All right, so yeah, thank you So I'm gonna talk today about Escript and its memory hardness and this talk have been really seen as a continuation of Jeremiah's talk In the sense that I'm gonna tell you the other half of the story About memory hard functions and in particular talk about data dependent memory hard functions and which as script is one example So and I shall mention this is joint work with a set of amazing quarters Joel Alvin my PhD student Vinny Chen Cheshot Piatchak and Leo raising Leo and Joel also in the audience. You can also certainly ask them questions about it So I don't need to introduce the concept of a memory hard function anymore. So in particular Jeremiah has introduced the notion and let me just do one thing here. I have a problem with the screen All right, so I don't need to introduce the notion anymore here But for those of you that missed the talk or just came in just think of Dennis Moderately hard hash functions to be used in the context of password hashing or key derivation or proofs of work where moderate hardness is in terms of both time and most importantly memory consumption and There have been numerous practical designs that have been just mentioned that targeted memory hardness like Escript and Argon to D Argon to I Catena balloon hashing and many mores, but the focus of this talk is going to be on provable security once again so in particular provable security has been very effective in Validating real-world cryptography because it helps us in gaining extra confidence in particular against those attacks that we cannot envision yet but somehow in the context of memory hard functions and The password hashing competition where many of such designs have been proposed Things went a little bit differently mostly because we were lacking appropriate theory at that point in time or at least that's my assumption and Validation there as mostly occurred in terms of cryptanalysis and often enough intuition and As you have just seen there is now better and better theory to validate memory hard functions But we're still somewhat on a quest to find practical design that are also probably memory hard in the strongest possible sense So and if you want to close this gap, of course, there's two things you might try to do So one of them is what was advocated in the previous talk So we have a well-defined theoretical framework to design provably secure memory hard functions And we want to find those that are practical enough in this framework and that can be deployed But another alternative which is what we do in this work is that you can look around for designs that exist already in practice but that are out of reach for current techniques and but they resist attacks and maybe try to come up with a valid theory that Proves them secure and memory hard and this is exactly what we did in this work And we targeted a script and the main message here is positive So we provide a proof that the script function is optimally memory hard or ideally memory hard using the language from the previous talk And this is particularly surprising at first because well a script was the very first Candidate memory hard function It was introduced by Colin Percival in the very same paper in 2009 that introduced the notion of memory hard functions as we know it now It has found usage. So it is the object of our recently published RFC It is also used within cryptocurrencies for proofs of work It's using litecoin and other lesser cryptocurrencies and also It inspires other designs so you can find ideas from ascripts for example in argon 2d one of the two winners of the password hashing competition and Let me stress really that I mean this is interesting in practice, but also from a theoretical standpoint This is the first example of memory hard functions that we can prove optimally memory hard So even in theory not just in practice So let me put this a little bit in the context of the previous talk a lot has been reset already So I guess the main point here is that we distinguish between Memory hard functions that are data dependent and data independent right so data independent ones are those where the memory access patterns During the execution can depend on the input whereas I cannot depend on the input Whereas for data dependent they can depend on the input and ascript like argon 2d is an example of a data dependent one so so far The theory has been really focusing on Data independent designs are sure enough one reason is they have some attractive features that I'm going to talk a little bit More later resistance to side channels if you're concerned about that But a major point is also that from a theory standpoint as a much cleaner connection to graph peblings The Jeremiah has just illustrated that makes proving things much easier on the other hand Even though we just get we have this framework in place coming up with practical designs as you can see is work in progress Right, and we have even though this is the objective some controversy But we have attacks now that definitely show that there are structural weaknesses in practical designs that we already have On the other hand on the data dependent sign of things There's quite a lot we don't understand So we have designs around like ascript and argon 2d that seem to resist non-trivial Any non-trivial attack and speed up on the other hand we have absolutely no theory to understand why that's the case And they seem much harder to tackle and so that's exactly what we were concerned with here so a little bit more concretely What we target in When I say we analyze ascript we actually target an analysis of what is called romix, which is the core of the ascript function and It's a it's a hash function, which is a mode of operation for a simpler hash function She's not quite a hash function in the usual sense It's a build out of salsa and it's laying preserving but I'm going to obstruct the this is a just a hash function H and The structure is very simple So it starts with a single iteration of a hash function of the hash function H So you have an input m is going to become your first state x 0 Then you iterate the hash function to get n values x 0 up to x n minus 1 And then you apply the hash function once more to get what is the initial state of the second stage? The second stage is where the interesting things happen that ensure memory harness In particular we start by looking at the initial state as 0. Maybe you can't really from far It's a little bit small, but what you do is you now want to derive an integer between 1 0 and n minus 1 From the state as 0 you can do that for example by interpreting as 0 as an integer and then reducing it mod n and You interpret this as an index which points to one of the n values x 0 to x n minus 1 say points to 1 So you're going to take that value and now you're going to x or 18 to the state apply the hash function again And then you get the next state and so you can go on like this So you're going to do the same thing to the next state the revenue index say this case by accidents is the last one Take the value x or 18 to the state and go on and on until you get the final output now You have some parameter n here. There's no clear discussion. I think what are the right parameters for s crypt? I think suggestion. I've seen are things like n is equal to the 14 W which will be the length of the hashes so the size of the state Should be something like one kilobyte or larger, but I think like today's standards You might even want to have larger parameters All right, so we want to analyze this we want to prove with memory heart What that means is that we would like to prove a lower bound on the cumulative memory complexity There was already introduced in the previous talk So informally what it means is that we want to show that for every adverse or even parallel ones if we take the integral of this curve so we look at the memory consumption at every point in time and We sum them up. We want to show that this is large enough. Okay, and and This is lower bound for another metric which is less appropriate since it's less Resilience to amortization, which is the sd complexity which just looks at the maximum memory consumption times the time complexity So and we want to prove this And somehow we are very bad at proving lower bounds usually in crypto So what we need to do in these cases or the usual way out is that we are going to make some ideal assumption on the underlying hash function H and we model it as what we call a random oracle So we model it as a random hash function and then we just want to prove a lower bound on any parallel adversary They try to evaluate romics in this model That means we consider some adversary that takes as input a message on which he wants to evaluate the function And then proceeds in steps where in each step what he can do is he can submit a vector of queries So multiple parallel queries simultaneously to the random ideal hash function and also can keep some state For the next step and then in the next step the adversary is going to get this state He's going to get the responses to these queries and then this is over and over again And then just output something which ideally should be if the versa is correct for evaluating this the function should be the output of the function on input M right and then we want to Consider the cumulative memory complexity of such an adversary which typically we're going to model the memory size at every step by considering the size of us of a state as I and Plus we're also going to consider the size of the answers that the adversary gets back from the hash function queries This is very generous The adversary might need more memory, but we're going to prove a positive result a lower bound