Well, hi there. I'm Sandy Olnock artist and paper crafter on YouTube And I want to share with you some impressionistic pottery that I created in my Bible I did this with water-soluble oil pastels from Prima And these are one of my favorite products to use for this technique For a number of reasons one is they have a great color selection and they're really inexpensive for a full set like this And they go on really creamy much creamier than the other similar products Like gelatoes or distressed crayons, and they work particularly well with the technique that I'm going to share with you. I Can sketch with these they do have a point to them And if you color with them on a regular basis on the side of the crayon Then they sort of self sharpen not really but sort of self sharpen So you'll see that a lot of the coloring that I do throughout this I I color with the side of that point I'm sketching in my image first and these are very forgiving with the technique that I'm going to use So I can just scribble and that's one of the fun things about this you can scribble and When you get to the next step everything smooths out and looks gorgeous Even if you're not coloring an entire image like this I'm trying to detail in a bunch of clay pots and these are Not something you have to do with these you could just do Simple shapes you could do flowers you could just do color across the background and these are a great way to Get a lot of impact of color Without having to have a whole lot of product or take a lot of time to do it because they're very quick I am speeding this video up, but they are very quick to use this entire page By the time it's all said and done only took me a half an hour to complete so you can get a lot of a Lot of work done very quickly now I'm using Kirkland baby wipes. These are Costco brand baby wipes nothing special about them But my finger inside and spread the color very simply This gives you a soft watercolor look and you're applying the color without a ton of water You could do this with a brush as well But the brush ends up adding a lot of water to the page and wrinkles it even more than this well so it stays relatively flat compared to using water with them and The the baby wipe Is just something that's inexpensive and you can turn it and use it with a different color You want to definitely turn it before you change colors So if you're going to start using the blue you definitely want to use a different part of the baby wipe So you don't transfer color, but you can also blend the colors that way By using them together and create other colors in between these lots of different opportunities for For different effects that you might want to create I'm going over top of the image and I'm wiping out a lot of that detail that I put in a lot of it was just mentally for me to go okay, I'm going to want to put some cracks in this pot in the front and That's something I'll add more to later because I'll keep adding layers the more layers you add to this the more richness of color you get But you can see that you can leave it as a very soft background if you like really soft backgrounds And it looks just beautiful. I wanted to add more richness of detail And as you use some sort of linear strokes You still want to apply the baby wipe to it or go in with a brush on that because Otherwise it remains a little bit on the tacky side because you get the feel of that crayon Remaining and it might make your page kind of stick together a little bit or transfer color But as soon as you hit it with water or the baby wipe then it kind of melts into the page And it's more like watercolor and it won't be sticky when it's all said and done I'm going to use enough color on this that you might get scared I might not be able to read this through the color, but don't worry because I can The verse that I'm illustrating here is from Jeremiah 18 I went down to the potter's house and I saw him working at the wheel But the pot he was shaping from the clay was marred in his hands So the potter formed it into another pot shaping it as seemed best to him and that phrase as seemed best to him Really stuck out to me Then the word of the Lord came to me He said can I not do with you Israel as this potter does declares the Lord like clay in the hand of the potter So are you in my hand and That that verse that that pair of verses is what really struck me That I am clay in the hands of the Lord and he can change me at the drop of a hat If if I ask him to he can do that. I can't change myself in my own flesh I'm a mess and there are so many things that need to be fixed in me And I tend to think of myself as a vessel that's already been baked I've already been through the kiln. I'm shaped into what I'm going to be But the potter can reshape us at any moment He does not have to be reliant on on anything else, but wanting to change us and he can do that We are not formed permanently into the shape that we are and into the the people that we are and he can transform and completely turn us into the person he meant for us to be and That's what I want him to do in my life and I Encourage you if you want him to do that in your life just ask him because he'll do it I'm adding more colors to this and more richness of color is developing as I do I'm adding the color and then just tapping on top of it actually instead of wiping it in order to get that richness because if I keep wiping I can keep lifting color off so I wanted that texture and To to get that you just sort of tap it with the baby wipe because that moisturizes it enough that it retains the texture But doesn't wipe it completely off The other thing I wanted to mention is that on my blog you may have seen I have a Bible journaling class It's just a couple of bucks if you're interested in mediums that both don't go through the paper and that you can paint on and not Not more of the words you can still read through them and even though this one There's a few spots where it may become a little bit difficult to read a few spots where this black line is that sort of thing I did check very carefully to make sure that I could read everything on here It's difficult to communicate in pictures, but I can actually read it for some people This is too much color totally understand that But for those who like this kind of a look these oil pastels are a lot of fun to play with And as I said, it's easy to do a really quick wash of a background if you want to these are also something that I take when I travel because I can get a lot of impact of color and a very large kind of background image without having to Carry around a whole lot of mediums and brushes and water and all sorts of things. I can just Take my baby wipes and get her done as you can see this does not go through the back of the page So that's an important thing to me as well And then I ironed it so I put a piece of paper on either side of it You can see how flat it makes it to iron this when you're all finished And it was just a quick quick hot iron for about 20 seconds And it's not sticky at all because I did all that wiping off of color The last thing to do was going to be to add some words to it And I took this pen at first I was like, oh, yeah I'll do white letters up in here and that didn't really work But it did allow me to sort of pencil in the words so that when I got my black pen out I was able to go right through and Trace over the the white letters that I had done in there that didn't exactly show up well and I left some space in the lower left-hand corner that I'm going to do some journaling and I will do that after All these photographs and everything so that that can remain private because that's my prayer to the Lord But here's the finished page If you'd like to see more of my work or if you want to go check out the Bible journaling class You can click on one of these videos in the screen in front of you You can hit the subscribe button if you'd like to get more videos from me and I will see you guys next time I hope you have a blessed day and a blessed week ahead. Thank you so much for joining me And I'll talk to you later. Bye


tabé it is no business of mine the president turning to monsieur d'Arzak and delivered to induce him to tell what he knew do you still refuse monsieur to tell us how you employed your time during the attempts on the life of mademoiselle stangerson i cannot tell you anything monsieur the president turned to roule-tabé as if appealing for an explanation we must assume monsieur president that monsieur robert d'Arzak's absences are closely connected with mademoiselle stangerson's secret and that monsieur d'Arzak feels himself in honor bound to remain silent it may be that larcent who since his three attempts has had everything in training to cast suspicion on monsieur d'Arzak had fixed on just those occasions for a meeting with monsieur d'Arzak at a spot most compromising larcent is cunning enough to have done that the president seemed partly convinced but still curious he asked but what is the secret of mademoiselle stangerson that i cannot tell you cette roule-tabé i think however you know enough now to acquit monsieur robert d'Arzak unless larcent should return and i don't think he will he added with a laugh one question more said the president admitting your explanation we know that larcent wished to turn suspicion on monsieur robert d'Arzak but why should he throw suspicion on daddy jack also there came in the professional detective monsieur who proves himself an unraveler of mysteries by annihilating the very proofs he had accumulated he's a very cunning man and a similar trick had often enabled him to turn suspicion from himself he proved the innocence of one before accusing the other you can easily believe monsieur that's so complicated a scheme as this must have been long and carefully thought out in advance by larcent i can tell you that he had been long engaged in its elaboration if you care to learn how he had gathered information you will find that he had on one occasion disguised himself as the commissionaire between the laboratory of the sorté and mrs. dangerouson of whom experiments were demanded in this way he had been able before the crime on two occasions to take stock of the pavilion he had made up so that daddy jack had not recognized him and yet larcent have found the opportunity to rob the old man of a pair of old boots and he cast off basque camp which the servant had tied up in a handkerchief with the intention of carrying them to a friend a charcoal burner on the road to eponae when the crime was discovered that he jack had immediately recognized these objects as his they were extremely compromising which explains his distress at the time when we spoke to him about them larcent confessed it all to me he is an artist at the game he did a similar thing in the affair of the crédit universelle and in that of the gold ingots of the mint both these cases should be revised since bolmayer or larcent has been in the sorté a number of innocent persons have been sent to prison end of chapter 27 part b chapter 28 of the mystery of the yellow room this is a libra vox recording all libra vox recordings are in the public domain for more free audiobooks all to volunteer please visit libra vox.org recording by stewart bell the mystery of the yellow room by gaston larou chapter 28 in which it is proved that one does not always think of everything great excitement prevailed when ruta behal