What's everyone take down here back with another video today. I'm gonna be reacting to three more movie trailers These movies are gonna be coming out this coming March and they include captive state Dumbo and Captain Marvel. So we're gonna start off with captive state. Let's check out the movie trailer. Oh He's in this movie. Okay The state of our union is strong what I read about it is It's an alien movie Aliens took over basically But I'm not getting that feel yet though. It doesn't have that Feeling to it. Okay I haven't seen any aliens yet Looks very weird. I don't really get it too much Very interesting trailer, but I don't get the alien part. Okay. I get it now It's very subtle though It's not like it was described to be okay, so that was the movie trailer for captive states now It seems very mysterious It doesn't explain much in this trailer And I'm kind of curious of what it's all about because what I read about it is it's supposed to be Where aliens came and they're living among us now They are pretty much in control, which I don't really get in that trailer I don't have that sense at all in the trailer. Of course, you've seen something Floating that in the early part of the trailer kind of like it was on a beach and then you of course seen the Alien creature whatever it was Nearing the end but throughout the movie trailer. You don't see any aliens You don't really get a sense of what's happening. It's basically all confusion It looks like the government or the militaries are trying to control people so the aliens don't Harm anyone. I'm not really sure what's going on in this trailer at all because there's not much information For this trailer that they show in the trailer at least I'm gonna have to give it like a three out of ten rating just because it looks like it's something that You're gonna have to watch to get all of the details to kind of connect everything of what the movie is about But they couldn't really put much in a trailer the next trailer We're gonna be watching is gonna be for captain Marvel. Let's check it out So scrolls are the bad guys No Whoa, I was not expecting that It's uh, I can't remember which movie it was where there's an old lady that turned out to be evil As part of it. I don't know that was really cool though Marvel lately do a great job with the trailers though. So I'm excited for this So is she like an alien? I don't know kind of confused It does seem like it's set farther back in time it's not in modern day And he's Nick Fury in the Marvel universe So it seems like it's set back in the 80s Early 90s because of the vehicles, of course Yeah Simrel L. Jackson plays Nick Fury so in the Marvel universe So maybe this is pre Nick Fury before he became Nick Fury and this kind of tells the story about Captain Marvel For all that I think that supervillain died in Guardians of the Galaxy one I'm really curious. It does look really good. It looks action packed Which is what I love in movies and especially Marvel. That's what you expect to see Yeah, I love it. I'm definitely gonna check this one out Yep, for sure. So that was the movie trailer for Captain Marvel But like I said while I was watching the trailer It does seem like it's not modern day based on the vehicles everything that's happening And because Samuel L. Jackson currently in the Marvel universe is Nick Fury to me It seems like it's back in the 80s or early 90s It will be exciting to see everything that happens because this honestly looks action packed It looks amazing and you guys know I love Marvel movies. So this one here I'm gonna give it an 8 out of 10 because it looks amazing. I'm definitely gonna be checking this one out I can't wait to watch it But we do have one movie trailer left to watch and that is for the new remake for Dumba Which whenever I was a kid, I loved the animated version. So let's check this one out to see if it compares I'm really looking forward to this one Okay, that makes more sense while they're zooming in on the castle. I was wondering that I don't know how this is gonna fit with modern day though because they don't have Circuses anymore. They kind of took that out for animal abuse So it's gonna be Like a throwback and because it's live action Yep, that's Dumbo Wow, they nailed that spot on I'm really excited for this movie. Is that Danny DeVito back there? See like the circus leader? I'm not sure what they were called Yeah, that's him. I think him with this role is going to be amazing That's cute this one this movie's getting me right in the feels right now Just because I loved the animated version the original One back when I was a kid. So the fact that it's live action usually ruins that for me This live action looks amazing and it seems more emotional than the animated version felt It burns down No way Is that I'm really excited for this like I have goosebumps. I'm so excited Okay, so this was the movie trailer for Dumbo. I am super excited for this movie I literally have a goosebumps watching this trailer. It was so good. It was a throwback to my childhood I love the original Animated version for Dumbo and this looks spot-on it looks even more emotional than the animated version was back then So I'm definitely going to be probably tearing up when I watched this movie in theaters So it looks very well done. I think they did an amazing job at casting everybody for the roles It does look amazing It looks well put together and it does feel like they are telling the exact story from the original animated version It's just it's live action and it looks phenomenal. I'm really excited for this one I'm gonna give this movie trailer a 9 out of 10 rating because I am amped up And it's the first movie trailer that I reacted to that I actually have goosebumps from it I can't wait for this movie to come out. I am so excited. I'm ready to watch it and relive part of my childhood So out of these three movies. I'm super excited for Dumbo I'm really excited for Captain Marvel as well because you guys know I love superhero movies But for captive states it is one that I'm definitely gonna be checking out and seeing the bigger picture for it Because the movie trailer didn't give it any justice It didn't explain much of what's gonna be happening during the movie So hopefully watching the movie itself. It does put all the pieces together But right now I'm more excited for Captain Marvel and Dumbo So out of these three movie trailers, which one are you most excited for? Let me know down in the comments below and I will leave this video here Like I said moving forward in 2019 I will be doing more videos like this because it's something I really enjoy doing I love checking out movies and watching movie trailers So by doing it for a video makes me really excited for the movie. Hope you guys did enjoy. I'm gonna leave this video here Please take care. Peace


It was lit.  Who got drunk with the, the old one tells who got drunk and told you he was fine.  I don't know what he, I'm, I, I let him know, like I'm in the industry, but I ain't in the industry industry. No, no, no, how, how, how to, somebody approached you, how did they approach you? No, I didn't. You think, you think it was for that, you think it was the, Man, this. The connection to go to the next level?  No, I'm just saying the way he tried to, you know, that probably was an awful, that was probably was that visit.