So it doesn't matter if the adversary uses even more memory then that's better for us Okay, so if we think about this metric now and we want to evaluate romics now there are two naive approaches that You could take to evaluate the function Okay, so the first one is you can just consider a naive sequential evaluation Which is what you will do when you run your function on your computer Which is you simply compute the values in the first phase and store them into memory And then when you get into the second phase What you're going to do as you're just going to take them from memory whenever you need them And they are going to be there and hence you can compute through the entire thing in linear time in a parameter n and The amount of memory that you need while it's as much memory as you need to store these n values that are w bit large So if you think now about our cumulative memory complexity you have a linear number of steps You can store up to n times w bits So the cumulative memory complexity is going to be n squared times w bits, right roughly. I'm omitting constants here Okay, now the other alternative strategy is that you say well, I don't want to waste any memory now And I want to do this with almost memory less So what you could do here instead is say, okay I'm just go through the chain at the beginning and don't remember anything get to the initial state of the second phase and Now see which value I actually need say for example now I see oh from my is zero I need the value x1 so now I'm going to recompute it Starting from x0 and I'm going to get that value and then add it into the state and then forget it and go on and then see What's the next value I going to recompute it and then just add it to the state and go on now These are a computation Recomputing can be expensive because we might have to do up to linear work to go through the chain again So an average say n over two steps. Okay, so overall we makes n square steps and However, the memory we keep is very small So if the order of w bits where w is the size of the state remember so again the cumulative memory complexity is something like n square times w Okay, so now we can start making some conjectures, which is what people have conjecture for long Which is that we have two extreme strategies one remembering everything sequential the other one Other one memory less so we could conjecture that now every other strategy might be at least as bad Right, but of course, they're just a conjecture and we really have no a priori. We wouldn't have no evidence Right, it could be that the real thing is like this Okay, so maybe there are some strategies that are much better than n square times w Okay, I know the plot is a little bit absurd, but it was kind of a theory talk So I thought they should put some plot just to make it more real wordsy I guess all right so so is the conjecture true or not and And so that's exactly what we confirmed so we confirmed that the conjecture is true at least up to so in multiplicative factor So what we show is that roughly for every possible adversarial strategy that wants to evaluate Romicks its cumulative memory complexity is going to be well roughly n square times w times a constant which is 1 over 25 and could be up for optimization in our proof and Also note that we don't quite get n square times w we get n square times w minus some Difference which is four times log n where n is the parameter that gives you the number of iteration This is somewhat inherent in our proof technique So there is a small loss even there even if you optimize the constant in front So we really can't get rid of it But not that it's not a big problem if you're concerned about a concrete parameter especially because typically w is quite huge So I'm like one kilobyte at least and log n should be at most 14 So you should not really be concerned too much about that for a log n, okay? Also note that despite the simplicity of this result. This is really not something easy to get there have been numerous Well numerous at least a few attempts to prove this result in the past For those of you who actually read Colin Percival's paper. I assume many of you Introducing a script. There is actually a proof there of memory harness for a script and it turns out I mean, I'm not going to go into it We have more evidence more evidence to it in the paper, but it's pretty much full-chloride by now that the proof is incorrect So there there is a bug there And also it targets a weaker security property than a weaker harness measure than cumulative memory complexity and there's also some previous work by myself and a partially overlapping set of co-authors that appeared at your crypt last year where we proved a weaker bound and for s great and That's weaker both quantitatively. It's it does it for short of being optimal and also it only holds for restricted Adversaries, I'm not going to go into it Now the important point here that was already addressed by Jeremiah is that this shows a separation between data dependent memory hard function and data independent ones so by result by by Jeremiah and Joel Alvin We know that for every data independent memory hard function there exists a strategy that Allow you to evaluate it with cumulative complexity, which is roughly n square times w over log n Whereas here we prove something of the other n square times w So there is a log n gap that is going to fall away Of course, we have to be honest here constants here matter and a log n and a constant factor Might end up being the same for reasonable ends But at least I seem to article you see that the difference can be substantial and you know With a similar constant you have to be careful about that because log n can be very large for reasonable parameters So why is proving something like this so difficult? So the main reason is that we are quite bad at dealing with bounded memory improvable security and We have to address the fact that an adversary that might evaluate this function arbitrarily We want to show that it's hard for any possible such adversary Tries to memorize partial information about the execution and could do whatever he likes to do that And so these states these intermediate states could be really arbitrary and we have to think about that in the IMHF case The proof was much simpler somehow because the very nice elegant reduction to graph paddling works The problem is that this trick really requires you that the data dependencies in the computation are all known a priori Something which we don't have here In fact the security of something like romix or script or argon 2d really depends on data dependencies being unpredictable Otherwise you cannot get as high security as we get The intuition indeed is that the reason why this thing is memory hard is that Once you move to the second stage this indices that you have to go fetch for which you have to go fetch values from the first phase are Unpredictable until you compute them and so in order to be ready to proceed fast You need to have many of these values stored in memory already Otherwise you're going to be stuck and need to recompute things And so that's why the intuition I just want to give you a four minute five minute intuition about why Escript is memory hard is to really think about the following game where you're thinking about the evaluation of romix think about having a game Between a challenger and an adversary the adversary learns the initial value x0 Can make queries to the random hash function the random oracle and now the challenger in the game proceeds in rounds and an each round Gives to the adversary a random challenge, which is an integer between 0 and n minus 1 and The goal of the adversary is to come up With possible using as less as few memory as few memory bits as possible with the value indexed by that challenge in the initial chain Okay, so I'm abstracting away completely the second phase of Romix with the idea that it's really about getting these challenges that are unpredictable and Going and fetch that particular value and now the adversary want to go through all of the challenges and be able to compute So in fact we can make an extra step here just for the purpose of this talk Which is very intuitive and even model a simpler version of this game where the adversary only remembers similar to the pebbling case Just the values Just values x0 to xn minus 1 or a subset of them and so we can really think of this also as a special case of a pebbling game or a variant of a pebbling game where we look at the line simply and Putting a pebble on a particular node on the line with nodes from 0 to n minus 1 Indicates remember in the corresponding value xi if you have a pebble on node i and then you have the same rule as in the pebbling game we had in the previous talk and In particular multiple moves can be done in parallel So something the adversary could do in trying to evaluate it will start by putting always a pebble on the first node Then you could add pebbles you could move pebbles Nobody's put a pebble next to a pebble which is already there and moving parallel to support parallelism of the strategy Right and so in particular the challenge that the round game with challenges in the setting will simply have now The adversary learning a challenge at every round say for example here for and now the goal is to put a pebble on four For example now this will be done in four steps If you don't have anything on the line because you have to start by putting a pebble and then move step after step Then say you get another challenge now you have to put more another pebble move there into step But now if you get another challenge on six now You're lucky you have a pebble nearby in four and you can move fairly quickly to