would you expect from a boxing champ? The spacious master bedroom featured a cozy fireplace, chill sitting area, and private balcony access.  The ensuite was a spa-like bathroom with dual sinks, a step-up soaking tub, that boasted spectacular views of the California mountains, and a large standing shower for relaxation. Moving outside the backyard, maybe the show stopped breathless mansion. The sprawling exterior grounds featured nearly three acres centered on a gorgeous wide-stone patio that flowed into a swimming pool and spa with its very own waterfall. In addition, the patio boasted a number of lounging spots and a barbecue pit perfect for hosting your guests. I'm sure while Oscar lived here, he definitely soaked up this impressive yard and relaxed. Behind the pool, steps lead down to a lighted tennis court and basketball net. Back in 2017, Oscar ended up buying a condo at the Montana in downtown Pasadena for $2.65 million. This is where he's said to still live to this day. This residence features 4,150 square feet and boasts three bedrooms and 3.75 baths. There's a gorgeous terrace that adds an additional 500 square feet of living space and features plant beds, a hardwood deck, a barbecue area, and tons of room for outdoor lounging. In fact, his outdoor living area is one of the largest at the development. Inside Oscar's condo, the interior features dark-toned hardwood and natural stone tile flooring throughout. In addition, there are oversized windows which include walls of glass and glass doors to take in the stunning view of the private patio. Home features a formal entry, a living room with a limestone fireplace that is perhaps the centerpiece of the home's interior, and a beautiful, even kitchen. This kitchen is decked out with a suite of top stainless steel appliances, marble countertops, and a spacious island. There's even a breakfast nook to enjoy some casual meals. Elsewhere, there are features like a library den, an office where we're willing to bet Oscar signed a few deals, and a wine cellar. In addition, some perks to living in a condo include the building amenities, like 24-hour security, an indoor exercise pool, a fitness center, a library with lounge, and a first-floor atrium. Finally, let's take a look at the Big Bear Retreat designed by Oscar de la Hoya and later owned by Tito Ortiz, which was last sold in 2017 for $1.5 million. Oscar purchased multiple properties here in the late 1990s and transformed it into a compound that included a pair of log, cabin-style homes that combined to offer five bedrooms and 5.5 bathrooms in nearly 7,200 square feet of interior space. Surrounded by tall pines on more than an acre of land, both structures feature naughty pine panelling, stone fireplaces, and anthra chandeliers. Walls of windows and sets of skylights invite natural light in while bringing views of the grounds inside. This selling point of the home has got to be the beautiful mahogany wood deck that boasts panoramic lake views. Oscar liked to work hard and play hard as the exterior of the home featured a putting green and a footbridge that crosses over a running stream. In addition, the home featured a detached garage once used as a gym that has parking for as many as four cars. This was the home where Oscar would come to get some alone time and focus on training before a big fight. It's no doubt Tito Ortiz used the home in a similar fashion. All right, so I think we'll bring this house tour to an end here. We got to take a look at the homes of Oscar de la Hoya, including his former beller mansion, his current condo in Pasadena, and his former Big Bear Lake retreat. After seeing those homes, what did you think? Which was your fave of Oscars homes? Personally, I'm a huge fan of that beller mansion. It did everything and I love any mansion with a gorgeous home theater. Not to mention the backyard with pool and waterfall. You guys can even go ahead and rate his houses in the comments down below. Thanks for watching. Don't forget to follow me over on Instagram to chat and I will see you all next time. Bye.


My name is Jason Haddix and this is domain discovery expanding your scope like a boss. So we did some strike through here because it's not just domain discovery. I added a little bit of web discovery here. This talk is primarily focused around my discovery methodology. By no means think I have the best discovery methodology, but I think it gets me a lot of sites to hunt and bug bounties and pen tests when I'm going after a certain entity or a business or something like that. That's my Twitter if you want to yell at me on Twitter. I work for Bug Crowd who does bug bounties, so we manage enterprise bug bounties. On the global leaderboard of 600,000 registered testers I'm 59th currently on Bug Crowd and I play a lot of video games. That's me and my son and we're both wearing matching dinosaur shirts if you can see that. Okay so this is my methodology in a nutshell and if you guys might have seen this a couple of weeks ago I did release a version of this but I've added more since I did that version. So my version of a methodology to do discovery for hacking websites, this isn't an oscent talk where I'm going to go into hacking people and individual information. This is a methodology to find more web assets for me to go after in a bug bounty or pen test. Usually when you find undiscovered assets, web assets, they are less secured than the main domain and so in bug bounty world that means that they will be less secured and I can find better, more critical bounties on these sites. So we start with identifying our targets, their main TLDs. We move on to domain scraping for those discovered TLDs. We go into domain brute forcing. We then we go into permutation scanning and port scanning. We do some visual identification. We do some auxiliary stuff and then we go into the sites that we have now discovered and we start doing platform identification, content discovery and parameter discovery. So this is kind of how it works. So the first thing you do when you start trying to find or discover assets or IPs or anything associated to a domain and it's hard to see this but you actually have to look up their ASN, the autonomous system number for a company. This is their kind of registered IP space. They're all assigned an ASN number. Here I've looked up Tesla so Tesla has a couple different blocks here. So the site to use this, site to do this is that I used to do this is Hurricane Electric. It's one of the only free sites that will let you pull down the large set of ASN data. Some of them will let you pull it down but only will limit you at like 500 requests or 500 lines of the output. So here I can see that Tesla Motors has a registered net block of 209-133-790-slash-24. So this will be one way I start gathering or basically searching for their IP space so I can start looking for assets. This is just one out of all. Usually when I start though, I'm starting from a bug bounty so I already have a couple targets to start with. Usually they're main domains. So for Tesla we're using them as an example because they have an open bug bounty and it's pretty permissive. They say anything that we own is in scope of the bug bounty, including the cars and the web assets and stuff like that. So I would already probably have Tesla.com or TeslaMotors.com in scope and then I would look up their ASN. So then you want to do reverse who is. So manually you can use these two sites. There's also some tools that automate this. So one of the frameworks I'm going to use a lot, I'm going to rely a lot in some of the next slides is called ReconNG and they have a module for reverse who is. But if you want to do it manually, these are the two, again, the two sites that you want to use because they don't cap you at the amount of stuff that they pull back. Again, all these sites that do this online kind of reverse DNS information or give you information about domains and stuff like that, they want to charge you at some point for some of this info. And as a pen tester, I'm not going to pay $70 every lookup I need to do. So reverse who is will find some more scope targets for this type of stuff. The last one in this area is acquisitions. So this is actually the end all be all site for acquisitions. Crunchbase marks all this stuff when a company acquires a new company. They mark it all in their acquisitions table. So you can just go up to the URL at Crunchbase. It's crunchbase.com organization, then your organization name. And you can see here I have a list or a history of everything that Tesla has acquired in the last 10 years. So depending on if your pen test is really open scope or your bug bounty is really open scope, these domains are now top level domains that I have to put back into the beginning of my discovery. So Grumman Engineering, SolarCity, Riviera Tool. I'm sure if I was doing this, I would also want to check out SpaceX just because I know that they're related to Tesla. So you also want to add these top level domains to your testing. This should be automated. Some of these sites should be automated, but these sites really want you to pay for this data. So