HELLO EVERYBODY AND WELCOME TO THE PIES OF THE UNIGROVE OOOOOOO And I am playing Exterminus again on medium just like I did before Except this time we are on the wave that always kills us I think it's wave 15 and I am doing friggin amazing I was actually gonna do a few test runs just to make sure to see how far I could get But at the moment we are doing so good We are absolutely like trashing anything that comes up against me I've got a huge wad of food I've got a huge- oh I don't need that upgrading I've got a huge wad of like Spitty Mortar Bum Bums We're doing just so good I can't even explain it It's just like it's all working great I've got like workers just collecting separately from the food areas that I'm scavenging from Just so I can instantly go off and go and kill something else I think I may need to be over here so that's where I'm gonna go Never mind it is over here Uh oh Okay uh you know what?  Food star here we go here we go So we got re- all our wood ants that are shooting are basically fully upgraded A lot of our black ants are fully upgraded too I don't have too many upgrades I think I only have one or two Um that you can add to the entire kind of like colony wide Uh sort of aspect of things So now I- yeah man look we've only got this area and this area to go We've pretty much um exhausted all the resources The workers are a bit stupid I think it's the AI Like they don't go off and find stuff too well Um yeah look at this look at this like this should be pretty difficult right Uh uh not difficult at all We got level three they can take like three hits from one of those big cockroach things And yeah um I will send them over there and level level ones now I'm kind of tempted to I don't know I'll send them over here so we can just dig out this area a little bit more Um but I feel like the hermit crabs are coming and if the hermit crabs are coming It's not too bad um it could be a lot worse And we are so full on food I don't even know Like how to add more like there you go I guess like we need more food tiles Oh what is this?  Oh it's the mantises oh my god I forgot about the mantises Oh lord oh no oh no they're right on the queen I forgot I forgot about these No defend the queen quickly Luckily yeah they got absolutely minced so did a lot of mine my food is going down like Fair bit but uh it's not it's not so bad um we'll upgrade this Got a couple more to get this area a little bit as well We'll send the these guys down here to you know get food there And then there's loads of food just kind of like scattered about So I will send another bunch of workers just over here to hopefully uh Dig that out um and get the food and there's there's even more here Okay big workers go here now this has to be the hermit crabs coming up It has to be um I'm kind of tempted just to upgrade like my workers just because I can They don't cost anything uh I might as well just add some speed up tiles there as well When they can make those and they're making upgrade those and that's just gonna allow to upgrade everything else So we've got 26 seconds I kind of I kind of want to uh send all my big my big boys over here Because I feel like it's definitely the hermit crabs so there we go we got all the food from there Next is just this this these are going to be huge bottles Yeah, so this was supposed to be like oh, yeah, I'll do a couple of try games and then we'll start again We'll try again. Um, however this happened so it didn't really go that way. Uh, yeah, there's the hermit crabs There's a lot of hermit crabs. Okay. Okay. Okay. Now surrounding is not the best way. I've tried that in the past Um, oh god, don't attack don't attack don't attack just yet. Don't attack just yet You just need to bottleneck them Uh about here is probably okay because then we've still got all this all this and the thing is I've got so much food That it really doesn't matter And I tell you what I'm gonna put those workers back onto the sgs defend them. So there we go. There we go. Here we go So we all the all of the uh, the wood ants that are shooting are pretty much upgraded Um, but look at that the hermit crab is just healing like crazy Uh, we need to dig this out. We need to dig this out We need yeah, there's not many black ants that can get around. We need to dig it out. Yeah There we go. There we go. There we go. I do not want to lose those ants there So I'm gonna put all workers just to get the nest stuff Um food stores are fine But who cares about food stores when we've just got hermit crabs attacking and the thing is these guys take a while They take a while, um, and I'll probably dig out here. So we're gonna upgrade these two And we'll put some speed up tiles like here And then once these are made we can upgrade those guys. Um, oh god Yeah, upgrade that and then we're pretty much good. Yeah, we're gonna be good for these Oh god, see the hermit crabs are just There we go another one dead. Yes. Yes. They can't heal if they're not eating us Upgrade that and then that should upgrade this one as well. Uh, so we've got eight seconds Um, we're not doing too bad. Just the bulk of my army is here and it depends what comes next That's the real issue. Um As long as it's not fast. Okay, it's not