six right and you're interested now in Seeing what's the complexity of an adversary to go through this game and in particular note here that the memory complexity The particular stage corresponds roughly to the number of pebbles times the number of bits to store a value and now We want to lower bound the complexity of any strategy that successfully goes through this game and again This is completely arbitrary the strategy could be and will do anything so it will have different amounts of pebbles a different stage Whenever he gets a new challenge, you could have a different number and a different subset of pebbles on the line And it will take different amounts of times to answer that challenge And so we will like to show that no matter what we do. There's a lower bound which is squared in N For the curve here, which is defined by the red lines So this is the core of our proof and The basic idea here is that Whenever you have a certain pebbling configuration and you learn the challenge The time you need to answer that challenge is inversely proportional to the pebbles you have on the line This is quite natural because if you have a certain set of pebbles have so much time, okay? Oh five, okay. Good. So Yeah, I think I'm gonna be faster. So If you look at the set of pebbles that you have here on the line There could be anything say you have P of them and now you want to see how many Challenges you could answer within a certain amount of time steps say two time steps In fact, we count these as three in the paper Then there are only so many challenges. So any challenge of landing does this Highlighted area who'll be answered within three steps anything else requires more time and So if you do the math what you see is that this gives you a very nice probabilistic trade-off Where we see that what at least with probability one half The time that you need to answer the challenge the probabilities over the choice of the challenge It's at least n over or larger than n over twice the number of pebbles you have or in other words What that means is that we probability one half You have a trade-off in the form that the time you need to answer the challenge times The number of pebbles that you have on the line is at least n over 2 Right, so this takes us much closer to what we want, but we are not quite there yet In particular what this means now assuming that this trade-off just for the simplicity of my explanation to make it simpler Holes for every challenge What this means is that if we look now at the amount of pebbles that the adversary has on the line Every time a new challenge is revealed And now we look at the rectangles that are defined by taking as a height this number of pebbles And the width of the rectangle is the time it takes to answer that challenge Then what this trade-off tells us is that the area of these rectangles of all of them What is all of them for which is probabilistic trade-off holes is at least a linear in n So if you have n challenges now, it's intuitive to think that the overall area should be n square Unfortunately, that's not quite what we need because we need to look at this curve Which is defined by the amount of pebbles we have at every time and we have no guarantee that after an adversary learns a challenge You might just not drop everything it has and just remember for example the closest pebble to the challenge and forget about everything else In fact for the last challenge, for example, that's the most reasonable thing to do everything else will be rather stupid So Which that means is that the area which is the blue area here is n squared, but we need to lower bound the the area Which is defined by the red histograms Now I'm not gonna go into details how we do this But the basic idea and that's one of our two major technical contributions here Is to look not at the area that we have under the curve after the challenge is revealed But to realize that in order to have a number of pebbles, which is fairly high Then we need to put them there and so there is some work that we need to do And so what we look at is not at the drop or the behavior of the curve after we learn the challenge But we use a generalized version of the trade-off to look at what happens before we learn the challenge The other main challenge of course that I haven't talked about is that here I am looking at the simplified version in terms of pebbling but obviously we want to deal with adversaries that can store any type of information about the previous states of the execution and That's required some more technical work, which I'm not going to talk about here But that's very important now. I have some lengthier conclusions here that I want to start going through So the first one is that I think this is very it's an important result because it's a good example of an interesting theory problem that however validates a very practical design I just have a quote here from Phil Rogo with essay on the moral characters of cryptographic work Where in fact he motivates this as one of an important line of work to try to understand these modes But that's not the one the only one thing here So it is really it only gives it gives us also a very good example of a practical design with strong provable memory harness guarantees and also the first one which is really practical and as such provable guarantees and also it's really the first example even in theory of an Optimal in memory hard MHF now a question you might ask because I've been focusing on s-crypt and romix is what about argon 2d? So argon 2d for those of you who are familiar with it as a very similar design to s-crypt the main difference being that you don't have such two phases of Of execution, but you have a sliding window of values that you're going to use and point back to to insert in the execution Now we don't have this written down in the paper That's why I have a star but the same technique should easily give the same lower bound But so we don't have this in written yet. Okay now Another thing that I wanted to say is that that also came up in the previous talk is About the issue of DMHF versus IMHF so data dependent memory hard function versus data independent memory hard function so at least from With respect to the goal of achieving High and optimal memory harness in a provable sense so DMHF seems to be easier to get right and Also provably achieve a higher memory harness at least in a asymptotic sense So the main problem here that you might face Despite the fact that they're also harder to prove Memory hard but other than that of course the main concern are side channels and this is something that was also mentioned by Jeremiah There are a possible concern your memory access patterns do depend on the input and so Here the main point is that you should be really assessing Whether in the application you're looking at you're more concerned about memory harness being strong Or whether you're concerned about possible side channels So there are applications like proofs of work where for sure side channels do not seem relevant at all For password hashing what you have to see but if you're not concerned about that then there's really no reason why you shouldn't be using data dependent memory hard function since the guarantees really seem to be stronger and Finally just a few words about proofs So I really think that there's been some debate also for those of you that follow CFRG On the role of proofs in the context of memory harness. I really think they are important So if you have a mode that has a proof And is as efficient as one without I don't think there's any reason to discard the one without with the proof And of course, it's not the only thing. There's a lot of interesting questions Related to how tight these proofs are and whether the models are the best ones but still I think the proof remains an important component and Of course when I say proofs I mean you have to target concrete security and be as concrete as possible, especially in this domain We're speeding up things by a constant factor really matter and makes an impact You have to really work and make an effort into having bounds that are as tight as possible Okay, so that's actually everything I wanted to say so there is a paper on imprint About the results so feel free to have a look With a quick question. So there there was a constant in front of your bound, right? So does that give any inspiration for a new attack that would be a small constant factor speed up? I Don't think this is really tight. I mean if there are as many ways of Like relaxing things in the proof that might make might make things a little bit better So for example Yeah, just requiring that the usage of memory is slightly higher try to prove So it's not clear really and there's some work there that should be done and try to tighten them up So I don't think one over 25 is the final answer