they're all protected by different bot protection tools. So this one's protected by Distill, which is actually pretty good. Using a web scraper doesn't work like all the normal web scraping libraries that you would because otherwise I would automate this as part of a tool or something like that. Okay, so that is gathering from OSINT sites. What I want to do now in this section of the methodology is move on to finding subdomains. So I found a whole bunch of top level domains. I found IP addresses that they've used. Now what I want to do is find probably subdomains, and there's a couple different ways to do this, but they involve scraping more of these open source sites. So what do we do in this case? Well, basically when you're doing subdomain scraping and you're trying to find more subdomains of a top level target, a TLD, you want to scrape search engines, right? So the idea here is you would go to Google.com and search site colon Tesla.com and you would get a whole bunch of results that come back and that says Tesla.com, right? And then also a search result that comes back is admin.tesla.com, forum.tesla.com, and iteratively you make more Google searches removing those ones that you found from the list until you have no more results and you have a full cache of everything Google's ever seen for Tesla.com, all the subdomains. That manually is kind of a hard process. So you use tooling to do this. The other place that you can look for subdomain data is inside of certificate transparency projects. So cert.sh, Google's certificate transparency project and their open SSL subject alternative name space. Now these are kind of individual talks. You can go into scraping subdomains out of certificates or you can go into search engines scraping. I think there's already been a couple talks on this. So I'm going to go into the automation of these and what I use to make this quick. So there's two tools for doing all this subdomain scraping and finding targets. One is ReconNG, which I have created a script around called enumall that wraps around it. It's a Python wrapper. And there's another one called Sublister. And they're both really good. They both do the same thing. These are the sources they pull from. It's kind of hard to see. But on the right, Sublister does, they do the same thing on Bing. They look in the cert.sh project, which is the SSL certificate's directory. They look in the Threat Crowd API and the NetCraft API. Now individually, they also do some different sources. Sublister handles Bydo, Ask, DNS and Dumpster, which is the scans.io project, VirusTotal and PT Archive. In some way or another, these sites all have a website that's aggregating domain information somehow. And these tools will scrape that out of there for your target. So they will find Tesla subdomains for me. ReconNG individually will do SSL tools, API, HackerTarget API and Shodan, which is a pretty popular one. And then they have a whole bunch of optional modules that you can bake into ReconNG. So disparate tools, but the two best tools. So if I want to scrape all of these, I don't really want to have to use both. So this is a tool called Sublister. And so, oh, this is the one I showed you, the Sublister, and so this is a run on the right. It's hard to see, but basically I've set it to go after tesla.com. It runs, it searches Bydo, Yahoo, Google being, NetCraft, DNS, Dumpster, VirusTotal, ThreatCloud, SSL certificates, and passesdns.com. And then it just gives me an output of all of the domains. You can kind of see them. You can see tesla.com, auth.tesla.com, autodiscover, dev.tesla.com, forums.tesla.com, et cetera. So I've significantly expanded my scope now from just tesla.com to go after. So the other tool was enumall that I wrote. And I don't really feel like running them all independently. I want some form of automation around this. So this is a project called BruteSubs, which basically can take any recon tool written in any language if you make a docker file for it and spin it up and run it and give you the output from such tools. So BruteSubs specifically takes my tool enumall and sublister and a couple other tools we're talking about, and we'll run them. There's some configuration required. You have to set up the docker image with some of the modules that aren't included by default, make a custom environment file. But once you do that, all you do is docker up and it will run all of this domain scraping for you and just give you an output text file from three or four different tools that we're going to talk about in the next couple of seconds. So this is a run on the left. You can see it does a little bit of everything. It does the scraping. One of the tools is actually a BruteForcer. We're not going to use it because we're going to use something else for BruteForcing. All right, some other subdomain finding tools that are scraping data. The one that I find really cool here is Cloudflare.  And it'll tell you if that's already used, basically, if Cloudflare is already running on that domain. So this isn't my screenshot, by the way. This is the tool author screenshot. So by iteratively putting in names into that search field on Cloudflare once you're logged in, you can verify or not verify that they have a subdomain in existence with Cloudflare. Cloudflare runs on 15% of the internet right now. So you can get a massive amount of, basically, OSINT information from this kind of API or web portal that they have. So here it's running against Disney. You can see that it's returned some success querying the DNS archives of Cloudflare. There's another one that's individually TestCensus.io, and that's another project for aggregation of web data. So these are bespoke tools that don't really fit into anything, but I really like this Cloudflare one.  Now we have to move on to basically guessing at our target, right? So I might have some search engine results, but now I want to do this idea of brute forcing the subdomain. So the classic example of this is that you have Tesla.com, and then you try to resolve admin.tesla.com, and if it resolves and you go somewhere, then that site exists. If it resolves, it doesn't exist, and you iterate over this in a tool. Now over the years of pen testing, we've done multiple tools that have come out for this. Fierce was probably the first and best one. New school ones are like sub-brute, black sheep wall, DNS parallel brute force. Now the problem with these is that they take a long time with the big list that you're trying to brute force, right? And different projects have come out with different lists as well, and some of those lists are really long. And to do that normally, or at least in my experience, it took days, two weeks to run through a brute force of that kind of stuff. Now this is actually some research that I did. I basically benchmarked all these tools. So you can see that the two best ones here are two tools called GoBuster and MastyNS. GoBuster is written in Go, obviously. It does subdomain brute forcing. With this list, this one million line subdomain brute forcing list, it completed that whole thing in 21 minutes. MastyNS finished it in a minute 24 seconds. Now the reason MastyNS is so fast is because it's written in C, and instead of using just your DNS infrastructure that you're connected to, it has a list of DNS servers that it cycles through in parallel to resolve the sites. It gives you more false positives, but it runs very, very quickly. So these are the two tools that I integrate into my methodology for subdomain brute forcing. Yeah? Yeah. No. Well, subroot obviously aired out, but DNS parallel program BlacksheepWall returned 61 and 43, respectively, but they were all included in the data sets of GoBuster and MastyNS. Yeah. Okay, so that file that I said was a million lines that you're doing for subdomain brute forcing. So that is a file that is made out of basically every file that I could find that has ever done this type of work, subdomain brute forcing. So the fierce list is in here, DNS scan, the deep magic top 500 prefixes for subdomains. There was some research earlier this year by a guy named Bitcork who did scraping on the web of the top million most popular subdomains. Remember, we're brute forcing just names to see if they resolve, but we're not brute force from. So this is everything that's ever existed as far as I could find. So it's all catted into one file for you to use at that gist. You can just grab it. And the idea here is because MastyNS is so fast that why not just use a huge list? It doesn't matter, right? It gives us better coverage. So MastyNS can complete this in, you know, minute 30. Yeah, there's even some extra stuff on the subdomain list. So like the raft list and these were URL brute forcing, so using words to find URL paths. And I found that to be sometimes useful in fuzzing subdomains as well or brooding subdomains. So those are incorporated into this list as well. Daniel's project, robots disallowed. I ported to a DNS structure to being here as well. Okay, so I've done a ton of brute forcing and I've found some stuff that resolves. I've seen the internet and I've found a whole bunch