finished the courtroom became agitated with the murmurings of suppressed applause maithra angrie verbert called for an adjournment of the trial and was supported in his motion by the public prosecutor himself the case was adjourned the next day monje robber d'asak was released on bail while daddy jack received the immediate benefit of a no-cause for action search was everywhere made for frederick glossar but in vain monje d'asak finally escaped the awful calamity which at one time had threatened him after a visit to mom was arston jason he was led to hope that she might by careful nursing one day recover her reason ruta bill naturally became the man of the hour on leaving the palais de justice the crowd bore him aloft in triumph the press of the whole world published his exploits and his photograph he who had interviewed so many illustrious personages had himself become illustrious and was interviewed in his turn i'm glad to say that the enormous success in no way turned his head we left the side together after having dined at the dog that smokes in the train i put a number of questions to him which during our meal had been on the tip of my tongue but which i had refrained from uttering knowing that he did not like to talk shop while eating my friend i said that last soundcase is wonderful it is worthy of you he begged me to say no more and humorously pretended an anxiety for me should i give way to silly praise of him because of a personal admiration for his ability i'll come to the point then i said not a little netled i am still in the darkest your reason for going to america when you left the glandier you had found out if i rightly understand all about frederick larsa you had discovered the exact way he had attempted the murder quite so and you he said turning the conversation did you suspect nothing nothing it's incredible i don't see how i could have suspected anything you took great pains to conceal your thoughts from me had you already suspected last sound when you sent for me to bring the revolvers yes i'd come to that conclusion through the incident of the inexplicable gallery last sounds returned to mawazel stangerson's room however had not then been cleared up by the eyeglasses my suspicions were the outcome of my reasoning only and the idea of last sound being the murderer seemed so extraordinary that i resolved to wait for actual evidence before venturing to act nevertheless the suspicion worried me and i sometimes spoke to the detective in a way that ought to have opened your eyes i spoke disparagingly of his methods as until i found the eyeglasses i could but look upon my suspicion of him in the light of an absurd hypothesis only you can imagine my elation after i had explained last sounds movements i remember well rushing into my room like a madman and crying to you i'll get the better of the great fred i'll get the better of him in a way that will make a sensation i was then thinking of last sound the murderer it was that same evening that does act begged me to watch over mawazel stangerson i made no efforts until we're dined with last sound until 10 o'clock he was right there before me and i could afford to wait you ought to have suspected because when we were talking of the murderer's arrival i said to you i am quite sure last sound will be here tonight one important point escaped us both it was one which or to have opened their eyes to last sound do you remember the bamboo cane i was surprised to find last sound have made no use of that evidence against robert dazak had he not been purchased by a man whose description tell it exactly with that of dazak well just before i saw him off at the train after the recess during the trial i asked him why he hadn't used the cane evidence he told me that he had never had any intention of doing so that our discovery of it in the little inn at epine had much embarrassed him if you will remember he told us then that the cane had been given him in london why did we not immediately say to ourselves fred is lying he could not have had this cane in london he was not in london he bought it in paris then you found out on enquiry at cassettes that the cane had been bought by a person dressed very like robert dazak though as we learned later from dazak himself it was not he who had made the purchase couple this with the fact that we already know from the letter at the poster a start that there was actually a man in paris who was passing as robert dazak why did we not immediately fix on fred himself of course his position that the surete was against us but when we saw the evidence eagerness in his part to find convicting evidence against dazak and that even the passion he displayed in his pursuit of the man the lie about the cane should have had a new meaning for us if you ask why lassan bought the cane if he had no intention of manufacturing evidence against dazak by means of it the answer is quite simple he had been wounded in the hand by man was arston jason so that the cane was useful to enable him to close his hand in carrying it you remember i noticed that he always carried it all these details came back to my mind when i had once fixed on lassan as the criminal they were too late then to be of any use to me on the evening when he pretended to be drugged i looked at his hand and saw a thin silk bandage covering the signs of a slight healing wound have we taken a quick initiative at the time lassan told us that lie about the cane i am certain he would have gone off to avoid suspicion all the same we worried lassan or baumea without her knowing it but i interrupted if lassan had no intention of using the cane as evidence against dazak why had he made himself up to look like the man when he went in to buy it he had not specially made up as dazak to buy the cane he had come straight to cassettes immediately after he had attacked man was arston jason his wound was troubling him and as he was passing along the avenue del opera the idea of the cane came to his mind and he acted on it it was then eight o'clock and i who had hit upon the very hour of the occurrence of the tragedy almost convinced that dazak was not the criminal and knowing of the cane i still never suspected lassan there are times there are times i said when the greatest intellects brutally shut my mouth i still continued to try at him but finding he did not reply i saw he was no longer paying any attention to what i was saying i found he was fast asleep end of chapter 28 recording by stewart bell cambridge uk chapter 29 of the mystery of the yellow room this is a libra vox recording all libra vox recordings are in the public domain for more free audiobooks or to volunteer please visit libra vox.org the mystery of the yellow room by gaston larou chapter 29 the mystery of mademoiselle stangerson during the days that followed i had several opportunities to question him as to his reason for his voyage to america but i obtained no more precise answers than he had given me on the evening of the adjournment of the trial when we were on the train for paris one day however on my still pressing him he said can't you understand that i had to know larson's true personality no doubt i said but why did you go to america to find that out he sat smoking his pipe and made no further reply i began to see that i was touching on the secret that concerned mademoiselle stangerson rutabil evidently had found it necessary to go to america to find out what the mysterious tie was that bound her to larson by so strange and terrible a bond in america he had learned who larson was and had obtained information which closed his mouth he had been to philadelphia and now what was this mystery which held mademoiselle stangerson and mishir robert darzak in so inexplicable a silence after so many years and the publicity given the case by a curious and shameless press now that mishir stangerson knows all and has forgiven all all may be told in every phase of this remarkable story mademoiselle stangerson has always been the sufferer the beginning dates from the time when as a young girl she was living with her father in philadelphia a visitor at the house a frenchman had succeeded by his wit grace and persistent attention in gaining her affections he was said to be rich and had asked her of her father mishir stangerson on making inquiries as to mishir gen russell found that the man was a swindler and an adventurer gen russell was but another of the many names under which the notorious bolmire a fugitive from france tried to hide himself mishir stangerson did not know of his identity with bolmire he learned that the man was simply undesirable for his daughter he not only refused to give his consent to the marriage but denied him admission into the house matilde stangerson however had fallen in love to her gen russell was everything that her love painted him she was indignant at her father's attitude and did not conceal her feelings her father sent her to stay with an aunt in Cincinnati there she was joined by gen russell and in spite of the reverence she felt for her father ran away with him to get married they went to louisville and lived there for some time one morning however a knock came at the door of the house in which they were and the police entered to arrest gen russell it was then that matilde stangerson or russell learned that her husband was no other than the notorious bolmire the young woman in her despair tried to commit suicide she failed in this and was forced to rejoin her aunt in Cincinnati the old lady was overjoyed to see her again she had been anxiously searching for her and had not dared to tell mishir stangerson of her disappearance matilde swore her to secrecy so that her father should not know that she had been away a month later mademoiselle stangerson returned to her father repentant her heart dead within her hoping only one thing that she would never again see her husband the horrible bolmire a report was spread a few weeks later that he was dead and she now determined to atone for her disobedience by a life of labor and devotion for her father and she kept her word all this she had confessed to robert darzak and believing bolmire dead had given herself to the joy of a union with him but fate had resuscitated genre cell the bolmire of her youth he had taken steps to let her know that he would never allow her to marry darzak that he still loved her mademoiselle stangerson never for one moment hesitated to confide in mishir darzak she showed him the letter in which john russell asked her to recall the first hours of their union in their beautiful and charming louisville home the presbytery has lost nothing of its charm nor the garden of its brightness he had written the scoundrel pretended to be rich and claimed the right of taking her back to louisville she had told darzak that if her father should know of her dishonor she would kill herself mishir darzak had sworn to silence her persecutor even if he had to kill him he was outwitted and would have succumbed had it not been for the genius of rootabil mademoiselle stangerson was herself helpless in the hands of such a villain she had tried to kill him when he had first threatened and then attacked her in the yellow room she had unfortunately failed and felt herself condemned to be forever at the mercy of this unscrupulous wretch who was continually demanding her presence at clandestine interviews when he sent her the letter through the post office asking her