So I made some menacing steak and cheese egg rolls and CJ over here. We're making Cajun crappy fish tacos that Joe and I caught two hours ago. It doesn't get much fresher than that. That's the deal. So stay tuned guys as this is cooking and we'll show you the prep work too. It's the wife. Why is she waiting? Really? Yeah. Oh, it's a bagel? Oh, yeah. One day I couldn't even get the, I couldn't even get the lower down. It would get down, the lower. It'd get down five feet above the bottom and it would just stop and I'd go. Yeah, those were the good old days. What's happening?  And it happened five or six times. I took, this was not all too smart of me, but I caught a huge toad. Huge. Bigger than the fishing pole. The jig pole. And I'm self-conscious. Just don't cut your tongue. We'll have to make a fail video. Thank you much meat there. You're good. You can usually see through them when you're done. You are. Nice. Thank you. How do you do the knife stuff? Thank you. I don't really pay attention to what I'm trying to do.  You're on YouTube? Oh, on YouTube. You didn't follow our Instagram page first. No. My friends followed them before I did. It's funny how that works sometimes. I'm going to speed this video up to like six times fast. You're going to think you're the fastest lawyer. Yeah. I don't feel like it's going as good as you know. Deliciousness right there. Couple nice chunks of meat there. Who shot this deer? This one's mine. Nice. Your first soul deer. Was that this year? Well, last year I was alone too. This year I did a lot of like scouting myself. And he was guiding moose hunts. So I had to go out on my own a lot. And so this time it was like start to finish my own, I guess. That's great. I must have been proud. Yeah. Oh, you were? Nice. Let's see. Last year you shot a big one too. Yeah, last year was, that was a patch buck. This year was not, not as big as I had thought it was going to be. We actually weren't, we weren't really sure exactly which one it was. We have cameras out and stuff. And I thought it was a bigger deer. And just walking up to it, I looked at him and I'm like, it's not the one. You got it on me there. Nice. Nice deer. Yeah. Right, going with some Louisiana deer over there. Yeah, that's a booty. Is that a sponsor? Picked up a new sponsor, Louisiana. Cajun. Some breadcrumbs. Put them together for the crunch. This is a lot more sophisticated catching cook than I posted the other day. Put a stick through a brook trout and started a smudge fire on the ice. Yeah. Yeah, that one was smoked. Yeah, it was more smoked than it wasn't really cooked either. It really didn't even look that delicious. You could see the look on your face. At 28 below, anything tastes decent. Everything tastes better on the ice. I buried breakfast sandwiches. That was one of my favorite parts of fishing. Yeah. I know breakfast burrito is breakfast sandwiches. Kyle always makes the best breakfast sandwiches. Even just plain old medicine on the ground. Yeah. Just tastes so much better. Because you're hungry. Your body's so cold. But it tastes better too. A couple of eggs. I'll see you later. Yep. What's your favorite state you've ever been to? Oh, outside of Maine? Yeah. Can fish? Ice fishing or open water fishing? Whatever. That's tough. Probably Alabama. Really? Yeah. I loved it. Yep. I've only ice fished in one place outside of Maine. That was Minnesota. I don't have a lot to do. But probably the best crappy fishing right here in Maine. Yeah. Both numbers and size. From the people I talk to, it sure is. Yeah. I hit that one. Oh, that's better. Nice. This looks beautiful.  No. No, I'm pretty excited about them. I heard about them yesterday. What do you like better, that or that? State cheese. Wow, you just told me how much you like steak. The fish tacos. I was shocked. This is looking tremendous. I'm really just figuring out how good this looks. It sounded good. It's so simple, but... It sounded good, but now it's like... The light bulb just went off for me. My mouth is watering right now. The light bulb definitely just went off when you rolled that one. I was like, oh my God. I'm excited. Yeah, I didn't think I was all that hungry last night until those were made and I tried one and I went, I'm gonna eat three more of these. So I ate three more. I'll do these with... I'll use a ground up venison, but then I'll do it like spring roll style with cabbage and carrots and stuff like that. With the ground up? Yeah. And then we'll take them out on the ice and reheat them for our clients. They must go crazy. So John... John's like a phenomenal cook. He loves cooking. He's bringing... He's bringing his pizza. Prime rib, sausage, English muffins and cheese. Dan's bringing eggs. I figured we could do a breakfast for lunch tomorrow. Oh yeah. Holy cow. Yeah. So we're just gonna be rolling onto the ice in the morning and rolling off the ice. So tomorrow's video is gonna be pretty incredible then. We don't even have to catch a fish. I might have to call out of work. Yeah, I would call out of work. I feel cold coming off. You got the rolling on. I remember this was a long time ago. So we were chasing traps and I think this one did... I don't think the flag really went off too well. And remember getting to the hole and lifting it up because I think we were about to leave, I think, and I lifted up. The spool was gone. The spool was?  So I was sinking. And I still think about it sometimes. How big that fish must have been to break off a spool. Big. Had it with that. But it never tripped the flag? It just grew there somewhere. It grew there. But I think I can only make one more. Not enough steak. I've never had homemade egg rolls. This is pretty exciting. They're way easier than you would expect. Yeah, it doesn't look terrible. No, they're not bad at all. You can get these wraps anywhere. I got these at home on them. Boy, my mouth is watering right now. Oh, why it's fired up? It's so good. I am excited. Holy cow, looking pretty good. So those are the low calorie... I can do it. That's the healthy version of dinner. This is going to be the... That doesn't look that... Oh, we're deep frying these babies. That's alright. You'll be working up the Joe's Ice Cream Shop making egg rolls. Oh my God. You'll have Donnie doing donuts. You'll be doing egg rolls. That place will be packed. He's not that sponsored. He does that a lot. He cooks incredible. That's awesome. These are looking great. Yeah. That's looking incredible. What's that about? What are they? These are venison's sake and cheese egg rolls. Nice. Donnie's catch. Oh, they're not burning. They're looking good, though. They're almost there. They'll get much fresher than that, buddy. You caught those a couple of hours ago. We caught those a couple of hours ago. That's true. Alright, guys. You're here to watch this. This is probably the best part of the catch and cook coming up is the catch cook and then eat part. We'll actually let you know that. Wyatt, what do you think, buddy? Passes the test? 10 out of 10. 10 out of 10? This is like nothing. Probably the best main surf and turf you can get. Oh, yeah. Venison and crab. Venison and crab. It doesn't get too much better than that. In my world, it doesn't. Right?  Yeah. We're going to watch this fish talkin'. Wyatt, you're going to make a fish talkin'? Nope. I'm getting mine made. Thank you. Pretty simple. Oh. You want some of that? No, no. Do you want the salsa? Homemade salsa? It's not into avocados. I'm the only one that likes avocados. How do you... Oh, it's like glue. It's like glue. It's like Elmer's glue. I'm going to try the secret sauce. Looks pretty incredible, guys. It is. Dig in. Yeah. You know you're efficient when you have to move the electronics off the table to eat. Oh, great. I can try one of these things first off. That is good. So they're pretty good alone. But you can also do some of this ranch secret sauce. That is good. Yeah. Well, it's funny. You're going to get much better. This stuff's good, too. I told you last night without our youngest kids eating this and everybody enjoying it. It's like awesome. It's an awesome feeling. You brought home and everybody like... Yeah. Yeah, Anna's shooting the deer or you're shooting the deer or moose or catching the fish. That's just amazing. The fact that everybody loves it and it's organic and free range. People need to understand. I'm preaching. Well, yes and no. Not many times we have to do Cabela's. Exactly. Yeah, once you start adding up life scopes and snowmobiles and... Yeah. But that's why you got to eat more fish. That's one of the best things I've ever eaten in my life. That is so good. Now you see why I was so excited. Yeah, I would have never even dreamt this up. That... Holy cow. So simple. Delicious. This is something I think I would eat every single day and every yesterday night. Yeah, you can't buy something that good. Fish taco, crappy fish taco. Lucky or we guys. Seriously, this is like gourmet gourmet. I'm pretty lucky. I am really lucky to be here. Thank you guys so much for having me for dinner and this incredible meal. Thank you for coming. Well, my pleasure. We were just talking about falling through the ice and beaver trapping. I remember, I'll tell you guys a story when I beaver trapped. I beaver trapped with the guy that taught me just tremendous outdoorsman. He was competitive. So we would get on ice way before we should have. Like he was thin. He was about your size. Maybe a little skinnier. So the rule is whoever doesn't weigh the most has to go out on the ice first. The other guy stands on shore with a rope tied around his waist. That's how thin ice we were on. A lot of times he's walking on like the logs on top of the ice, you know, trying to get out further to get where you need to trap these beaver. And I remember poor Skip would be out there and you could just hear it cracking. You know he's going under and through. And I'd give that rope a little yank. You know, and he'd pull back and he'd turn around. He was so mad at me. Stop it. He'd swear he'd reach for a sidearm when I'd do that. But that's the one rule I had when I beaver trapped is never trap with anybody heavier than you. Because the lightest guy goes out first. When I trap beaver, I think the year before I was like five to ten dollars a pelt and it's just not worth it. But I did it anyway. I don't even care. Have you ever heard of Oscar Crom? So Oscar taught me how to skin beaver. He taught me most of what I know about trap. Just at his store, at his counter at his store he'd go in for hours. He'd just tell me, and I'd just soak to him like a sponge. And he would hike in like you were just saying, like crazy far into these bogs. And he would trap and remake the trap after he'd catch one. And Edie, his wife would sit down on her pack basket and she would clean skin that beaver in like 20 minutes. So he wouldn't have to drag it out.  