of stuff that might exist because it was off search engines or in all these open source caches. Now what else do I do? Well, a quick part of the methodology is trying to find permutations on the stuff that I've found already. So the idea is that I may have brute force for admin.tesla.com but a lot of people use subdomain nomenclature that's like acs.admin.tesla.com, right? So what all DNS does is it takes permutations and throws them into your results of other tools. So you take the results of other tools and you go ahead and run it against the domain and it will add these permutations all over and then find additional subdomains against stuff that you've already found because they use these weird naming structures in a lot of places. The other one, this is kind of interesting. I've only used this once in success but I really like the idea behind this because it's called SDBF it's called Smart DNS Brute Forcer. The approach here is to use Markov chains in some statistics in an Ngram model to basically generate these permutations of domains. I actually don't know what all that means. I've just used this tool and it's kind of cool. So yeah, so the white paper, this was an academic research project. He's published the code for this. The variance between this and Alt DNS is actually very low, maybe like 10% more I found with this than Alt DNS but I've only run it a couple times on a couple projects. But I like the idea and it has fancy names. Yes, with 100% covered so far, yeah. Okay, so I've done acquisitions, I've done their ASN, I've done subdomain scraping from all kinds of public resources, I've done permutation scanning to find bespoke weirdly named subdomains. Now I need to move on to doing some sort of actual port scanning. So I have a whole bunch of targets. There's really no other solution better than Mascan. It's just what you do. Nmap will take forever with a large ASN, not to mention the amount of time it would take to add on all those domains I found. So you just can't use it. Forever. So for a large targets ASN like 65,000 hosts live or something like that, the run from Nmap is kind of infinite and you fall asleep. For Mascan you can do a scan like this in 11 minutes. And so the problem with Mascan is that by default it doesn't have a default ports list, it's kind of meant for projects where you scan the whole internet for one port. So you'd have to specify in the command line all the ports you want. These are all the ports that are the default ports for Mascan. So if you want to do that, you can do a scan like this and just plug it in and go. Or you can use a config file and put all these ports in your config file for Mascan and it will go out and port scan all this stuff. So it's written in C, it's distributed really fast and so that's why it can do what Nmap can't. It doesn't have any of the functions that Nmap has for server, versioning, for Nmap scripting engine. Oh. I think it's just a list. List in the command line, yeah. Oh, actually no, it supports OG, which is the Nmap syntax for XML, comma, separated value and something else too. List as well. Greppable, there we go. Greppable, yeah. Cool. This tool will melt your boxes. So make sure to do it on DigitalOcean and not your home network. It will dosh your router. So I have port scan a lot of stuff. I have scraped a lot of stuff. I have a lot of sources that I'm building from. But in the first part of the methodology we were scraping public sources and those things might not be on the internet anymore.  They might actually have a registration but they're redirecting to the home page of the site I'm after. So a lot of the, when I did this run, when I did Tesla, a lot of the sites was TeslaMotors.com because that's their main domain. They had registered something either so that some nerd wouldn't hijack a domain that sounds like them or they had maybe planned to use a site eventually but never did or something like that. So there's a lot of registration and redirects and stuff like that. So you need to do some visual identification but I'm not going to go in my browser and open up like 400 tabs of sites that's inefficient. So what you do is you use a tool called Eyewitness. I like Eyewitness the best. What they'll do is they'll take your list of output and since I've been scraping from search engines sometimes I don't get the protocol that I'm supposed to visit for that site so it might be HTTPS it might be HTTPS depending on the source where I'm scraping from. Now what Eyewitness will do is it'll try to visit a subdomain or a domain in both HTTPS and HTTPS and it'll take a screenshot and it'll dump it in a folder and then it'll sort them by a screenshot. They'll also pull header information and content type and sort them into folders for that as well now too. So what I do is I run this on the output of everything I've already done and I start visually inspecting and so you can see some thumbnails there for kind of what the screenshots look like but eventually what you'll see in a large engagement like this against an open scope target is like an employee login and that's where kind of I would want to start or a partner login or maybe an old marketing page or a page that looks like it's coded in a language that you could probably kick and it would fall over so that's kind of where you would want to start. And this is a run of Eyewitness on the left. The added benefit of Eyewitness is it has a library to take screenshots for a couple other protocols too not just HTTP and HTTPS it'll also take screenshots of RDP and VNC so if these sites have those ports open it will take a screenshot of the RDP login so I've actually scored pretty good money on sites that have left RDP exposed to the internet with admins still logged in so I had their user names and all I need to do is brute-force their passwords to get into their RDP instance. VNC. One second. Any questions? Not in my methodology usually I'm going after web targets but the mass scan output will give you all those ports so if I want to I can go back later and look at SSH, FTP whatever protocol I want public facing databases like nobody should have that I want to brute-force those I don't know other interesting ports Cool, some auxiliary stuff for enumeration here is if people have DNSSEC enabled you can use a couple of DNSSEC tools in the LDNS Utils package to walk the relationship of DNSSEC registered domains and this has to do with the presentation that was at a conference that I held called Level Up at Bug Crowd we invited a bunch of our bug hunters to come and talk about their techniques he did a whole talk on this idea of LDNS walking and NSSEC walking and then even NSSEC 3 walking which are all technologies related DNS SEC and so the presentation there taught me a lot about these couple methods there was another one for basically using github to find secret keys internal credentials, api endpoints and domain patterns inside of github so just searching your target inside of github really is all it is you go to the search box you say tesla.com any partner that's ever integrated with them that has open source code you get their domains they might have left api keys so there's also just like the simple fact that people also don't actually just visit the site and see where it takes you so this isn't passive but this is active so one method is to use just burpsuite and scope filters to find additional domain coverage so I'm going to show that in a second but basically you load up your main target through a interception proxy burpsuite for web testers you visit it and then the JavaScript will start firing you walk it a little bit and you'll start to you know your site tree on the left will start to build up and then you can just nuke your scope down to a keyword of like tesla.com and start looking at additional sites that they were linking to and then you can also do a ton of Google dorking for things like people's ad keys for Google so if a company registers an ad key for Google they're going to use it globally across a lot of domains so if I want to find all of their sites I might want to Google for their ads key also companies across all of their sites use the same privacy policy in terms of service so if I can find that I can Google for that string and find domains using that and then looking for people's s3 buckets and aws buckets that's in a presentation by Ben Sakhtehidepour I think it's how you say his last name he was an intern of mine at bug crowd he works at hacker one now and he did a presentation on that which is linked on the right as well those are methods that take a while and could have their own talk so I don't go into all of them right here so this is just like a simple idea of what you do with Burp so I'm going to kind of try to do a live demo I'm going to fire up Burp suite so this is using Burp to kind of find all of the domains you can that are linked on one site so I'll start at Burp any of you in here use Burp yeah it just sits between your traffic and the server and it shows you everything that goes by and it has a whole bunch of helper tools to manipulate that web traffic they have a scanner in