to meet him she had refused the result of her refusal was the tragedy of the yellow room the second time he wrote asking for a meeting the letter reaching her in her sick chamber she had avoided him by sleeping with her servants in that letter the scoundrel had warned her that since she was too ill to come to him he would come to her and that he would be in her chamber at a particular hour on a particular night knowing she had everything to fear from bulmire she had left her chamber on that night it was then that the incident of the inexplicable gallery occurred the third time she had determined to keep the appointment he asked for it in the letter he had written in her own room on the night of the incident in the gallery which he left on her desk in that letter he threatened to burn her father's papers if she did not meet him it was to rescue these papers that she made up her mind to see him she did not for one moment doubt that the wretch would carry out his threat if she persisted in avoiding him and in that case the labors of her father's lifetime would be forever lost since the meeting was thus inevitable she resolved to see her husband and appeal to his better nature it was for this interview that she had prepared herself on the night the keeper was killed they did meet and what passed between them may be imagined he insisted that she renounced Darzak she on her part affirmed her love for him he stabbed her in his anger determined to convict Darzak of the crime as Larsen he could do it and had so managed things that Darzak could never explain how he had employed the time of his absence from the chateau all Myers precautions were most cunningly taken Larsen threatened Darzak as he had threatened Matilde with the same weapon and the same threats he wrote Darzak urgent letters declaring himself ready to deliver up the letters that had passed between him and his wife and to leave them forever if he would pay him his price he asked Darzak to meet him for the purpose of arranging the matter appointing the time when Larsen would be with Mademoiselle Stangerson when Darzak went to eponae expecting to find Balmyr or Larsen there he was met by an accomplice of Larsen's and kept waiting until such time as the coincidence could be established it was all done with Machiavelli and Cunning but Balmyr had reckoned without Joseph Rulta Biel now that the mystery of the yellow room has been cleared up this is now the time to tell of Routabil's adventures in America knowing the young reporter as we do we can understand with what acumen he had traced step by step the story of Matilde Stangerson and Jean Roussel at Philadelphia he had quickly informed himself as to Arthur William Rance there he learned of Rance's act of devotion and the reward he thought himself entitled to for it a rumor of his marriage with Mademoiselle Stangerson had once found its way into the drawing rooms of Philadelphia he also learned of Rance's continued attentions to her and his importunities for her hand he had taken to drink he had said to drown his grief at his unrequited love it can now be understood why Routabil had shown so marked a coolness of demeanor towards Rance when they met in the witness's room on the day of the trial the strange Roussel Stangerson mystery had now been laid bare who was this Jean Roussel Routabil had traced him from Philadelphia to Cincinnati in Cincinnati he became acquainted with the old aunt and had found means to open her mouth the story of Ballmeyer's arrest through the right light on the whole story he visited the Presbytery a small and pretty dwelling in the old colonial style which had indeed lost nothing of its charm then abandoning his pursuit of traces of Mademoiselle Stangerson he took up those of Ballmeyer he followed them from prison to prison from crime to crime finally as he was about leaving for Europe he learned in New York that Ballmeyer had five years before embarked for France with some valuable papers belonging to a merchant of New Orleans whom he had murdered and yet the whole of this mystery has not been revealed Mademoiselle Stangerson had a child by her husband a son the infant was born in the old aunt's house no one knew of it so well had the aunt managed to conceal the event what became of that son that is another story which so far I am not permitted to relate about two months after these events I came upon Routabil sitting on a bench in the Palais de Justice looking very depressed what's the matter old man I asked you are looking very downcast how are your friends getting on apart from you he said I have no friends I hope that Mr. Darzak no doubt and Mademoiselle Stangerson how is she better much better then you ought not to be sad I am sad he said because I am thinking of the perfume of the lady in black the perfume of the lady in black I have heard you often refer to it tell me why it troubles you perhaps someday someday said Routabil and he heaved a profound sigh and of chapter 29 and of the mystery of the yellow room by Gaston LaRue


But that doesn't mean in terms of aggressive expansionism that people always tunnel into. To give more of an idea as to why territory is pretty valuable, Napoleon didn't actually lose most of his troops because of Russian winter. He lost them because of logistics. The winter didn't really have much effect into the casualties of war. Russia used scorched earth doctrine. They weren't afraid to burn their own land. No country is. The United States, NATO is going scorched earth on any country that might be deciding to lean towards Russia Russia and China. So the United States, the doctrine in the West has really been this for the last number of decades. It's World War two.  So they're not even going to scorched earth on their own lands. They're going to scorched earth on other nations. As far as expanding, no. There's a certain point where you don't expand any further. You don't, logistically as you said it.


In our previous video, we proved what we're calling theorem 914, that if two groups, G and H or isomorphic, then there are some properties that must be the same about the two groups. That the two groups will have to have the same order. If one's abelian, the other one's abelian. If one's cyclic, the other one's cyclic. If one has a subgroup of order n, the other one has to have a subgroup of order n. These element, these properties right here are often referred to in the literature as invariance. These are things that do not change. They do not vary as you go from one group to the other because the two groups are isomorphic. Because after all, when two groups are isomorphic, we're not saying they're equal as sets. There could be some cosmetic differences. We saw previously that the group Z4, with respect to addition, it has its elements 0, 1, 2, 3. This is the same group as Z4. That is, we're looking at fourth roots of unity. So you get 1, i, negative 1 and negative i. Clearly there's some important differences here, right? The names of the elements, the labels themselves are different. The name of the group is different. We call one of the operations addition and the other operation multiplication. These are all cosmetic differences. This is sort of a linguistic difference between it. This is just how we describe the group. But the algebra of the two is going to be the same. And that's where this idea of invariance comes into play. An invariant is something that doesn't change as you go from one group to the other. So like both of these groups are abelian. And so that's something that's true when you go from one group to the other. These are both groups of order four that stays the same. They're both groups that are cyclic. They both have a unique subgroup of order two. Those are things that stay the same in variance. Now the reason why invariance is so important is what happens if you want to show that two groups are not isomorphic. Showing that two groups is isomorphic just means here's the isomorphism for the world to see. You just have to give someone a bijection between the two groups that's homomorphic and then it becomes an isomorphism. It preserves the operations between the two. But how do you show something that's not isomorphic? You don't show the world an isomorphism. Like, look, my hands are empty when I try to display the isomorphism. Well, that doesn't make any sense. That's sort of like the same argument about Bigfoot, right? Is Bigfoot running around the California mountains or anything like that? Well, I can't find him. Does that prove he doesn't exist? Maybe Bigfoot's really good at hiding. I have seen numerous movies about Sasquatches and Yeti's to explain why man hasn't found them but why they've existed the whole time. Admittedly, most of those were comedies and fictions and things like that. But nonetheless, is Bigfoot a good hider? And that's why we can't find them? Or can we not find them because he doesn't exist? That's that's the concern we're in right now. If we can't find an isomorphism, is that because it doesn't exist? Or does that mean we're bad at finding them? Which could very well be the case. I mean, at the time of this recording, the Riemann conjecture is still an outstanding conjecture, one of the seven millennial problems of 2000 worth a million dollars if you can solve it or disprove it, right? And the Riemann, the Riemann hypothesis has to do with the existence of nontrivial roots to the so-called zeta function. I won't go into all the details of that. But you know, the best mathematicians in the world have worked on this problem. Yet no one can find nontrivial solutions. Does that mean they don't exist? Or does it mean they're just really, you know, very, very well concealed, right? That these are sort of the problems one has what one struggles with when you try to prove non existence. So the usual strategy one takes to prove non existence is actually proved by contradiction. We can't prove that it doesn't exist if we can't find it. So what we're gonna do is we're gonna assume that it's true. We will assume that it exists. And then we find a contradiction, a logical contradiction that would follow from the existence. And so if we can get a contradiction, then we must then we didn't have to take the opposite of what we assumed to be true. That is, we'd have to then assume what was what we have to then we would then know the assumption is false. So it doesn't exist. They're not isomorphic. And this is where invariance comes into play. Because if there was an isomorphism between two functions, that isomorphism must preserve all of the invariance. If there's an invariant that disagrees between the two groups, then that means they're not isomorphic. There's no isomorphism that could exist because otherwise it would have preserved those things. So let me show you some examples. Let's look at the dihedral group D4 versus D5. So the dihedral group D4, this is the symmetry group of the regular square. Well, I guess every square is regular. And D5 will be the symmetry group of the regular pentagon. Okay, these two groups are not isomorphic. How do I know that? Look at their orders. D4 is a group of order eight, two times four. And D5 is a group of order 10, two times five. We proved this previously. Now, like I said, in the previous in the previous video, we proved theorem 914. And so the order of a group is an invariant. Two groups are isomorphic. If they're isomorphic, that means their orders are the same. But D4 