But then you roll in the snow. It's like a sponge where you roll in that snow and the snow will grab all that liquid water. And it saved me quite a few days of not having to go home or back to the camp. Even if you put a boot through and just fall over and put your leg up and then roll in the snow and it would pack snow around and it would take the water off. And catch a beaver rolling around the snow a couple of times and it tastes dry. Exactly, same thing. Like that's what we knew. You'd pull it out 20 below zero rather than having ice cold or pulling fur off or anything. I remember like I was good at skinning and it's a challenge to skin beaver with the fat and everything and I hated fleshing so I tried to clean skin. And I remember like Skip and I sat and we set a pile of traps and he knew what he was doing. I didn't know what I was doing. I think we got like one and it took me like two hours to put it up, like to clean skin it and put it up on the board and everything. Like two days later I went to check the traps all alone. It was like the first through check at all our sets and we caught 19 beavers that day. And I was driving back to the warden camp because that's where we were staying up near Clayton Lake. I remember doing the math and I'm like, alright so two hours two hours times 19 beavers if I start now and don't stop to eat or anything back in a week. And I was like something's gonna change so I remember an Oscar telling me how Edie did it and she'd sit down and put that right over her lap and right in front of her and how she'd clean skin it. And I got down to 26 minutes where I could clean skin a full size beaver but still like eight hours of skinning right there and $5. But you know it was always like $5 or $10 for a hide for a beaver felt. No one would trap so then we'd trap hard and then you get paid like we get paid like we probably averaged I bet you we averaged $35 on beaver like we got some for like as high as like $80 you know and some every once in a while would be like $10 if you catch a kid so we never left the previous years prices in the forecast for us from the trap. Just because we loved doing like if the state knew it I would have paid every cent to them to do what I did. But it gets to a point where you find I naturally know like this isn't an hobby I need to keep anymore. I will never recover from this. Oh boy, now I'm starting to say again. Because it won't, you won't. Like I told you I sold a Fisher, two Fox about nine big prime coon with my coon items that year we selected what we shot we didn't shoot a lot of coon because they weren't worth anything so we leveled all of them out that was just after the rabies went through and their numbers were way down and we shot nine prime coon I think I trapped two or three or four I just kind of did a dub it off I sold my bird of Kimbells, it was pin and I think I made like sixty dollars on all my fare I came home that afternoon and I had a great big buck mink in my trap and I looked at him you're not worth killing buddy I let it go and I haven't trapped sense no it wasn't so much the fare price it was just it got to be a sport that I loved but I couldn't afford to do anymore you know I used to be making I used to make enough money that I would buy my family Christmas presents it wasn't a lot but to Mayor Kimbells you'd trade some of your fare for de-skin gloves or you'd go and you'd have a little chest and you'd buy some little trinket or something for your family I remember one year my grandmother told me I said I'm saving all my money for a snowman so I could be the trap and she said don't be stingy remember when you do good things for people and people do good things for you well unbeknownst to me I had a snowman on the Christmas side the family got together and held me that was awesome that was the last year I had a trap alright that is going to do it for tonight full belly incredible food, incredible time with friends really looking forward to getting after some more big slab crappy tomorrow might even go after some rainbows so should be a great day I'm going to try to do a little more reading last night I just really got into this book and stayed up a lot later than I was expecting to but not sure if I can tell you what this book is I'll have to ask the author but this is the beta copy that I've been working on helping on like an edit or a read through so I found a lot of stuff that could be helpful for him last night but the story is just awesome so it's been a great read and a lot of fun to read too so I'm kind of excited to get back into it and be able to help out a little bit with some editing and also to follow along with the story but follow along with my story thanks for tuning in guys that was just an awesome day with CJ I really really enjoy fishing with him he likes to hunt him down the way I do and just go after him hard the first lake we got out there and we caught a pile of fish tons and tons and tons of smaller crappy that most places would be happy with those 10 to 12 inches and then we moved and he made a really good decision not to fish on that unsafe ice and we moved to another pond and we really got into him there out over some deep water the quality was a lot better we were catching probably an average of about 14 inches and 1 over 15 which is always a plus great big slab so tomorrow we're going after him gonna try to get you something big big on film like over 16 thanks for tuning in guys thanks for following along with this truck camping adventure maybe get 2 more days out of it we'll see you on the next one


So, let's say the question was the following. They wanted us to factor this expression, right? Factor this polynomial. And it's 2x to the power of 5 plus x to the power of 4 minus 2x minus 1. So what we're going to do is lay this out in the synthetic division form. We'll probably do it down here because it's transferred numbers down. And the possible factors of this are going to be possible factors of 1 divided by possible factors of 2.  So we're very limited as to the possible factors that we can try for this. And keep in mind these are just the factors that we can try manually. There may be other factors there but we just can't do them manually using synthetic division anyway. So possible factors of 1, plus or minus 1 divided by possible factors of 2 and we're going to lay down the whole thing here. What we got is possible factors of 1 which is plus or minus 1 divided by possible factors of 2 which is plus or minus 1 and plus or minus 2. Now divided by plus or minus 1 it's just whatever the possible factors of the last term are. We lay down our division statement here or our synthetic division coefficients, right? For the synthetic division. And keep in mind everything has to be in descending order, right? So that's x to the power of 5, x to the power of 4. We're missing x cubed and we're missing x squared so we're going to have to put place markers here. So we put a 0 for x cubed, 0 for x squared and we got negative 2 and negative 1. So we actually have 1, 2, 3, 4, 5, 6 terms. We always have one extra term than whatever the power is, right? So what we're going to do is just lay down our synthetic division statement the lines here and we're going to choose x is equal to 1 and go through the synthetic division form. What we got here is we're going to try x is equal to 1 and that means we're trying to see if x minus 1 is a possible factor of this guy, the polynomial, right? Which is what we're trying to do. We're trying to factor this expression here. So what we're going to do is take the 2, drop it down, multiply it by 1, goes up here add those 2 together, bring it down, multiply it by 1, comes up here and just do the zigzag and I'm just going to lay the whole thing out right now, right? And every time we're going across this way, we're multiplying whatever was here by 1 and we're going to see what we end up with. So during this long division, we just go zigzag, zigzag, zigzag and keep in mind I mentioned this in when we're doing the polynomial long division with putting the place markers in where for polynomial long division we really didn't have to put place markers in. It's good to do it because it prevents you from making mistakes but for polynomial long division it's fairly simple. You just can't add terms that don't have the same power, right? You can only add like terms. So if you keep that in mind, especially from series 2, we talked about that if you keep in mind that you can only add like terms especially for polynomial long division then you won't really make too many mistakes of adding different powers together. But we still ended up putting place markers because we want to line everything up. That's what we're doing here too. We're putting the place markers just to line everything up just to make sure everything's in descending order. The problem arises with the place markers is if this power up here was extremely large, let's say it was power to, you know, x, it was 2x to the power of 27 and then we went to the power 4.   