it but today we're not going to focus on any of that so I've opened up Burp suite and I have a Chrome tab here that's directed to pass through Burp suite so if I refresh Tesla.com you'll see my proxy tab lights up I'll let this through so all the traffic is now flowing through Burp suite to the internet you can see on the left hand side a whole bunch of stuff has how many domains have traveled through now I want to make sure that I completely I completely spider Tesla so I can find every related domain so here's Tesla.com down here I can right click here and spider this host it'll say would you like to modify the scope to include these items you want to answer yes here and I'll say yes here alright so this is going to spider Tesla.com with the web spider you can see it's transferring bytes it's making requests it's got some forms queued I'm going to stop it here because this could take a long time and now I've got a whole bunch of stuff in this site tree on the side right and these this will expand out pretty large if I continue that spider to its finish not all these are Tesla sites right these are all links that were on their sites so what I want to do for your target is just to go to your scope tab here and you can add a new rule here in your scope and just add a keyword under your host here as Tesla and then click here on the ribbon and say show only in scope sites now these are all Tesla sites that were linked from their main domain now what I'd want to do is select all of these spider all of these recursively find out what they're linking to and use the same filter to try to find more domains so recursively I could do this and probably find a ton of their stuff that they're linking to on their sites any questions there cool alright that was the only one I didn't have an animated gift for so alright alright so I've identified a ton of sites to hack now on a large scope program or pentest now I want to do some actual identification of what software they're running to actually do the hacking alright I found a ton of scope so there are some tools that already exist to tell you what technology stacks that these sites are using WAP-a-Lizer and built with are two browser extensions that you can use that will automatically just based on the headers that come back from the site based on strings in the source code of the page the HTML source code they just know it's built with WordPress or they know it's built with whatever framework they can even go as deep as telling you what the databases are that are running the project so WAP-a-Lizer and built with they're just little buttons that sit inside of your browser and you can click them and get full stack information the reason I want to know the full stack information is because it helps me know what techniques I'm going to use to try to hack that server there's also another thing called Retire.js which is a scanner to find outdated server-side JavaScript libraries which is super cool you can use that I use it a lot and then this is a new tool called Vulner's or it's not a new site but it's a new Burp extension that I like so Vulner's.com is a repository basically CVEs and instead of the actual CVE advisory they give you exploitation data on how to exploit old versions of software like you know old hacker sites used to do so they give you all the write ups of the original person who exploited it it's not just like hey there might there is a buffer overflow in this area of the application this is the CVE number so what Burp Vulner scanner will do is it will find basically pages you load it into Burp you browse a site and it will tell you what technologies the site is using and what CVEs based on the version number it's returning it might be vulnerable to and it has complete links inside of Burp in the bottom right hand corner there that you can go to and click and find exploitation info so it's a pretty sweet Burp sweet tool that I like a lot right now it's plug-in yes Burp Suite plug-in yeah I think two weeks ago yeah it's not in the backstory yet at least it's not as far as I'm aware so it's on the github on Vulner's Vulner's.com Burp Vulner scanner that's where that's where it is so this is just loading the extension and running it on something eventually in the bottom right hand corner you'll see the you'll see the outputs writes going to a site selecting a site yes he's Vulner's detected and there's all the CVEs that might be associated to that site because of its versions on the bottom right hand corner cool all right so I now have a bunch of targets I've started to identify their platforms I have auxiliary reports to test I really have a lot to test at this point on a large scope and tester bug bounty now what you have to do in any like web test if it's a web technologies you have to discover all the content of the website not just by spidering stuff that exists but trying to find stuff that doesn't exist so this is this is a thing called content discovery or directory brute forcing on websites you'll learn about this if you take any web hacking class it's basically brute forcing paths on your url so let's say I'm hacking Tesla.com and there's a there's a hidden page that is basically the admins page in its slash admin but that's never linked anywhere on the site only employees know about that path to go there well the way you find this stuff is you brute force words after that path after the main Tesla.com path here this just like the old tools in DNS used to take a ton of time to do tools like potador or or any other directory brute forcing or content discovery tool even the content discovery tool in burp not super fast go buster is kind of the new school tool to do this it's written and go it's multi-threaded it really does a good job for this so you can burn through a large list of brute forcing this kind of stuff with go buster in I can tell you it's completed in running sorry it is yes it has some of the same functionalities as the cooler tools where you can so it took 40 seconds to run on a 500 500,000 line directory brute force list which is really fast if you don't know that's super fast for brute forcing the passwords I think madusa was the one I used last I think madusa yeah madusa anyway okay so you're brute forcing URLs right so you have a fast tool go buster but you also need a great list to find out what common paths there are so there's there's three lists that are really kind of the industry standard now sec list is a project that Daniel and I run together and it has lists of paths that usually exist that are sensitive Dan did a separate project called robots disallowed he went out to the whole internet right Dan and basically found every robots.txt file that existed which is the stuff that admins don't want you to spider and then put that into a list so you can then spider it yeah so it's like the whole internet status so it's super cool you run that through go buster it's really fast you'll find good stuff there these digger word lists these digger word lists are two projects put out by I forget what consultancy it was it used to be stack and loo which is now bishop fox I think yeah so they're cool guys they had these digger tools and what they did is they went to the source code repositories github and there's another one I don't know what the other one was what might have been bit bucket I'm not 100% sure anyway they went there and they spidered all the code from those projects and then parsed out the paths any paths that they saw for directories and then made lists based off of that and reoccurring instances so you can use any three of those lists but use them with go buster you can also do this inside of burp but it's just not as fast but if you want to keep it all in burp you can do it in burp alright so now I have paths I have sites I've got a ton of stuff to work with is there anything else I need to do there can be I don't do this a lot because this is like an extra step but it is worth mentioning I think it's a cool idea so the idea here is that I might have found a whole bunch of scripts and maybe I found an admin script or resource on the page but this resource doesn't tell me how to use it I'm not an admin I don't know what parameters to send or data to pass into this script to do anything so the idea here is you can actually brute force that as well so this is a tool called parameth it's a resource name or a script name here on the bottom it found a simple test PHP script but it has no idea what parameters to pass this to execute anything so or it found you could find a path or something like that so what it does is it brute forces parameter names for that there's another project that burp actually put out called backslash powered scanner and they did a similar research to Dan's which but instead of crawling all of the robots.txt files on the internet and putting that into a list they basically I don't know where they got the data but they pulled out the top 2500 used parameter names on the internet so you can load that into parameth and try to find parameters that will execute you know when you're successful because this tool will do like a reject