and D5 are they don't have the same order. So there cannot be an isomorphism between them because otherwise that would prove that eight equals 10, which is contradiction. Therefore, because they disagree on an invariant, it means that D4 is not isomorphic to D5. And there's something particularly special about the numbers four and five right here, we actually get a general principle from this, that the dihedral groups dn and dm, they're only isomorphic if and only if the parameters in and m are the same. So if you take the symmetry group of different regular gons and in gons, that is they have the different number of vertices, then those won't be the same groups. So dn is not equal, is not congruent to dm when in and m differ. All right. Now order is a very nice invariant. If two groups have different orders, they can't be isomorphic. But there are groups with the same order that can still be non isomorphic. Take S3, the symmetric group on three letters, and take Z6, the cyclic group of order six, the cyclic group as this label has order six, S3, its order is going to be three factorial, which is equal to six. Both of these groups are order six. What does that tell us about isomorphism? It actually tells us nothing. It tells us that they could be isomorphic or they could be not isomorphic. We don't have enough information. We have to look for a different invariant if we want to show that they're not isomorphic. Now the invariant to use here is the commutivity principle. Now Z6 as a cyclic group is a bilion, but S3 on the other hand is non-abilian. If we take, for example, the permutations one two and one two three, notice what happens here is one goes to two, two goes to one, so one is fixed, two goes to three, and then three will go to one which goes back to two. So one two times one two three is two three. But on the other hand, if I take one two three times one two, you get one goes to two, two goes to three, right? That's already enough evidence right there. Three goes to one, and then two goes to one which one goes to two so it's fixed. So notice you get two different transpositions. This is a non-abilian group, S3, but Z6 is a bilion. But like we said earlier, if the two groups were isomorphic, if one was a bilion, then the other would be a bilion. This is a violation of one of these invariants. Therefore, Z3 is not isomorphic to Z6. You could also make an argument about cyclic. Z6 is cyclic, but S3 is not cyclic. So the two groups cannot be isomorphic to each other. There's a different, they disagree on invariants. Now I want you to be clear that this list of four invariants is not comprehensive. These are all four conditions that must be the same for isomorphic groups, but there are other conditions. If all four of those conditions are the same between the two groups, they could still be non-isomorphic. And so it's to show that two groups are non-isomorphic, it's important to kind of develop a good understanding of these invariants. So let's look at another example, right? Let's consider the cyclic group Z8 and Z12. These groups are both cyclic, they're both non-isomorphic, they're not isomorphic, but they're not isomorphic because they have different orders, right? Z8 is order 8, Z12 is order 12, those are not the same integer. Therefore, those two groups are non-isomorphic under addition. But what if we look at the associated groups under modular multiplication? If we look at Z8 star and Z12 star, okay, those are both groups of order four, right? Let's just be, let's be clear, Z8 star, Zn star will contain all of those integers relatively prime to the list. So Z8 star will look like 1357 and Z12 star will look like 15711, like a slurpee, in which case, those are both groups of order four, that there's a potential that they could be isomorphic. And in fact, I'm going to define a bijection between them. I'm going to send one to one, three mod 8 to five mod 12, I'm going to send five mod 8 to seven mod 12, and I'm going to send seven mod 8 to 11 mod 12. So that is clearly a well-defined bijection because I'm telling you which congruence class goes to which one. And it's clearly one to one and onto because there's just four to four, okay? So we have a bijection, is it, is it homomorphic? That one's a little bit harder, because in this situation, I just, when it comes to an isomorphism, it's easier to show it's isomorphic when there's like a formula that this goes to that formulaically, is that even a word, by some formula, right? This formula isn't really a formula at all. It's just, I'm saying this goes to here, this goes to here. I told you one by one where each of the elements goes. So proving that this is homomorphic is much more challenging, and for a very large group, this would be a very, very challenging task. Now, since these are both groups of order four, it's not so hard to do. So what I'm going to do to prove, to prove that this, this, this function phi is actually homomorphic, is I want you to compare the Cayley tables of the two groups. So if you take z8 star, its elements are 1, 3, 5, 7, 1, 3, 5, 7, right? If you look at all the possible products, 1 times 1 is 1, 1 times 3 is 3, 1 times 5 is 5, right? 5 times 3 is 7, 5 times 5 is 1, okay? So look at that, that's the, that's the Cayley table for that. Do the same thing for z12 star, right? 5 times 5 is 1, 7 times 11 is 5, things like that. And so remember that the identity, that the map here phi, since 1 to 1, 3 to 5, 5 to 7 and 7 to 11, I've re-labeled everything. And so let's see what happens if I start labeling these things. So for the first one, let's label every single one we see in this picture. So you'll notice that the one, when you're working mod 8, is the identity. Looking at the first row, you see the exact same label, right? So one is the identity of this group. And notice how you have the ones across the diagonal here. This suggests that every element is its own inverse. So if you take an element times itself, you get back the identity. That's kind of interesting. If I come over to z12 and label all of the ones, because remember 1 goes to 1 here, I label all the ones, you will see, you will see the exact same picture. The ones are located all in the same spots. Interesting, all right? Let's see the labeling 3 goes to 5. If I label all of the 3s, right here, this is going to be the second column in row here. If I label all the 3s, see their locations on the grid. 3 is identified with 5. If you look at all the 5s, notice they're the exact same spot. Okay, what about 5 goes to 7? If I list all the 5s now, right? 5 is associated to 7. If I list all the 7s, you can see, again, they're all in the exact same spots. 7 goes to 11. If I label all of the 7s, which in the middle I guess I could have just left it blank because that's an indicator, right? You can see that according to the color codes here, they're all the same spot, right? And therefore, the Cayley tables are the same. These two groups have the same Cayley table. And in fact, earlier in this series, we played around with this idea about two tables, two groups have the same Cayley table up to relabeling. That was sort of a precursor to this idea of isomorphism, for which if two groups have the same Cayley table, they necessarily have to be isomorphic to each other. Now, you have to be careful. The Cayley table itself is not the best tool to use, per se, because one, for a group of a million, right? That's a big Cayley table. It's a lot of data to process. And also, if you list things in different orders, so if I had listed like 1, 7, 5, 11, the colors wouldn't have matched up the same way. So if you're doing the Cayley table, you got to list them in the same order, according to this bijection right here, which isn't too hard to do. If we list the elements in the same order, the same rows and same columns, based upon this bijection, then you'll see this same Cayley table emerging right here. And so in the literature, we would say here that the Cayley table determines the group. What I mean by that is the following. If you give me the Cayley table of the group, then I can determine the group up to isomorphism. Up to isomorphism, there's only one group that has this Cayley table. And that group is the Klein-4 group, namely Z2 cross Z2. And so there's lots of different ways of representing this group. We could represent this as, well, we could do a mod 8 multiplication, mod 12 multiplication. We could think of this as direct product, 00101011. We could describe it that way under addition. Another one that's kind of fun to do is the Klein-4 group. You could think of it as just the group 1abc, like here, for which the multiplication is then given as 1abc, 1abc. All right, so multiplication by 1 is pretty easy. Multiplication by a, you're going to get 1. a times b is c, a times c is b, b times a is c, b times b is 1, b times c is a, c times a is going to be b, b times c is a, and c times c is 1. You see the same exact structure right here? We could do all of the same labelings. We could look at the identity, look at where the identity is along the diagonal. We could do the next element, call it yellows, or it's a right here. You could find all of the a's, exact same spot. We could then do my next element, that's the b's, that's going to be blue. See the blues right here, just like above. We could have all of the reds, which are going to be the c's right there. Up to relabeling, all of these groups are the same and the Cayley table determines them. This is the Klein-4 group. That's why I say it's so as if it's unique. It's the Klein-4 group, because uptie someorphism, these are the only, these are the only group that has this Cayley table. And so when I say that, the Cayley table determines the group. This is, when we say that such and such determines the group, what we're saying is there's a list of invariants that if all of these invariants match up, that determines the group. So if two groups have the same Cayley table, which is an invariant, then they will be the same group. Another way of determining the group is if a group is cyclic, if two groups are both cyclic and have the same order, then that determines the group, right? Being cyclic in the order determines the group. It's a sufficient list of invariants, because as we started this whole video, going back a little bit, as we started this whole video on this discussion of invariants, which we had right here, these are all necessary conditions for two groups to be isomorphic. Necessary conditions means they have to be true if they're isomorphic, but if they all are true, they might not. They could still be non-isomorphic. This idea of such and such determines the group. That means that you have a sufficient list of invariants, which really is a powerful tool that you can show that two groups are isomorphic without even coming up with the function itself because you have a sufficient list. At the time of this video, the only criterion I'm going to give for determining the group is one, the Cayley table determines the group, and then second, if two groups are both cyclic and have the same order, that also will determine them up to isomorphism. Later in this chapter, we will provide necessary and sufficient conditions to determine abelian groups. That is, the fundamental theorem of finitely generated abelian groups will give us conditions to determine when two groups are isomorphic or not. Two abelian groups are isomorphic.