You're not going to do that. What you can do is realize that whatever you're multiplying this guy with when you're going across, it just multiplies. When you're adding them, it's just the same term coming down, right? So what you could do is keep in mind where, let's say this guy, this is 3, this is 3 going up to a 0, right? If you add those two guys, that's 3 again, and that multiplies whatever is here. So if that was a 2, the 2 multiplies here. If that was a 0 again, you add it. And if you add another 0 here, you're multiplying it by 2 again. So what you could do is multiply, figure out how many terms you're missing and take whatever this is and take it to that power and then multiply it by these guys. Now, I'm not going to get into that, because I've never seen problems like that coming up. They're not going to give you, you know, in general, you're not going to get an expression where, you know, x to the power of 27 missing all the middle terms and, you know, goes down to x to the power of 4. So if this comes up, if people have problems with it, if this question comes up, I will make a video of how you go ahead and do that and figure out what you have to multiply, you know, the last term that you had here before you started having to place markers until you get to the next term where you don't have a place marker. But right now, we're just going to leave it alone and just use place markers for it, okay? So what we ended up doing is, you know, doing our synthetic division, getting a remainder of 0, right? So that means x minus 1 is a factor of the top guy. And what we end up having down here is our quotient when we, you know, we're basically dividing this guy by x minus 1. And what we did was this was x to the power of 5. We took out an x from it. So what we've done is our quotient now starts with x to the power of 4. So all those numbers there, they're the constants, the coefficients in front of the variables. So I'm just going to write those down right where the numbers are because I don't want to continuously write down all the numbers again and write the x's there, right? So I'm going to write those down with pink chalk. So we're going to write it down with pink chalk and those become our variables for our coefficient and the last term is going to be our constant. So we've kicked down our original polynomial by 1 degree. And what we're going to have to end up doing is factoring this guy using synthetic division and the factors of this guy are possible factors of this guy divided by possible factors of that guy. Same deal as this guy. So what we have is it becomes 2x to the power of 4 plus 3x cubed plus 3x squared plus 3x plus 1. And we don't have any missing terms. So what we're going to do is just do straight out long synthetic division as well again. Now possible factors of this guy are possible factors of this guy divided by possible factors of this guy which is plus or minus 1 divided by plus or minus 1 or plus or minus 2. And what we're going to do is try positive 1 again. So x equals positive 1. And I'm just going to lay down the synthetic division statement, you know, the lines right here and just continue from there that way we're saving space. So what we're doing, we're trying to see if x minus 1 is a double factor of this guy. You know, a polynomial could have the same thing again. And all you would do if it was, if x minus 1 was a double factor of this guy, you would go x minus 1 all squared is a possible factor of this. So we're going to go ahead, I'm just going to go ahead and just do this whole thing and find out what the end result is. To see if x equals 1 is again a factor of this quotient here, this polynomial here. Which would mean it's also a factor of that guy. So what we end up having is x equals 1 is not a factor of this guy. So we already divided. We found out x minus 1 was a factor of this guy. Reduce that guy to a new polynomial, right? And we just found out x minus 1, x equals 1 is not a possible factor of that guy because the remainder is not 0. The remainder ends up being 12. So x minus 1 is not a factor of this guy. So we already checked, we already tried one of the possible factors of this polynomial. What we're going to do is try another one.  So we're going to do that one and see where that goes. So I'm going to go ahead and just do the synthetic division here and that's x is equal to negative 1. So the 2 comes down, multiplies negative 1, goes up here, add them together, multiply negative 1, continue, continue, continue to see what we end up. Doing the synthetic division, we ended up with a 0. So now we know x is equal to negative 1 is a possible factor of this guy, which means it's also a possible factor of this guy. What we have right now, so far we found 2 factors, which is x minus 1 and x plus 1 are factors of this guy. And what we've done is we've divided, you know, x to the power of 4. Is that x to the power of 4? It's x to the power of 4. We've divided x to the power of 4 by an x. So our next term here is x cubed. So that's going to be 2x cubed plus x squared plus 2x plus 1. And always remember, if any of these were negative, that means they're minus, they're not pluses, right? The sign in front of the number goes with the number. Now what we're going to do is continue our synthetic division and try to find possible factors of this. Possible factors of this are plus or minus 1 divided by plus or minus 1 and plus or minus 2, right? Same deal as here. I just picked the polynomial where it was going to be easy to figure out what the factors were, right? Now what I've done is I'm running out of blue chalk. So we're going to change colors. And we haven't used green on here. So green, you can picture green as being blue. So green is going to take over and we're going to do the long division for this or synthetic division for this using green, okay? And what we're going to do is try 1 again. Okay, let's start off with 1. Or you know what? 1 we know is not going to work because all of these are positive. If we multiply everything by 1, then everything's being added together. So there's no way we're going to get a number here where the remainder is going to be equal to 0. So what we're going to do is try x is equal to negative 1.


Is it better? Oh, yeah, much better. Thank you so We're gonna talk about command and control through web hooks and That's going to be a big eyed lemur edition talk. I don't know why it is, but I like lemurs for some reason so The big words out of the way what we're trying to accomplish here We're talking about web hooks, but essentially from the tactical standpoint It's a red team and pentester challenge as Loran talk was talking about is when you're on site if you're in situation where You need to create command and control. It's a it's always a challenge especially in secure environments and The problem of outbound communication is that we're we're gonna try to solve a little bit We're gonna go over HTTP web hooks concept And we're gonna try to establish a synchronous one or two-way communication with C2 command and control over web hooks And but from strategic standpoint really what we're trying to do is meet the blue team at their map of the world They are operating in a certain way and all we have to do is just adapt and overcome and that's we're gonna try to do that We're gonna try to feed off the land and Maximize the retooling capability on site I Was introduced but essentially I have to say that my opinions are mine nobody else's and apparently Watson agrees with me, which is good So enough about me meet Misha the pentester real deal he likes grasshoppers He lives to eat them. He gets paid by grasshoppers and that's all he really cares about But really Misha's Day starts at nine o'clock, you know you plug in you get an IP.   Well almost and To Misha lunch is very popular. So, you know, he wants to get to his lunch as fast as possible but Before Misha can actually go to McDonald's and order his number six with the grasshoppers and a meal He has a job to do, you know, we're not going to concentrate on anything that he does internally before the Exfiltration we're going to talk about that specific topic here So 9 30 in the morning Misha has gotten the admin Misha has Probably gotten some of the data from from a company and tries to Get it out Get to his C2 or whatever the case may be. He's not able to do that, right? He's frustrated. What does he do? Essentially, you know, he's got lots of options, right? You know Kimberley says ain't nobody got time for that and you know, Misha likes that very much because Kimberley is really super cool So egress filtering, right? It's It's easy for pentester. There are so many things to do There is really no challenge here until you get to the point where all your Tunneling is is watched over Your DNS ICMP, you know, obviously you can shell out Outside, you know, you can't get web-based shell and you can't access the cloud drives All right, so you're prepared for it, right? Because no one does the blanket the egress filtering you can get to to your C2 through cloud-fronted domains Cloud-fronted domains are the ones that are basically, you know in a cloud and then, you know on providers That are accessible like AWS or whatnot.  So he's done, right? There is nothing he can do Blue team says Not really, you know, you've got no friends here. You're done. Misha go home Eat your lunch or order number six if you can afford it.  