response discovery and a comparison between sending it nothing and then sending it this this brute force parameter so it'll tell you hey this differed you should go check this out because I think I actually executed something here yeah no that's not it's a different thing yeah no this is a command line tool yeah I you could do it in burp you would just have to do it in intruder yeah it would I mean command line tools are usually faster but if you do it in burp you keep it inside of your burp workflow which is nice yeah okay so parameter brute forcing is a thing all right so there's a lot of stuff that we've done in here as is you know like how do you keep track of it how do you automate it like really there's not a great solutions right now the problem here is I see a lot of people making these frameworks to do all this for you and that's really great like jcran at my work has one called intrigue and it is these slickest looking oscent tool there's one called data split which is badass which these guys actually make which is cool but my problem is that the tools and the sites that I'm scraping and that are written right now they change a lot like those sometimes those sites go offline sometimes they start limiting your api access the tool and the technology maybe maybe distributed next time it's written a lot of these tools are writing their own tools to do this and so it's never as fast or as complete as I need it to be so I always end up having to go back to manually using these tools to get the data I want so there are two projects one called hodor and one called kubot by on shaman barita and basically the idea here for hodor is that you set everything up as a docker container with a standard docker config file so if you have a new tool and it's the new hotness you load it into your docker config file and then you run one command in hodor and it distributes it distributes your command across all of the machines let's say I just say docker up slash something and then I say tesla.com it'll stand up new docker instances for everything run all my tools simultaneously and then spit back the output to my host machine and so that's where I think kind of the future is of everything because then if I find a new tool I like it doesn't matter what language it's written I can just make a docker container for it and start it and bring back the output then all I have to do with that output is parse it a little bit on the command line and it's usable so I think hodor and kubot are what I'm going to use in the future there's also in the bug bounty world there's this idea of in order to hack these things I have to be the first to know about them when someone stands up a new sub domain I need to be the first to know about it so I can hack it and get a good bug asset note is a framework that will do some of this for you and you can write custom modules for and it will basically text you when it finds a new domain so I have a couple of bug bounty hunters who use this in great success they get an alert on their phone that says tesla stood up a new domain you need to go home right now stop whatever you're doing and go hack it before the rest of the 500 other thousand bounty hunters are going to go after it and so really it makes a difference it does when you're trying to do bug bounty full time for a living that's it any questions yes I haven't published this version of the slides I don't know you guys publishing somehow the slides at all I'll give it to them and they'll probably be on the recon village site you have a question yeah so there's also the idea of looking for that kind of stuff I haven't found any tooling that I've settled on yet that's why I didn't include any of it there's probably four or five tools that will scour the internet for misconfigured get directories and also misconfigured AWS S3 buckets and so I haven't really found one I liked yet in the presentation but that is a method that I do use yes yes I don't do anything from home anymore so I did a bounty a couple weeks ago and I went up against Akamai's WAF and if you get blocked by Akamai's WAF it blocks you from PayPal eBay all your banks I tried to register for a hotel wouldn't let me to that site my wife was really angry with me so yeah so I do everything from digital ocean yes is pretty much now they haven't bothered me yet what? nothing yet yeah so we have extra recon badges which are super sweet how am I going to do this somebody name off one of the tools I use in my methodology who said first over here it was you yes one of these what was one of these subdomain scraping things that I talked about I think he said it first sublister yes cool alright sorry I only had two you need the battery I also have a couple printed copies of proof of concept or get the f out so if anybody wants one of those they can just come up and grab one so I'll just put them right here cool really thanks for coming I really appreciate it


I am going to talk about what we currently have issues in open open source licenses. I am from the side of Cologne and my colleague Karina which actually submitted the talk. She is from Berlin. So the German Aerospace Center is a research organization of the German government. We are doing research on transportation, space research, energy and aeronautics. And we are also a German space agency among other things. We distributed this in Germany with 20 sites currently, 8,000 employees and about 5,500 are scientists actually. And also we have offices outside of Germany like here in Brussels or in Paris, Tokyo and so on. And within our lab, within the German Aerospace Center, we have a lot of software and a lot of open source and free software. This is actually a picture two years ago here at Foster which I took of somebody you might know. So the software scene and software development at DLR is very diverse. So we have many, many domain scientists from aeronautics and space and so on. All of them have certain thoughts and things in their minds and usually they are implementing their ideas into software patches. That's the basic way of working. And so software development at DLR at our lab is very important. Like 1,500 people are working full time on software development. That means we spend 150 million euros per year personal costs for software development. It makes us one of the largest software companies, if you will, in Germany at least. But actually we are not a company. And the characteristics, the people who are developing software, and this is very similar to other similar organizations like Research Labs and maybe also universities, that our developers have no training in software development at all. So some of them had like programming courses at universities like the course in C programming or Python or other colleagues have courses in Fortran programming and so on. And the problem is that they have no education but now have to do a huge amount of the time they are doing in software projects actually. Space experts, domain experts for aeronautics and transportation and all this kind of stuff. They just have to do programming work because this is essential in every scientific field today. Like especially in the field of where we are doing a lot of data science and so on. And a lot of these people just, many of these people or colleagues don't work on huge software projects actually, but they do something like exploratory programming, like small scripts or entering a bit of code, bits of code in Jupyter and no big books and so on. And we use a lot of technologies, more than 30 programming languages like with Fortran and Ada and MATLAB and Python and so on. And a lot of, we use a lot of open source software and we produce a lot of open source software with many different licenses. That's where part of the problem is coming. So we have a huge number of software projects. One of our problems is that we don't have a real overview about our software projects. So it's very heterogeneous from the organization point and it's very hard to get an overview and it's just not possible today. And regarding open source software, usually the software starts within the lab and then it's exposed as a source license to the outer world. Here are three examples from the Earth system modulation field, from traffic simulation and from aerospace design. And the software packages are used from other researchers or from other companies. And contributors come from also from other research labs and universities and also from companies. Problems that we have, what we had in the past is that we published open source, that we had issues with licenses. So things which are not going to really talk about. But one of the things that happened is that our government in Germany gave software away to another country and stated it was open source. And it was not. It was the software of our lab of DLR. And well, there was a journalist from the Spiegel magazine and he discovered that and there was a little trouble coming up. So we fixed this with a lot of effort and then we had a couple of other problems where the license compatibility was not fulfilled and so on. And in general, colleagues didn't know