Dobro dobro, imam Mateo Mejuci z HoVasp. Moj počut, da se počutim, da se vse zelo. To je mnogo počutim, in je to, da se vse pravimo, da se zelo. Da se počutim, da se vse vse zelo. In da sem počutim v Italy, in Vologna. in bolonija. Zato to je taj agenda. Zdaj sem vse začetniti ovas projekte in ovas testov, kaj je metodologija začetniti sekuritivne aplikacije. Zdaj sem vse začetniti aplikacije. Zdaj sem vse začetniti sekuritivne aplikacije v tešku dovoljevacijo vsakrčen, danes vse taj vse začetniti. Zdaj sem vse začetniti sekuritivne ovas-petali v 2005, naredil taj projekte z dvej ročin, pomežajte začetniti sekuritivne aplikacije. Zdaj sem vse začetniti ovas? Vse začetniti sekuritivo. Ok. So, OWASP stands for the Open Web Application Security Project and is a project dedicated to find and fighting the causes of in secure software. So we have an OWASP foundation and everyone is a volunteer inside OWASP, everyone can participate. So everything we do is free and open source. So maybe that is for reason that we are here now. Ok. So the main object of OWASP is developing tools, standard and documentation related to web application security. We have thousands of active members all around the world. We have more than 100 chapters around the world and millions of it on our site. So if we think at OWASP we have four areas. We have an area called education in which we develop the first tool for the education of people on web application security. For example, the OWASP top ten tell you about the ten vulnerability of the web application. So for example from cross-site scripting, SQL injection and so on tell you what are these vulnerability and how you can protect about it. Then we do training, we do conferences, so next conference is in Poland with confidence and we develop web got that is an application that is vulnerable to web applications security so you can test on your own the vulnerability. Softer also the other is free available on www.owasp.org. Then we have a community, we have a lot of chapters and we have a lot of project incubator and we have a wiki portal so everyone can edit the contents of the wiki portal. Then we have a building area and we have the OWASP building guide that is a guide that tell you how develop SQL software. There is a code review guide that tell you how to review the code for the security. Then there is another project like horizon that is a tool that do static analysis of the code. Then for the verification area we have the testing guide that is the core of the presentation and we have a web scarab that is a tool is an HTTP proxy that runs on your local machine and can intercept all the HTTP requests from the client to the server so you can see all the requests and edit it and see how the server can respond. So web scarab and the testing guide are together the framework for the testing. The testing guide is a methodology and the web scarab is a king tool for the tester. Then we do validation and certification but there are new items. So the testing guide is free and open. We use the creative commons so everything is open and free. You can download everything we do. It's just a piece of a puzzle so you can see there are a lot of tools. There is the building guide, the code review guide and the testing guide. Here the OWASP community. We have a lot of chapters all around the world in which we can debate the web application security and we organize conferences locally et cetera. Now the total projects in OWASP are 88. 42 related to tools and 32 related to the documentations and nine for technology and five for the activities inside the OWASP foundation. So all these projects are sponsored by the OWASP foundation because we collect money from the conferences and maybe from the conferences. So OWASP now give some money to the leader that developed the documentation or tool. Now the goal is to improve the quality of our projects. So now all the projects are labeled alpha, beta or release. For example, the OWASP is a release project. So now our goal is to increase the quality and create professional OWASP books. So you can download from the site, the PDF, for example, of the testing guide, or you can buy from lyulu.com, the book that is at the price of the printing. So it's less than $10, something like that. OK. So, now we will talk about the testing guide. Just a little history, the testing guide start from January 2004 from Daniel Kappber, the bright, the first testing guide, that was 20 pages in which he collects all the tests to do on the application. Then in July the 40th, we developed the version 1.1. And in December 2006 we decided to develop a new project that is the version 2 that is more and more big than the other version. And now in last December we developed the version 3. You can see from here that the complexity of the project. From the beginning we released a document of 10, 20 pages, then 30, then more than 250, and now we are nearly 350. So the complexity of the articles and the methodology is growing, it's growing. What are the goals of the OVAS testing? We would like to create a complete new project focused on web application penetration testing. And the goal is to, we don't like to see the security as a black heart. So we would like to share with the tester and with the auditor and with the other involved in the audit of the application a common methodology. So the question is here to develop a methodology that is completely open. OK, here the action plan, the last version, so the version 2, takes about three, four months to the develop. And we begin with brainstorming to understand which is the methodology. So we collect all the web application penetration testing experts and we decide together to develop a common methodology. So the first stage is very complex because we have to collect all the ideas of the other and create the methodology. Because we didn't want to create the my methodology on your methodology, but the community methodology. So it's not so easy. Then when we decide the index and the templates, we write down the articles on the wiki model. We review the articles, review all the guides and then we write it in doc format and PDF and then we release the candidate and so on. The testing guide version 3 started on every 2008 and firstly we do an hours leader brainstorming about how to improve the version 2 and we do a call for participation. We had 21 authors and in the version 2 we had nearly 50 authors, so the authors are less. Then we describe, we discuss the article and here you can see that there is an action plan about this guide. So here is the book that you can download from the site in the PDF. You can see there is introduction, et cetera. And chapter 4 is the core of the book in which we describe the web application penetration testing methodology. And then we focus on how to write the reports. When you find the vulnerabilities on a web application, we decide also to write a methodology to describe how write a report, how to collect the vulnerability, how to value the risk associated with each vulnerability, et cetera. Because it's fundamental to present the result in the right manner. Then we have four appendix. We describe all the testing tools that we use. Web Scalab is the key tool. But there are a lot of other tools. For example, for SQL injection, we have SQL Ninjas. We have a SQL map, and so on. Then the reading, the fuzzing vector, and the encoded injection. Now we go to see it better. The difference from the version 2 and the version 3. And the version 2, we had eight subcategories. And now we have 10 subcategories. We create the configuration management testing and the authorization testing and the encoded appendix. So here I would like to show the index. We describe the overstesting framework, and so on. And here you can see that we start from the information gathering that is the first category of the test. And is the passive test, and it's not an active test. In the information gathering, we collect all the information about the application. So we understand all the entry points. Where is the application, because maybe the target is only an IP address. So we have to understand where is the application, in which part is running, and so on. Then we do configuration management testing. For example, we go to see the strength of the SSL protocol implemented. We go to implement the infrastructure configuration management testing, and so on. And then we go for the authentication testing. In here we have split it in 10 controls to perform. The first one is to perform the credential transport over an encrypted channel. For example, when you have a username and password to verify if the username and password information goes over an encrypted channel. And then we go for testing for user enumeration. For example, if you know a valid user, and if you try a not valid user with the wrong password, maybe the application respond in a different manner. So you can understand that the user is available on the application, and you can enumerate a lot of user. Then we can do the default of guessable attack. OK, just a flash here. In the second part, I will show some examples. So I go a little bit fast. Then we do the session management testing. You know that web application running over HTTP. And HTTP protocol is a stateless protocol. So you have to implement your own state, or you use the framework, for example, from J2E or .NET, there is a session management mechanism. So here we test the strengths of this mechanism of the session management. Then we do authorization testing. When a user is authenticated on my application, I have to test if the user can do something that is not authorized for. Maybe he can read PDF that is private, or he can do some action that is valid only from the administration, and so on. Then we do data validation testing. Data validation testing is the big one. Maybe I didn't find an application that suffer from data validation vulnerabilities. It's quite impossible, because here we test all the entry point of the application. And we understand how the application validates this information before doing a particular action. For example, create a SQL query on the database, or create an output on the browser. So if the validation is not correct, we can perform across-site scripting, or SQL injection, and so on. So here we describe also for the SQL injection how to test the Oracle, how to test my SQL server, and so on. Here are all the other data validation testing. Then we describe the Daniel service testing. Usually we didn't perform the Daniel service testing, because we touched the application, not in the environment. The application is running, so it's not very important to understand the software of the Daniel service. Then when we are a web service, we test also the web services. So here we describe how to test web services, and if we have an agile application, we describe how to test the Ajax. And then chapter 5 describe how to write reports and evaluate the real risk. So here is the index of the methodology. So what is a web application penetration testing? It's a process. It's a process that involves an active analysis of the application to find the weakness and the vulnerabilities. It's a black box process. So we don't know the source code of the application. We know only the URL on the IP address where the application is running. So this approach is a black box approach. And for example, the code review testing is a white box approach. That means that you know everything about the code. So you can read the code, understand when a call function is called, et cetera. You can understand everything about the code. Here we don't