You know, he is not thinking straight So what we're trying for him to do is to think out of outside the box. What does that even mean? Well assess the situation look around you. What is available? What can you use? Being in this specific situation in this specific company, what can you do? And you are on developer Network, there are developers out there. For example, Misha hears that They're pushing some code here and there. They're using some things called Webhooks Misha doesn't know what webhooks are. So let's let's take a look at this, right? What those webhooks are before we move on further so webhooks So the old way that we check For what we send the request to web server and we check for a response We say, you know, every five seconds, we're gonna go out and say, hey, are you done finishing? You know doing what we're tasked you to do the web server and then we keep looping until we get the response So naturally, you know, web server is not really happy with us. So in some time We'll get the response and then server is Okay, until the next time we start start asking him questions stupid questions really So The web server Says, hey, you know what stop asking me. Why don't I tell you when I'm done? processing your request this is what the new way of doing webhooks really is you submit a Request for processing and when the processing is complete Web server just says, okay, we'll give me the link to post the response back to you Well, here's the link when you're done posted back to me No problem.  So no more You know aggravated servers and you're happy So what do we do? The link that we post in the web hook Is just an action and a method or some variation of the same and then on the client will listen to You know for that sort of request or response rather from the server And we have a callback that has you know, we'll launch in the background to listen for it So who uses webhooks? It's nice and therefore The developers are using them right continuous integration Heroku just yesterday came out with a new CI service for themselves, you know github slack Any notification services like Peter Judy data dog and you know internal teams as well So hey, Misha is excited. He likes to learn about new things webhooks seem to be cool And you know, Misha being Misha. He still likes grasshoppers right for some reason. So he thinks about lunch all the time and so, you know things Started to kind of click a little bit right with our help So we start looking at what can we do with these web web hooks while we're on the inside? There are developer sites. They're using web hooks, you know, can we can can we use? This technology or this trick for C2 contact, right? Yes, right and so Misha is a little bit more excited here. You know, he's got his thought process Started and so We're talking about C2 broker, right C2 C2 is somewhere on the other side of the planet How did we broker this information? So the traits of broker? C2 broker is it needs to be public right because you need to get out to a site that Is visible and then that site needs to post somewhere else that is also public. It needs to see a decent set of web hook functionality so we can be a little bit more flexible and Most importantly for the red teams is that we have to blend into the traffic, right? You know things that are being watched. So whatever we can do to maximize our chances to get out safely That's what we're gonna do and so in this case specific case with proxy content management in the middle We want to be on a you know on a good behavior with proxies.  How about back to github slack and all the other ones they're public They're visible. They have good API and so you can try right? So you're in scenarios. We're not allowed to connect outbound with web content proxies. We've established that You lost the tools on the inside you need to bring them in How do you do that? That may be one of your scenarios to use web hooks to do that Or if you're a little bit more advanced in this regard then you want to switch The direction of your C2 and have the C2 on the inside when you connect from the outside You can also do that. So let's build you a tool to get you go and Misha, right? So really nice Intermediate C2 broker is a cat site of you know of some sort and Misha does not really like cats but and Actually, Misha doesn't like cats with eight legs either But if Misha can take advantage of that site, then you know, he'll be happy Right so let's go ahead and evaluate a cat site a cat site is super popular developer friendly, obviously You know everybody uses it Has really awesome web hook API and is allowed, right? companies do allow traffic to to to github right github is specifically used for for development for DevOps, but also for infrastructure So essentially What what we're gonna do is? We're gonna use github to create a broker for our C2 So the test is going a task is going to be for Misha to to send a Request to github over web hook the web hook will reach out to the C2 that Misha has another side of the planet, right and The C2 will respond through github back into the presence that Misha has on the inside of the of the company the way it sort of works with With web hooks is is just that you store some notification on a github. There is a link that wakes up a Agent on the other side, and then you circle back in this case You still pull in some of the results But this is done manually because you know what you've tried to ask for and so you you can ask for for a response Github is easy to set up You know, it's helping us from the red team perspective To set up up to 20 web hooks. So thinking ahead You have a lot of functionality here Github is super rest friendly, you know Jason payloads everything is cool set up for us. So we're gonna go ahead and Choose what we are listening for and what we're gonna be listening for are the issues and issue comments on the other side and so Also, github is trying to secure developer communication storage and all that good stuff So we're gonna ride that wave, right? We're gonna use github security to to obscure our communication with our C2 and our client so This is octahook. It's a little shell that allows you to encode all these things that we talked about to to use the client and use the server and Proxy everything through issues and github communication to the C2 so Essentially from the blue team perspective all you're seeing is traffic to github traffic from github, right? It's all encrypted obviously because github makes it easy for us We just did LS dash L on our C2 which resides somewhere in Eastern Europe, maybe right, so This this concept is asynchronous we Execute a command on it on on the server on the on the C2 And then we manually pull the issue for completion, right? We send the status and say hey am I done am I done am I done we view the issue number 612 and 612 has a response for us, which is nice, right? It's it's a little shell here so What what is the delivery mechanism in this particular response every agent connecting to the C2 has the identifier and You know, it's a straight straight YAML over Jason to post the requests and get the responses out you use the the git app tokens to Authenticate yourself with github and it basically goes from there You you you can use app token you have some limits Things that you need to take care of with the github as far as throttling counters and you know posting limit, but for the most part it's all extensible here And on the issue side, this is what you see on the github, right? It's the the various types of requests that you are octa octahook supports You can do operating system execution. You can do content put which we're gonna look at a little bit later So and obviously the the C2 on the other side it says yep You know the issue is resolved go ahead and look at your responses. So essentially it's like a ticket, right? It's a ticket from your C2 to github to close the issue and notify Your agent on the inside to come back and check for it If you've got large payloads, you know, you can split them across multiple Comments on the same issue. So it's very convenient This is how the request looks like Essentially, you know, you can extend it if you want but in the proof of concept, this is just the LS and the type of execution is the process More configuration But really what needs to happen here is that Now if we're using webhooks over github for example in this case You can assume a role you can be a client and a server on each side of the things, right? So you can be listening to to The way github works by sending responses through webhook is that it's It's a broadcast, right? So if you created two webhooks that both of the webhooks are gonna get the Jason payload, right? And so you can play on this by Saying hey, you know, well if I can listen to both then I can be a server and a client Which makes it much easier for us because we can extend that even further You can do uploads through git Obviously for lost tools if Misha cannot get to his impact at library It's not on the customer side. You're working from a restricted Citrix environment. You know, you can pretty much reverse upload the library and and use it here and Every agent that hooks up through through github will have a directory with identifier and this is where you place the content in So again the roles you can be a client side and server side on either side of the of the execution the C2 can be a client You know your agent can be a client to threads Command execution and and and the web server itself that listens for for the payload Yeah, so, you know bring more tools on the inside is exactly the opposite of executing something on your C2 which makes it easier for you to bypass the the proxy and you know because github is is really allowed This is a little demo of how you would put a Content from C2 if you forgot to brought your toolkit back into the organization, right? You touch a file or in this case You will probably have a depot files on your C2 and then you would execute a put through git To to the local thing and then you can pull it down by download But it's still sort of Not real-time, right? It's you need to ask whether your upload has completed or whatnot, so it's It's a little You know not automated enough Let's see what we can do right to solve this issue Again coming back to what really web hooks are It's just a broadcast and if we use github as a central repository or broker of C2 Then