about open source licenses and which license to choose and so on. And the problems that we have are not as problematic as like with our hardware. This is much more expensive, but it's also not nice and we try to avoid it. And like in 2012, there was a letter by our CIO who sent a letter to all the employees with some tips and warnings about open source and dealing with open source licenses and so on. But the situation is really complicated because if you are a developer and especially a researcher which are not interested in software engineering and programming and in license issues, it's really hard to understand licensing and open source license in particular. For example, at the ICPC conference last year, there was a talk about a study, do software developers understand open source licensing? Well, the general conclusion is that developers understand open source licensing if there's one license involved, but it's really if they struggle if there are multiple licenses involved. Usually in most projects, this is the case, that we don't have just one license but we have multiple licenses and we have also issues of license compatibility and so on. And well, what we try to do in the past years is to take some actions for our colleagues, for our employees, for example, information, provide information on trainings, knowledge exchange possibilities and consulting and support. And I'm going through all of this briefly. So information and trainings, what we set up was a training for open source licensing. It's not about developing software, it's about only about legal issues on licenses. And it's a regular training in our education program of DLR so every employee can sign up every year. And it's a short training, only four hours, like from 10 to 3 p.m. or so. And it's one by two persons, a legal expert for the real legal topics and second person is a software engineer. And together we are presenting the basic stuff about licensing and how to select open source licenses and how to use open source software. And it took place in various sites at DLR throughout the years and a couple of people from different institutes attended and the people who came there, most of them didn't have very deep knowledge about open source licenses. That's our main audience with these trainings. So when we asked three of the training, nobody said that he or she has deep knowledge about licensing issues and the topics of the training. We also asked them for the expectation on the trainings. We got a lot of feedback what people want to learn over you about licenses and so on. We learned about legal basics and the feedback after the training shows us that we fulfilled the expectations of our colleagues. At least the ratings were good or very good. So I think this has turned out very well. And what we also did is like brochure like in real paper and information about legal basics. It's developed by a law firm in Germany from Berlin and funded from DLR sources. And the open source brochure contains a couple of chapters and sections about distribution of unmodified code and modified code. It has lists of all liabilities for licenses which are widely used at DLR, for example DBSD or Apache license and so on. And covers of course concepts like copy left and so on. And this is one page of the open source brochure which we distribute in our lab. We have checklists so colleagues can go to these checklists and mark all the points of say the projects fulfill these points. And it also has a lot of information about very different things related to open source and software development. And it also has some kind of decision trees for example for choosing a license for their own projects. This brochure is in German only currently but we are working on an English version of the Creative Commons license which we can distribute in the future like this year somewhere. Next thing is knowledge exchange between our colleagues. The first thing that comes to mind when you think about knowledge exchange is a wiki and also we set up a wiki in our central wiki installation where we have wiki pages for everything and since a couple of years there is an open source section with question and answer section and information and link lists and so on. This is like the single point of information for open source issues at DLR. I think this is very common in standard but what we also set up is kind of workshops, knowledge exchange workshops. This is for peer to peer exchange between our colleagues which come to a place together and we have this knowledge exchange workshop for different topics at DLR like for software engineering and visualization and photonic systems and so on but also for open source and also open science and open access and these kind of topics. This is currently open for any DLR employee. Currently we have a limit of 60 participants per workshop. This is an interactive program, short lectures and everybody has to introduce it himself or herself and we have lighting talks and discussions in small groups and so on. So for example last year everybody had to make a small poster introducing herself. Actually this is Karina who was supposed to talk here now. And then we can go around to the posters and everybody can ask questions and explain what he wants and what he offers and so on. Well of course sometimes it's hard to understand what people offer. That is also one of the problems that we have that we have very strange minds in our lab. They are thinking about concepts like how to integrate satellites into an industry for all infrastructure and well then if you have to go to them and ask about the open source licensing then they basically explode. So this is the interesting part of the job. And also we gather the feedback for our workshops and for the different topics and also for the expectations that people have and the most important expectation was to get knowledge from other people. We send the same lab from colleagues which have the same problems. The feedback form showed that we had to fulfill this expectation. So we will continue with this kind of workshops, internal workshops for knowledge, not exchange. And we have a lot of findings which came out of these workshops which we can use for further actions and further activities within DLR. Very general findings which we in part already know before that we use open source a lot and that people want to publish open source more and more and so on. And there were also critics of open source software and we discussed these topics too. For example for things like earning money and the business aspects and so on. And one of the things that we needed a formal process definition and what to do for employees if they want to publish the software as open source. This was missing, it's now available because we developed it in the last month, last year. So this was one of the outcomes of these kind of software and knowledge exchange workshops. And of course another topic that we set up in another area is help and consulting. If people at DLR have problems related to any kind of licensing or any kind of open source issue, there are actually a couple of departments who might help for like the technology marketing division, they help in general licensing questions and topics like property rights and so on. We have the legal department of course who can support and for general legal questions of copyright questions and we have a software technology division who helps in license selection and all things related to development. And of course during these support actions we have typical topics are what are criteria for choosing open source software or what are best practices for your own open source project and so on. And what we set up for this and we found out that this is also very important, just a very simple single email address, open source at DLRD and any employee can send an email to this address and we will help these guys. And well of course everybody from outside of DLR can send us emails to this address and we will probably help these guys. And what you also did is that we choose a couple of licenses which were approved by our legal department and colleagues and employees can use this out further asking anybody. Like the simplified PC license, Apache license, Supernode, Eclipse public license. These two licenses are really widely used at DLRD for right of project. And of course we have a lot of other licenses which we are using but if one of the colleagues want to use one of these licenses they don't have to ask anybody again. And another thing we decided a couple of years ago that we don't go and develop our own license. A couple of related institutions are doing this like the European Space Agency and NASA and so on. They all have their own open source license or their own license and we decided just that the existing licenses, the existing open source, all the approved licenses are enough for our project and that's it. And it works in practice so there's really no need for our own license. And for support and help also we have a section in the Wiki where there's a discussion board and Q&A section which is very frequently used currently. So