know nothing. So the methodology described here with the tool is together web application testing. Our approach in writing the guide is open and collaborative. So everything can give is contribution and collaborative because we decide together what to write and it's a community methodology. Then we would like to create a testing methodology that was consistent and repeatable under the time. So if I test an application with this methodology, we would like to have the same results from another tester. And, yeah, the quality is another target. Here, for example, a testing parallel template. Initially, we describe, we have a brief summary of what we want to test. We describe the issue, and we describe from a black box testing example and gray box testing example, and then we collect all the references and the tool that are useful for this kind of test. For example, here is one of the paragraphs about the cross-site scripting. And here we describe what is cross-site scripting inside the brief summary. We describe the issue. So how you can test for the cross-site scripting. And here, black box testing, the methodology. So you have to detect the input vector and to inject some script to understand how the application reflects your information on your browser. And, for example, here is an example where, for example, you have the URL where user equal Mr. Smith, and Mr. Smith is reflected on the browser. So, for example, you can write down script, alert 123 slash script, instead Mr. Smith. And if you collect this kind of screenshot, you understand that the application doesn't correct, validate the output. So you can create a reflected cross-site scripting. Here are other examples. And here are references. So you can read the white paper and the tools. Here, again, web scallop. And all was called 9,000 is another free tool that is a collection of web applications for the cross-site scripting. So you can use it, et cetera. OK, here the difference, because we described also the gray box testing. For example, if we know the session ID generation algorithm, we know something about the application. So it's something of gray box testing. But, again, the white box testing is not the target of this guide, but the code review guide, that is another guide of OWASP, is focused on the white box testing. So, now I introduced the methodology with some examples. We start, I say that we start from the information gathering. So the first phase in the security assessment is to play with the application with a tool like web scallop or idle tool and understand how the application answered to you. And to find all the tree of the application, so all the directory accessible from the public, et cetera, so you can write down all the entry points of the application. Entry points, I mean the entry points, for example, when there is a form on the web page, when you insert user name and password, user name and password are two entry points of the application. And these are something that you have to test, for example, for data validation. So you can understand how the application is functioning during the information gathering. And then you use a spider and robots and crawlers to understand everything about the application. And then once you identify the application entry points, we do web application fingerprinting to understand which are the web server, the application server running on the application. And then we do application discovery and analysis of error codes that are interesting, for example, when you try to request something particular and the application respond with, for example, Microsoft DB all error, you understand that there is some kind of database at the back end. And maybe you can collect information about the name of the table and you can write down for the test for the SQL injection. So here you collect many, many information about your application. Here, for example, if you perform an HTTP head request from your target, the answer is something like that. And here, for example, you can understand that there is a page version 1.3.3 and there is a unique server and there is a redact, et cetera. But for example, what if I do the same request and the header of the server is obfuscated? For example, here you can see the third line obfuscated and obfuscated, et cetera. Also, we can understand that which is the server because the header is in a different manner. So for example, a page <IP_ADDRESS> answers answer with date as fair field in the header and so on. So you can understand which are the platform. Then we do configuration management testing. So for example, the SSL strength of the application, we do DBLH testing infrastructure configuration management. For example, we do also the old backup and reference files that we find quite a lot on the application. For example, if the login is login.jsp, if you try to request login.back or login.hold, maybe you can find this information and maybe there are some information confidential inside this reference file. So you can, once again, found useful information for the test. Then we test, for example, for HTTP methods. For example, if put or delete is admitted on your web application maybe you can do other kind of test. Here, for example, we can find an access to Tomcat admin interface from the internet, maybe. Or here, from Nestus output, we can extract all the ciphers that the server admit. Here, for example, you can see that there is a desk and MD5 cryptography algorithm and hashing algorithm that are quite old and it's better, don't use it. Then we test the session management. Session management is a critical part of security test because the HTTP is stateless and so you have to understand how the application implement the state of the user that is authenticated on the application. So we test for the session management schemes for the QQI attributes. For example, if when I authenticate on an application I understand if I go to see if when the directive set QQI I go to see if the QQI is secure, is HTTP only, if there is a date in which is valid or not and these are all attributes that you have to put on your QQI. Then we test for session fixation for exposed variable and cross-side-quest forgery. Now we see some example. Here, for example, on the right we have a web application and on the left there is a user that hold these username and password. Here I post my username and password via HTTPS on the application and on the bottom you can see the parameter, username and password. Then the web application verify the credential and if it's okay, the web application will generate a QQI and says welcome to Mario Rossi and if you look at the header of the answer of the web application you can see something like that, a set QQI, authentication equals something, a string of characters that will be set on the browser of the user. So, for example, if I request many, many cookies of the application, for example, using web scarab you can collect a lot of cookies, 101,000 of the application so you can understand how the application generate the cookie. Maybe the application generate the same cookie every time we don't find it, but there is a linearity in the generation. Here, for example, is a simple, very simple example. You can understand that if I collect a lot of cookies I can understand that there is a linearity in the generation so I can understand that the next cookie is that one, just plus two. So, for example, if I am authenticated on the web application and I request my money, how much money I have inside the bank, if I understand the mechanism of the session I can modify that with the web scarab so here I send to the web application not my cookies, not my ticket, the ticket that I understand that is from another person. I don't know which person is, but I know that maybe there is an open session so I can do a session ejecting. So the web application now verify my identity not from my username and password, but from the ticket and the ticket is related to Mario Verdi and not Mario Rossi, so Mario Rossi and you can see the account of Mario Verdi. This is an example of session ejecting. Okay, another example here, for example, in a web application where you can create your own MMS and then send it to a user via a network mobile phone. Yeah, I don't describe everything, but the attacker is the first one on the left and has a laptop and a mobile phone and there is a spoofed identity with another phone and there is a receiver with another phone.  So I send him a session ID and my telephone number. What if I modify that number with another number and we saw that the application doesn't correct validate the session ID, but validate only the MSISDN, so the result is that the application charges another user and not me, so I can send the spoofed MMS to another person and pay a spoofed identity. Another test, very interesting, is cross-site request forgery that is a quite new vulnerability that is not so, we found a lot of cross-site request forgery and I don't find the, okay. I describe the test. We find the cross-site request forgery when the application permits to send an authorized function without authorizer every time the user. And we use the image tag attack to create and enforce the user to commit that action. Now we see better. The first step is to find a vulnerability function. For example, if an application has a function to create a new user or there is, and this is only for the admin, for example, or there is a found transfer, for example, all the online banking site permit you to create a found transfer. We understand that there are these functions. Then we analyze how I send this information to the server. For example, when I click Submit, I want to create a transfer fund from my found to another fund with 10000 euro of fund. I understand which is the request. So I can create a malicious email or malicious site in which I force the browser of another user to do that action. The result is not an authorized action executed, but the user don't understand that. Another example. For example, online banking. Here is the transfer fund mechanism. You can see the HTTPS, examplebank.com, the transfer function in which the variables are EU and 2. This is very simple to understand the vulnerability. For example, if I am authenticated and create a transfer to the count 1234, and this is the amount, the request is something like that. The second step is that the user must be authenticated on the application, the user, which is subject to the attack, must be authenticated on the application, and then I force him to request these HTTP requests using the image tag. Here is the example. If I create a page like that, in which inside the HTML I insert the exact request that I understand that the application is used for a transfer money, I can force a user to request this one. For example, if I send an email to one million user, and maybe one user is reading this email, consequently, if he is authenticated on the web application, the browser will execute this command. So the user does not understand that he is doing that. And the application sees that the correct user is doing that. So it is a big problem for say, hey, I didn't do that, but the application sees that you are authenticated and you are performing that action. So it is a big problem to understand that you are not requesting this kind of transfer fund. So the cross-request forger is a big vulnerability to test and to understand. Then, authentication testing. If you have a question, please, because I see, OK. Authentication testing, we go to see how the authentication mechanism is robust and so on. So we test the credential, we test for user