you know we can achieve real-time communication, right? And so essentially what we do we assign two web hooks one that goes to the C2 server the other web web hook that goes to the clients to the Agent that resides in the company. So essentially by me executing LS-L on the C2 The request and the response is going to be coming in both ways so I can have You know I can I can wake up both sides at the same time by that broadcast and Those sides there are client will listen for a response the size of that that is a server is gonna listen for a request and So that makes it a little bit easier for us to achieve real-time proxy in via github by creating just two To endpoints it could be different IPs it could be different resources on the same Server if you want to but that's basically what you could do So let's see how that's done So we put we turn on real-time communication. We execute in LS-L Outside and we get a response back no polling nor asking for viewing issue for response And so that's that's basically the real-time shell that you can get from C2 back into into your environment You can reverse it right so you can say hey Misha. It's 12 30. I want to go to lunch I'm gonna change the roles flip the roles I'm gonna make my agent on the inside a C2 and I'm gonna make a client on my you know Point of presence across the world and that's how I would operate for the next day until I Get what I need from this company So really nice, right a good day worth of work Misha's happy, you know took him, you know a few hours to code it in But then you know, obviously Misha doesn't like to be alone. He likes to share things with a friend and That may also be possible because right now you can extend This is a proof of concept for forget right, but essentially if we know that continuous integration tools exist through various sites that are More than likely right now are allowed, right like Hiroko maybe Slack is a very popular thing So you can write a plug-in for how you want to communicate, you know file puts and execution of command between the two so Because you have every agent has its own configuration and ID you can create a logic Where you say I'm only listening for ID, you know XYZ coming from this particular machine so you can have a swarm capability where you are Broadcasting requests and getting responses from where you need to be so you can bring in a friend, right a different agent that would be Taken over your C2 capability and you can hand it off. You can change the role you can hand it off to another guy so Yeah, so simultaneously simultaneous execution on multiple agents may be possible Flipping C2 direction may be possible mitigation Web hooks are here to stay that's That's how developers will will go forward with this right that's easy it solves a lot of good issues for them and The sides that would implement that they're very popular and high-ranking on the content proxy will still exist Again, you know if you're managing your your your systems Well, why not just restrict the specific developer to go to a specific site that they need to on a github like a Repository even from this specific machine do not open up just blanket You know communication to github because that's what that's what's gonna happen here You can Take a hard look at why you need to use github. Do you want to have a? local repository of things that you need Local developers to use our infrastructure team to use Do you really need to go out to the social coding sites and and and do that and You know if you're into deep behavior expansion expect Inspection then There is no reason why you would need to have 612 Issues right opened up on zero line of comments and or code and github, right? That's a telltale sign of this particular for example example of communication, right? So see what your developers are doing why they're doing it and You know restrict them accordingly and from a red team We're gonna keep writing the social coding until you know this sort of Division happens because you know possibilities are endless with meeting software right now You know it's all gonna be you know widespread and Yeah, so essentially it's one of the things that can be done if you have any questions, you know


Hello, I'm Milanda from Philippines. I just finished my 120 hour course through the ITD training. I learned a lot from this course. This course I think was enlightening. And the lessons I learned from this were educational and practical to use effectively in teaching. I've learned to appreciate more the value of English grammar and its structures and how I could use this in my classes. As a whole I think that the course is an empowering tool for every teacher and I am so grateful that I have been part of this new learning experience from ITDT. Lastly I would like to encourage every teacher, every English teacher to take this course because this course can help you, can help us to be more effective teachers. Thank you.


What is up everybody, Jason here for JaspysCaseBricks.com. We just sold out 2023, Panini, Zenith, football, six-boxer, half-caser, number two. This is the second half of the case, and there's everybody there. So we just needed to sell four teams, which we did. We have the serial number. There they are, Indianapolis, Miami, Green Bay, and Philly. There's a customer name there. Should be a fun one, guys. And here we go. All right, we got B-Jail, Jalari, Rookie. The Cardinals. Sake 1 Bargley behind the numbers for the Giants. We got Class President, Ricky Williams. Really, really cool-looking card right there. That's for the Saints, going to Eric. And we got Josh, or Johan Dotson. All right, that was a $15 team, guys. Command and Serenity with that one, out of $25. And what do you know, guys? What do you know? Two out of ten, Anthony Richardson, Quad, Relic, and Autograph. A little bit of the Nike swoosh, the laundry tag there, two-color patch. Johan with spot two. Let's go. Very, very nice. And there's the fire, guys. A little E.J. Brown, non-numbered. That wasn't supposed to be like that, but we'll take it, I guess. Out of $50, Bryce Young. Didn't see much of him in the first half. Panthers going to Robert. A little Aaron Rodgers. Out of $50, a little Patty Mahomes. That's pretty nice. More. How about Jonathan Mingo? Rookie ticket preview. Another one there for the Panthers. And we got a Jack Campbell to $2.99. Detroit Lions going to Nicholas. And then we got a Rashi Rice, RPA to $2.99. That's going to go to the Kansas City Chiefs going to David. All right, very nice. All right, we got a three out of five, or five out of five, sorry. We'll love this. Damn, very nice. Artist proof. Josh Allen to the bills. A little Andrew Luck class president. That'll be randomized as well with the E.J. Brown base. And then we got a Brock Birdie autograph, $49.50. Just bought in right after the break. Scott, there you go, man, got rewarded. Matthew Stafford. And then Chase Brown, rookie patch autographs there for the Bengals going to Serenity. So far, a very, very nice second half. Musgrave to $50. That's Green Bay Packers, R&B 24. Four's Robert. And we got a Will Leviss behind the numbers. Adrian Peterson for the Vikings. We have a Trey Tucker to 10. Eight out of 10. Raiders going to Jeffrey P. The Derrick Stingley Jr. Z Jersey patch autographs there for the Houston Texans, which is going to Matt. Whoa. I'm sorry, Mark Cooper. That's a one of one. It's for the Browns going to Serenity. Very nice. Harvey Gotts. Trenton Simpson. Then we got a Will Leviss. Titan's going to Todd. Stake home Barkley. Giant. Then we got a Jaren Hall to 23. Rookie ticket update preview. Vikings going to Douglas. Got a redemption. We got a little de-swift. And then how about we just turn it bam. Wow. It is another team summit autographs that features Greg Lloyd, Jack Hamm and TJ Watt. Wow. Another one for the Steelers, Michael Golucci. I know you're a big Steelers guy, but I guess you could buy one and sell one. You could sell one and keep one now, I guess. The same one we got in the first half. Last one here, guys. Harrison Booker. We have a Tyree Wilson for the Raiders. And then we have Thunder and Lightning. Actually, this one might, no, it's not number. Christian McCaffrey's Z-Team. Frickin' awesome. Whoa. I haven't seen that name in a while. Well, Jake. Jake Lummer. Z-Graphs. Out of $1.99. That's going to go to the Broncos and Brian. And then last hit is going to be a Sean Clifford patch autograph. $135 out of $2.99. It's about five is Josh. All right. Well, we didn't get a lot of hits. For the R&B, but a good quality amount of hits, though, right? Especially with that one. So there you go, guys. We'll randomize the non-numbered stuff right now as well, too. But a pretty nice second half, guys. A lot of really nice stuff. And obviously, the Anthony Richardson made it really nice. Brock Purdy had a five. We'll love this. A lot of nice stuff. So appreciate it again, guys. All right. Let's switch scenes and let's do that quick little base giveaway. All right. 11 times five out of six. One, two, three, and four, five, six, seven, eight, nine, 10, 11. Josh, you're going to get the non-numbered base as well. Thank you guys so much. Jaspyscasebreaks.com. Guys, get in for more breaks.


First pitch of the at bat to Meisner the leftie and he's gonna pop it up bloop into no man's land The second baseman shortstop two outfielders all looking at it shortstop says I got it and then boots it into right field And the runner because there was two outs He just never stops running all the way home and they rule this a home run. There's teammates love it Yeah, baby. There you go and just misses it and then BAM I love the fielders have to go run and the shortstop looks no way same thing all of us said