I think the key messages of my talk here are that we at DLR, our strategy was regarding the open source licensing is that we first offered specific information to our employees and provided room and space and time for peer-to-peer discussions and for knowledge exchange. Then afterwards, just afterwards we came up with formal process definitions and something was just given from the board of directors and so on. And we have positive evaluations for all of our actions and so we can continue on this road and also other research organizations at least in Germany but also currently in the US like copying this kind of way that we are doing. Okay, that's it. Thank you. If you have questions, just ask. Thanks. You like to allow just credit knowledge rather than direct it from above but it seems like when it comes to choosing licenses you're not actually giving your engineers that much choice. Obviously one of the big choices of license choice is whether you use copy left or not and the three approved licenses by default had no copy left, no copy left and I think a little bit of copy left. So one of the most difficult decisions is not in fact in front of that. So I can see how that would make it easy but yeah, if you have any comments on that and you just decided not to use copy left licensing with DLR. Does this question is too long to repeat? Yeah, so the question is basically why do we choose only licenses which do not have copy left in it and this was not by intention so we just came up with these two licenses because a lot of people ask for specifically these licenses and it's totally possible that we add another license like GPL or other licenses to this list. It's just the current state. Is this the list that you're producing software or the list of licenses that you're using? The license that you're using for software that we initiate? Yeah, I think you was first. What organizations do work for them? Is it a function of how big they are? How big roughly is DLR in terms of number of employees? The question is how big is DLR in the employees? We are currently more than 8,000 employees. Yeah. Do we have public domain in Germany? As far as now we cannot do this in Germany. But I'm not the legal expert. Who choose without passing through the legal department? Yes. But for instance, if I were a copy left license after I was in the legal department, have you got any experience about some of yours tried this way? Like I want to choose a copy left license and ask... So the question is can people choose a copy left license and if you have experience with employees doing that? Yes, we have a lot of experience. Many projects of DLR have, for example, a GPL, a GPL or other copy left licenses. And it's not only legal department where we have to go through, but also actually you must convince your manager actually. But that's a side note. But in general a lot of people did that before, yes. Also copy left licenses. No, we look into... Yeah, okay. The question is in what basic is it accepted or not? So in each case we look into the specifics of the project and does it make sense? Does the license make sense? And in some cases we like my department or other people suggest other licenses and sometimes we just say yes, this is okay. But especially this project is currently a bit more formalized also with decision trees and so people can make the step for choosing license by themselves more and more. Yes. So the question is do we provide the actions and services to external parties? Yes, sometimes. For example, we did it a couple of times for other research institutions in Germany. Universities and research labs. And also in one case for a company, but this is not our main focus. There's choice of licenses. Sorry, can you repeat? Why not push every all of the TLR programmers with one license as opposed to permitting... Ah, okay. So the question is why do not push everybody to use these licenses? For one license. One license, especially one license, yes. No, this is a strategy which we tried out before. For rice technologies, for programming actions, for licenses, for development infrastructure and in a really free mind research environment like the art is not going to work. So people want to do their own stuff, their own way, their own license and so on. And so we have to provide offers, but we do not make pressure arms and to choose just one single license. We don't want to. No, that doesn't conform to our way of free thinking and to do what you like basically. Okay, thanks.


In the northwest there's a farmer called Shannon Porter who has been nominated for the Innovation Award for Women Farmers 2023. It's actually a competition that was developed to shine a light on the hundreds of innovative projects that are carried out every year all over Europe by women farmers. And this will particularly showcase solutions that are being implemented by women to support sustainability. And Shannon's story started in a way in 2021 when she started up her own business on her family farm which is between Newton and St. Johnston. It's called the Milk Bar. You may have seen the signs dotted around the road and directed towards the Milk Bar. Well it is completely self-service and I'm delighted that Shannon now is joining us in the studio to tell us more. First of all Shannon I welcome to the show and congratulations on being nominated for the award. It's great. Thank you very much John. It's great to be in here today to talk to you. Yeah the last time we talked it was during COVID wasn't it? During COVID just before we opened up I think we were on the show probably the week before we opened up in September. So things have moved on a good bit since then. Yep a lot. Yeah I suppose when you're looking back and you condense it all you know you realise the things that have changed and that you've developed and the strides that have been made. Anyway let's talk a little bit about this award you're nominated for and let's also just talk about it. I suppose what you do there you supply milk locally but there's a lot more to it. Yeah so we obviously have our milk vending machine there on the home farm so I've all my local community and the locals come and get their weekly supply of milk. What's different about your milk? My milk's not homogenised or not standardised so like the fat gullibles is not there's simply there's nothing taken away, nothing added. Is it so-called raw milk? It's not raw milk because it's pasteurised just to make it safe for human consumption but there's nothing added, nothing taken away so back to the old days where you have the cream on the top you'll have that and a lot of people maybe who are lactose intolerant now I have no scientific evidence but people who have been lactose intolerant have tried my milk and I've had no effect on them. So it's great if you are lactose intolerant to try it out. It's a strange one. It's strange but I think it's because it doesn't go through the processes that there's nothing added, nothing taken away it's just simply pasteurised for a short period of time just to make it safe. So it's worth trying. It's worth trying. Definitely. Alright you see I'll be the opposite the cream forming on the top it was just one of them things that I grew up and and didn't like it for most people or for a lot of people it's they welcome it. Yes but the thing is you literally just give it a good check in the morning before you pour it out and that is it. It's just a shake back in through it all. Yeah and it's it's easier to froth as well if it's been used in coffee making. Yeah so I've got a since I've started open I've had a lot of coffee shops that came on board and they noticed massive difference of being able to froth and their coffee tastes is so much nicer and then I suppose we're becoming more sustainable so we're using glass bottles we're using milk churns so there's no plastic waste so that's where all these lovely businesses coming on board are loving that because everybody's wanting to become more sustainable now. Absolutely.  Use them and refill them and that my milk vending machine person buys their bottle once that's their bottle to keep and they just keep coming back with that bottle clean and refilled. Yeah again sustainable. Alright aren't you supply you mentioned cafes so you supply local businesses as well. Yeah yeah I've few places I've letterkinny or in letterkinny of Saunders of Balbofeve called Creamery I have three in Derry I have nine hostages Rosta Yum Yum Kicks and then I supplied to local coffee our farm shops like Belly Holy Farm as well and businesses growing I have a lot more coming on board now so I'm looking forward to it. Expanding. Yeah expanding every day yeah. And you also do flavored milks. Yes so basically you can get your customers can add different flavors so usually banana strawberry chocolate and vanilla on board and then I changed up every week every Friday roughly put two new specials out so like specials so like Easter had cream egg flavor and so on. How do you get a cream egg flavor into milk? It has to be tricky. You just buy these products. Sounds delicious. You're not giving away the secret. Yeah that's it. You've been a finalist in the blast in the hair and that's the competition for food here in Ireland and you've been a runner-up in the food Coast Onigal Enterprise Awards so you know you're no stranger to awards how did this one come about? I literally just got an email one Monday morning that I was being nominated IFA organization there they nominated me so it's just a shock through an email I couldn't believe it never knew of it and brilliant yeah it's fantastic it's great to be recognized to be nominated for it. Yeah absolutely so and what would you say to a young woman who are thinking about going into farming or more importantly I suppose women who are growing up on a farm and wouldn't even think about going into it as a career what would you say to them? I mean you're you're well down the road now so well see I've all I've from a young age I've grown up and I've always interested in farming I've always wanted to be in the farming industry no matter what and you were always encouraged?  