numeration, for user account, for the brute force of the web application for bypassing the authentication schema. Here we can see some example, for example. Here there is an application with Mutual Digital Certification certificate. And you can see the user with his own public key certificate and the application install a public key certificate on the proxy behind the application. So here we found, for example, that the handshake SSL and mutual authentication is from the user browser and the proxy. So on the layer beside the application layer. And then we analyzed that there is a script client that collect the information of the user certificate. So there is something inside the browser that go to see the user certificate and send the user distinguished name to the web application. So here you can see that there is an error, a logic error, because here is the authentication post. When I send from my browser to the server, my user distinguished name, you can see in the last row, user distinguished name equal 100. So I do handshake SSL with the proxy. But from an application layer point of view, the client send to the application is distinguished name. And this is a bigger error, because the application verify with SSL who is the user. And the application must see inside the certificate of the user once that the certificate is verified who is the user, but not asking to the user, which user are you. So here there is a big problem, because everyone here think that the application is very secure, because I give to every user a digital certificate. So I think that I implement a very secure authentication mechanism. But if you go inside and understand all the request that the application is doing with the browser, you can understand that there is a big security flow. Then we do authorization testing. We test for patroversal, for bypassing authorization schema, and testing for privilege escalation. Here, for example, here, you can see a site where you can download something, for example, from the file system of the server. And what if you do something like that? The ID parameter here is validated, or you can insert everything, and maybe navigate inside the file system of the web application. Here, for example, you can see a cheap pass vd. So all the running process, et cetera. Here you can see how to bypass the authorization schema. So, for example, the user jsp is part of an administrative menu. You can see that an admin can create a new fake user with role 3 and group 001. And you have to test if another user that has not the privilege of an admin can do the same, for example. If you understand that there are some administrative functions, this test want to verify if I do the same with no privileges, what is the answer of the application. The application is currently validating the authorization mechanism or not. If you test it, maybe you can find a lot of surprise. Another test is testing for privilege escalation. For example, here, the server response after the user authentication, here, the application use an hidden field with the profile value. You can see sist inf1. And this value is the authorization parameter. And once again, is given on the client that everything that is on the client is avial. So you have to verify that before using this information. And what if the user modified the value from sist inf1 to sist inf3. And in this case, we understand that we become administrator of the application. So once again, the authorization must be on the server side, not on the client side. Then we perform a business logic testing that is, OK, I ran it a little bit, that is a test where we understand, for example, if there is a workflow inside the application, and to execute a particular function, I have to go throughout step 1, step 2, and step 3. What if from the step 1 go directly to step 3? And there is some mechanism inside the application that verify that I have to do the step 2, that another test. Then we go for data validation testing. As I say, you can find the main vulnerability inside the application, because the application are full of entry points, and it's very difficult to verify all the entry points, and validate correctly the output, the SQL query, on the Heledap query, and so on. So here, for example, is a reflected cursive scripting where in this site, there is a search field at the bottom. And what if I write something like that instead of home, I research for home, or something like that. Maybe I can insert a script. And if the output is something like that, I understand that the application doesn't validate the output. The stored cross-site scripting, here, for example, we have a chat where you can insert a title, a message. What if the application permit to write an HTML, and then you post something like that. And then when a user click on test cross-site scripting, we will execute on the browser the script. So, for example, I can store the, I can steal the cookie of the user, or I can manipulate all the browser of the user. OK, command injection. Here, an example from a web got. What if there is something like that in which I request a file on the file system, and simply add something like that. The result here is something like that. You access to the file, but you can access also to the volume of the hard disk. Then we do web services testing. There is a plug-in inside WebScarab that is very useful for the view WSDL. So, when you find the service, you can use this plug-in, and you can insert, maybe you can see here, something inside the web service, understand how the web service can answer to your request. Here are some XML structural texting. For example, if I invert the tag of the XML request. Here, if I insert a large payload of the inside the XML, what is the answer of the service? Then, I will shortly introduce you the web application testing. Then, it's important to have a testing report model. So, we create a always prescrating model. It's very easy. Risk is equal likelihood for the impact. And we need to identify a risk, get information about the vulnerability, the trade agent, and then understand the impact of the successful exploit on the business. OK, so we can understand what to fix, what are the risk modes, et cetera. So, here you can see that the writing report that we can suggest is something like that. In exactly summary, a technical management overview, an assessment findings, and a table where for each category of tests, you can see all the vulnerabilities, the name of the vulnerabilities, and where is the effect item, where are the findings and the solution, and the evaluated risk about the vulnerability. OK, so how can you improve software development in the lifecycle? The OVAS guidelines can help you to develop web application in a more secure manner. The building guide tell you how to develop the web application to protect for SQL injection, for example. The code review guide tell you, from a white box test point of view, how to test the function that you are implementing. So, viewing the code understand that there are security risks. And the testing guide tell you how to perform SQL injection once that you have developed the web application and you don't know nothing about your web application. So, inside the software development lifecycle, we can divide in five phases, from the defined design, develop, deploy, and maintenance phase. The controls to implement are training on the user to do policy review guidelines, adopt guidelines, doing code review and doing web application penetration testing. So, here is a big picture about the SDLC and OVAS guidelines. On the left, you can see that before the SDLC is improved, the OVAS guidelines can give you an help on how you can create your development lifecycle. And then, in the defined and design phases, you can use the building guide to develop a SQL software. And in the development phase, you can use the code review guide. And before the deploy, using the testing guide that just described. SDLC is not a buy to buy because it's a very complex process. And, OK, just a flash about the PCI standard and the OVAS. You can see that the control 6.5, the PCI standard, tell you to use the OVAS standard inside your application that you are collecting information about credit card number and so on. So, this guide is useful. We think that this guide is useful for the industry, for the pen testers, so the company that do audit of the application and for the clients. So, we have a methodology that is open and shared between the client and the audit. Future steps, in OVAS, we would like to integrate better the develop, the code review and the testing guide and improve the client's side security. And, OK. So, I thanks all the authors of the version 3 of the testing guide and we have one minute for the answer, for the question and answer. If you could repeat the question. Yeah. You also said that we can have a wide box approach. Code review, look at the code and see if there are really opportunities for the code. What would be the balance to do between the wide box and the black box approach? Inside an organization. Yes. We saw that many companies require web application penetration tests, so the black box approach. But we know that is the last step that we have to do. So, our idea is to begin to implement the control in the first phase of the software development lifecycle. So, from the guidelines and the code review. So, we know that doing code review is more effective than doing web application penetration testing. So, your answer is correct. The code review is better because you can see the code. You can see everything about the code and see, OK, in this line, in this component, you have a problem. And you can write down the remediation immediately. And instead, if you do a black box assessment, you know that there is a vulnerability, but maybe you don't know where inside your software. And it's more complicated. And it's in another phase of the development. So, more cost and it's, OK. Other questions? Thank you.


What's going on, everyone? Sam here with late sports cards ripping 20, 22, 23, Panini Court King's basketball hobby, eight box half case break. Number one, pick your team style. Let me read off a list of our names in our teams. We've got Alexandros Kings, Anthony C Warriors, Boss S Celtic, C's R A, Sons, Chris B, Bucks, Chun-Wai W, Grizzlies, Corey O Voles, Dean W Nix, Edward P Lakers, Evan H with the Sixers, Felix N, Nets, H Lee with the Jazz, H Wang with the Hornets, Cavaliers, and Wizards. We've got James R Thunder Spurs, Joey Y Mavs, Jose V Hawks, Kenneth R Timberwolves, Kevin R with the Clippers, that's Kim J with the Heat, Lee Wan-Y Pistons, Luke M Pelicans, No-G Raptors, Paul G, Nuggets Pacers, Shelley L Magic, Tom B with the Rockets, and Y Lin with the Blazers. So good luck here, everybody. Again, we've got to fill up number two. We're at nine to go on number two. Definitely check that out.  Nine to go. Let's pull some heat out of this. Good luck, everybody. I know, I can't believe tomorrow is opening day for baseball, too. I'm so amped, dude. Are you? Yeah, I'm going to be watching some of the... Well, I'm not going to be able to if I have to start moving my stuff. I'm not going to have Wi-Fi, so I can't watch the Yanks, unfortunately, but... Get a radio. Yeah, right. All right, let's see. So that's how that goes. We've got Jason Tatum. I think it's all based on the top. Curry, DeRosin, there's Zach Levine to 149. Nice one there. We've got Dyson Daniels. That's going to the Pelicans. Nice one there. Pelicans, Dyson Daniels, heir apparent. We've got 12 out of 25. RJ Barrett. Nice one there. Congrats on that one. Dean, Dean taking the next, second and last team taken. That is game used as well. Yes, game worn patches. All the vets are game worn for the most part. There are going to be exceptions, of course. Very nice. Congrats on that. Let's see really quick. What are the short, short prints in this? Really cool one here. It's going to be Watercolor, Devon Booker. Nice one there. We've got Rookie A.J. Griffin on the works in progress. We've got Andrew Nemhard on the level one, and then David Roddy on the level two for the Grizzlies. Yeah, so you see like there's, this is one versus two, and then it'll have that on the back one and two. Oh, okay. So it makes it a lot easier. Got it. It makes it a lot easier, but you'll know after like four or five boxes you'll know where the lights are and stuff. Yeah, even looking on the checklist, I kind of already have an idea. Oh, yeah, exactly. Yeah, I forgot they got pictures of it. Again, guys, we've got nine to go and number two. Let's get that filled on up. Keep our night moving here. Right on schedule. PG Book. Damien Lillard. There's a Tyrese Halliburton on the paint for the Pacers. Nice one there. Congrats, Indiana. That is going to be five out of 99. Five out of 99. We've got 63 out of 75. Cam Thomas on the Impressionist Inc. Going to the Nets. Nice one there, Felix. Again, one of the last teams taken. These last teams are, they're hitting big so far because we got Dean again with the Knicks. That's going to be Julius Randall on the Art Nouveau. Grats on that one there, buddy. Julius Randall, Art Nouveau. Game worn. Yes, it is game worn. Very nice. We've got watercolor. Yanis for the Bucks. Rookie, Marshawn Bochamp for the Bucks as well. A, Mark Williams, level one. And a, Eggs Benedict, Cumberbatch, Matherin. Level two for the Pacers. Nice one there. Boxing, Road Trace. There's Matherin on top. This is like upside down. This is weird. Peyton Watson, Rookie of the Works in Progress. Watercolor, Anthony Davis for the Lakers. These are like legit upside down. This is strange. Devin Vasell, Red to 149. What's up, Jacob? For the Spurs, Andrew Wiggins for the Warriors. There is Garland, Anthony Simons, Anthony Edwards. Got to Dyson Daniels on the Fresh Paint Autograph. That is number 91 of 199 for the Pelicans again. Congrats, Nola. Very nice. Here's your guys' link again. Nine to go. Teams on sale. Then we've got Art Nouveau is the Entree, Aitin. That is game worn for the Suns. Nice one there, Phoenix. Art Nouveau. Yeah, Walker's going to be a stud. Pull his card yesterday. What was he on again? Cardinals. Yeah, Conley Bradley. Beal, there's a Pascal Siakam. That is not numbered. I don't believe. 12 of 25. Campaign. Cameron Payne. Nice one there for the Suns. That's pretty sweet. Got to love some campaign action. Pelicans gone in number four. Got a J Dubb, Jalen Williams for the Thunder. Nice one there on the Art Nouveau rookie jersey. We've got Jalen Durin, rookie. Hey, Maestro's Cade Cunningham's second year. Level one, Ochai Bahi. And level two, Andrew Nemhard for the Pacers. Product, probably top's update I'd have to imagine he'll be in. Most games are. Yeah, most are. Russ, Jimmy Butler, Zion. There's A, first steps. Chat Holmgren for the Thunder. Nice one there. We've got 135 out of 149. First steps of the break of the night, I should say. Overall, we've got 27 out of 49. Michael Porter, Jr. Brushstrokes, going to the Nuggets. Nice one there, MPJ. Got to love MPJ. He's good. He's really good. Jalen Durin, that is going to be rookie expression for the Pistons. What's up, Carl? How you doing, buddy? What's up, Carl? Pistons. We've got Peyton Watson, rookie. For the Nuggets, works in progress. There's a Jabari Smith, Jr., Maestro's rookie. It's going to be Wendell Moore, Jr., level one, and a Johnny Davis, level two for the Wizards. Again, guys, just nine to go in number two. Actually, eight to go. Eight to go in number two. Celtics just came in. Thank you very much. We're down to eight, guys. Eight to go on the second break of Court Kings. PYT style. Eight to you. Keldon Johnson, Pascal Siakam, Spencer Dinwitty. We've got a Jaden Ivey. Nice one there on the red foil. That is two, 149. We've got the Caruscio, Alex Caruso, Purple Brushstrokes, 20 of 35. Nice one there for the Bulls. Got to go into the Pistons. Rookie expression, Jaden Ivey. Nice one there for, again, the Detroit Pistons, Jaden Ivey. We've got a watercolor. That is Yanis, a Marchand Vochamp works in progress. And AJ Griffin, level one, and a level two, Benedict Matherin. The rookies look really good, they sure. I think they look a little better than last year's. They're pretty fire. Carl, what are you speaking of? I'm curious. Yeah, what's it about, Carl? What's the situation on that? Again, guys, eight to go on the next one. I feel like I've heard a podcast about politics. Oh, interesting. Like a name sounds familiar, but I can't think of where I heard it. I think that might have been a hard time. Probably. Kauai Leonard. That is two, 149 for the Clippers. Got Jaden Hardy. Nice one there. Going to the Mavericks. That is 23 of 49. Manias this week. Yeah, West El Mania week. Yep, yep, yep. Got Kennedy Chandler, rookie expression going to the Grizzlies. On to the rookie jersey card. We've got Colin Sexton, my issues. A watercolors job. We've got a level one, Andrew Nemhardt. And how about a level three pillow? Nice one there for the magic. Grats on that. Orlando. Nice level, level two coming your way. Nuggets gone in number two. We're down to seven to go, everybody. Seven to go. Seven to go. Thanks again. Level threes look pretty cool. Yeah, level threes look clean in this, especially a pillow. That's solid. Yeah, that's really solid. I know I'm excited to see what the fours look like. Really excited to see what the fours look like. All right. Here we go. Here we go. Bam out of bio for the heat. Hero, Devin Vasell. There's a pink Spencer Dinwiddy. That is $2.99. This year, he's a rookie this year. He got drafted first overall. Cool one here to $25 for the Raptors. It's going to be Ron Harper, Jr. Nice one there. Congrats on that one there, Toronto. Very nice on the heir apparent. We've got Jalen Durin. That's going to be going to the Pistons on the Art Nouveau, Rookie Jersey. Art Nouveau. Your pal is leading probably Rookie of the Year, right? Oh, yes. I'm close for Runaway. There's Jason Tatum. Maestro's. A watercolor, Zach Levine for the Bulls. We've got Jabari Smith, Jr. at level one Rookie, and a David Roddy at level two. Let's do a quick recap here, everybody. Thanks again for getting this filled on up. Got seven to go in the next one again. That is Jalen Durin, Kennedy Chandler, Jaden Ivy, Jalen Durin, Jalen Williams, Deandre Aitin, Julius Randall, RJ Barrett. Nice one there on the four-color Vietnamese patch. Otto is Ron Harper, Jr. Jaden Hardy, Alex Caruso, Michael Porter, Jr. Campaign, Dyson Daniels, Cameron Thomas, and Dyson Daniels. That'll do it for the break, guys. Thanks again for the fill. Next up, number two, let's fill it up.


theoretical framework in context of social and political movements that why there are various school of thought why there are various groups those have their perspectives regarding the social and political movements so we have to understand that what type of schools they are and what what's their actual perspective regarding the social movements there is important school of thought that is pluralism and a collective behavior model of social movements then there is elite theory and resource mobilization theory and then class framework or the political process model with those school of thought there are rational choice model and then there is post-modern school of thoughts they all have their perspectives they all have their views regarding the social movements so firstly the florist and the collective behavior model of social movements they believe that to value moderate democratic participation and generally speaking non-institutionalized tactics such as demonstrations and violent activities are viewed as deviant from political behavior in healthy democracies a florist school of thought your collective behavior model according to social movements that if a person with any kind of emotion with their own system their point of view if they do not have a clear view and they want to express their disagreement then they start the movement and then elite theory and resource mobilization this theory focuses on the capacity of elite for all kinds of governing and resources mobilization capacity on one hand and the incapable structures of social movements on the other hand elite theorists they believe that when there is if the elite they have the capacity to mobilize the resources then definitely there is no need of social movements but if the elites they are not capable of mobilizing the resources then definitely the outcome will be the start of the social movements so the this school of thought actually they have the doubts regarding the governing capacity of social movements and they view them as a threat or hindrance in the way of elite to govern properly in kaya kyaal hai ki agar social movements jalingi bhi to ultimately kya karlengi kya asal mein to ye power elite ke pass hai that how they want to govern to ease a school of thought ki under bharat saare aise nukta nazar hai jinn par pao zyada criticism bhi hosakta hai then the class framework or the political process model according to this that political process model resembles more the class framework of kaal marks. In ka hi kyaal hai ki har moshre ki under class system uta hai. Har moshre ki under wo log bhi mojood hai jinn ke paaz zarayi hai aur wo log bhi mojood hai jinn ke paaz resources nahi hote aur ye dono ek level takto ek dusre par dependent hote hain ye milkar chalthe hain. Lekin fir ek stage hain ki ye inka apas mein ikh talaf ho jata hai. Working class apni situation se ja mutmain nahi hote, to wo ye chahti hain ki uski surthe haal ko tabdeel kiya jaye aur us context ki under fir wo bakaida tor par movements jahti hain in context of change the system or the structure. The rational choice model, rational choice model actually that individual's involvement in a group activity is totally based on the cost-benefit calculations. Inka hi kyaal hai ki afraad jo hain unke patient azar. Sir, fir sirf ye dekh na chahiye ke wo ye faisla karin akeli toji ki bonyat par ke unke fayda man kya hain. Agar wo isb bonyat par faisla karenge ke tahreek mein shamil hoona unke liye fayda mand hain ya tahreek wo start kab karna hain aur kese karna hain ya kis issue par karna hain to ye basically rational school choice jo hain unki basic thinking hain. Aur agar hum ye dekh hain ke in logon ka ye khyaal hain ki koi bhi jo group actions hote hain without directly participating in its activities. Agar koi group, kisi khas activity ka part hi nahi manda. So, wo koi bhi asim movement jo hain wo kamjab nahi hosakti.  Fir jo ek aur aakhari school of thought hain, they are the post-modern model. They, this model basically is the reflection of industrial society. And they have the very clear distinction between public and private spheres, but the start of 21st century brings a blur image to this distinction, to post-modern and post-industrialist discourse. To fir public and private, jo school of thought hain, jo logon ki involvement hain, public-private partnership ki bhaja se waha par ehtajaj kaise hoega, waha social movement, skin basis par rise karengi, wo kiske khilaf ehtajaj karengi aur yeh tahri ke kiske liye fayda man hoon ghi. To zahere post-modern model jo hain, yeh bohati dil chasp aur iske andar, hamare liye, bohot kuch hain seekhni ke liye.