I went off to Harbour Adams University over in England and studied five years of agriculture. Why over there? What's your unique about the uni? It's one of the top unis farming universities it's great recognition of getting jobs after it I went out over there for a few times to look at the campus for opening days and I just fell in love with the place and I just had my heart was set on it. And what sort of an experience was that? Oh fantastic you could out party life. I had a year out as well I got to work with two great businesses like Landerries and Premier Attrition so having a full year work experience is really really good so you're really fit in the door in the place and during my summer holidays too I went off to New Zealand for three months. So you've gathered up quite a bit of experience? Yeah and by time over there like I was always sorry your English friends they always went home with the weekends whilst Irish ones were always stuck over there by ourselves so the weekends we milked cows just to gather up a bit of money so were you were you real tortured then when you came back and you were going dad no no dad there's no there's a different way to do that but he loves that because he like we are the young generation coming ahead and he does take us on a board there's new technology out there he does eventually eventually but he does realise new technologies out there and you do have to improve to make a better sustainable farm. Yeah absolutely so yeah it's all going on selling the milk providing the milk to you know local cafes and businesses and also there there's the flavoured milk and now that the sun is out ice cream. Yeah so I'm working along with little mamas up in Donegal town so basically John has taken my milk and he's making ice cream out of my milk for me so that's my product and so that's sort of the next stage we're probably going into wholesale selling us on to other places. So he uses ice cream he sells ice cream and you're also selling ice cream from your shop. He's just making it for me he might have made his own for his own place but down the road you never know he might. Okay great and well the weather is good not just for ice cream sales but you know good for farmers as well as well I mean it must be a godsend. Oh definitely it makes life so much easier for us farmers too to get cows out full-time less feeding around the yard and everything and all that good weather you're busy doing other jobs as well of getting grass ready fertilizer out ready for silage the whole shebang so busy busy. You need a good spell and you know you've waited long enough for it like everybody else and reduces the cost of it as well.   Yeah absolutely. Yeah and when you were at uni was it was it was it was a lot of fellows? No you'd be surprised I was nearly 60% of ladies my class. Wow. Yeah so there's more ladies in my course studying agriculture than there was men. Brilliant. Yeah. Okay well listen good look here for the future obviously with the milk bar but also in this award we will keep an eye out to see how it goes not all about awards obviously but it's just nice to get recognition. Exactly and it's a great pleasure to be and thank you very much appreciate it. Not at all not at all and have you a website or can people find out how you Facebook and Instagram so it's the milk bar 2021 and if you're weekly updates of everything going on on it so yeah. And just to give people an idea as well as to where you're located because I did mention the science I've seen the science myself you know which is the people are. Yeah I am in the countryside I am.  Yeah no like I have school trips and I'll come out too as well like so it's great to get them out but I am out in the countryside but the reason why I wanted out in the countryside was for people to realize where the products coming from and then having the opportunity to do school trips getting to bring the kids out showing them the whole cycle of where calves are born to where the product actually comes from which is great because the kids nowadays don't know where the product is coming from where milk's coming from so. No you might think living in Donegal of course you know and they'll have seen it and they'll have had some experience but no not at all and even like having ag science like leaving their students out you know they learn from the textbook full time but I'm not a learner a book a person to read from the book but visually learn and getting to see exactly everything helps them to study better so I'm situated between Newton and St Johnson and Carrigan's about three kilometers in between the wall all right probably easiest way sometimes people would just go from Carrigan's where CCCP is and you'll see the signs from there follow the signs follow the signs okay well you know what I'm with you realize they're not you are a trendsetter when it comes to women in farming you know and and increasingly a role model for for girls and for young women thinking of heading into the sector so continue success Shannon Porter from the milk bar thank you thanks John thank you


To other parts of Africa now, a journalist who disappeared last month in Mali's northern city of Goa appeared in a video on Wednesday, appealing to authorities to do everything they can to free him from Islamist militants holding him hostage. French journalist Olivier Dubois said he was kidnapped by the gym on April 8th in a 21-second video shared in social media that has yet to be verified by authorities. Direct civilians have long been favoured targets for kidnapping by criminals and Islamist groups in West Africa's Arut Sahel region, partly because of perceptions that the French government is prepared to pay ransom to secure their release. France has repeatedly denied paying ransom for hostages. Hello. Hope you enjoyed the news. Please do subscribe to our YouTube channel and don't forget to hit the notification button so you get notified about fresh news updates.


Okay folks, Larry Pesavento for the mid-afternoon update for TFNN. We're looking at the mini E-mini S&P weekly chart. You can see the large ABC measuring here to 50.79. I mentioned at the beginning of the week this thing would not start down until we took out this low here at 49.34. We got to 49.37. We're now trading at 50.43. We made a higher high on the week. That was at 40.66, so we could have another 13 points or 10 points or 100 points more. I don't know, but this is an ABCD. We've also measured from the low to the high. That comes in just about now, the measure week to week. It was, I believe, let's just do it together here one more time just to be safe. Go from high to low. It was 20-week cycle there, so if you moved it over here just a little bit to double check to see what that would be, and you'd be looking at a 20-week cycle coming in here. Oh, gee, that didn't come until a second week in March. I didn't know that. That's strange. Well, nothing surprises me. Anyway, that was a 20-week cycle. We're still going up, so there's no reason. Now, I mentioned to everyone this morning the news was the PPI was not very good. The market dropped from 55 all the way down to 10. It dropped 45 handles, and then it rallied back. Folks, two things were against it for being down this week. One, it's Friday in and up week. Two, it's a day before a holiday. Those biases say that the market almost, not almost, but about 75% to 80% of the time. The day before a holiday, which is President's Day coming in on Monday, is an update and up close. So that's what we want now. If Monday or Tuesday is not an up close, that means that that cycle that had been there, and that hasn't failed very often, that means that something is wrong, and that's what you want to be looking for as a failure of those numbers coming in. As far as looking at this on a shorter-term basis, we see these swings up and down all the time. We'll be covering those on my part of the show that will be coming up here in a minute. Today will be Shane Smollion, TheWolfTrader.com, and we'll be having him on the air in just a minute. And stay tuned for a little more of TFNN trade what you see 24-7.