fast. That's fine. That's fine. We've only got two hermets left There we go. Uh, and then the rest of the army can now come over here. Oh god. No music come over here Not those Yeah, just go away. Go away. Don't get food. Don't get food. Don't get food You just need we need to now just defend the queen like these aren't too bad like these guys It's just a matter of just kind of bottlenecking them Yes, here we go. Once those wood ants stop putting in firepower We are freaking all good. Like watch this. They're just going to dissolve now Once the out the wood ants get closer Okay, I'm not collecting food. I can turn that off now. Uh, I'll probably put Um, the workers to go collect the hermit crab stuff because there's a lot of food there. How much each? Fifty four each that's brilliant. Okay Yeah, they're just confusing them I don't have too many shooting bumbums. Actually, this is this is a little bit of a predicament But I mean, it's not too bad.  Yes Yes, and now they can eat these now they can collect these basically. We're good I'm just going to turn off that waypoint because I could send that and just easily Quickly do that stuff. So we've got 10 seconds now. So we basically don't have any time to do anything else We'll do great anything. Uh, I guess I could make more uh more of these guys. I suppose black ants aren't too bad Uh, let's see where's what's coming from. Okay, so it is The trap jaw ants, which depending on how many there are they are level three though That could be that could be a bit of an issue Um, I will send these guys to collect the little bits of food The uh, they'll just send them all the way over to here because it's still from a previous excavation So yeah trap jaws. I don't think we'll be too much of an issue because they're going to take a lot of damage Straight away and then just jump back Um, they're not going to be good against the shooties though The shooties aren't I'm going to be able to hit them because they're moving but yeah As you can see that was a wave that was super easy super easy. So we're just going to tell these guys To go over here already. We're full on food stocks Oh god, okay, uh, so we'll we'll just dig out this area. I'm probably separate that a little bit This doesn't make a difference I don't know, but we'll just put some food down here Um, are they still excavating? Where's three? They should be going that way. Were they not going that way? Oh, they were going this way. Whoops. I've set the work. Oh, no Set the wrong one Okay, still 40 seconds to correct the mistake. It's fine. It's fine. We're going to use a fair few workers We're going to grab a lot of food here There we go So there's more food and I'm just going to make sure that's upgrade because if I can hold on to the food That's perfect Um, I also want to dig out all of this as well because maybe this could be a chamber for something So, yeah, they're just going to grab that. We've got 20 seconds. Um, I'm like I said, I don't know what's coming So I'm just going to hold the bulk of my army over here And just see what happens Uh, I think we should make some speed up tiles up here like solder I should make some speed up tiles Just so we can like run faster if we need to get around areas like anywhere that there's like empty space I should just put speed up tiles Uh, okay, something big's coming something big is coming. Oh god It's it's these guys. Okay. Do not collect food. Do not collect food Workers you all need to be on working duty. Yep. Yep these Oh, these are like the toughest ones I think Um, oh god. Oh god a bottlenecked in the wrong place. Oh, no, they can still get through though It's not it's not too bad. It's not too bad. Um, although they're now being overwhelmed Oh lord Oh Keep the water Oh no, oh no, oh no We need to get back. We need to we need to be back. We need to be back. There's too many We are losing we are losing We need a bottom that wish I didn't realize these were coming the bottleneck. That's better. That's better That's better. Keep them here. Keep them here. Thank god We've got so much food and we've got loads of black ants and loads of workers to constantly uh Keep them at bay. Yeah. Yeah get in there get in there There's a lot of them, but they're almost dead. They're almost all dead They're all like low health now And where our numbers are coming back numbers on the increase numbers on it. There we go Just collect food now guys collect food collect food You do you do a thing you join them you join them sod it We've got 20 seconds. We need to make up for all that lost food Ha ha ha Oh boy Well, that was tough. We're lagging the game man. Okay, so let's just upgrade as many of these black ants as possible Um, I feel like I want to upgrade the workers. Oh, I don't know. I don't know. I don't know. Okay. There we go We're doing good. We're doing good. Put them back on that Judy. Okay. What's coming in? Okay, when you'd be here. I don't know what this is.  What are those? Oh There oh no, oh there are me ants. Oh, no That's not so good. They're gonna get the rage. I can already see the rage No way Oh god, there we go. There we go. There we go. There we go. There we go. There we go. Not bad not bad Not bad. Okay. Dig dig dig dig dig. We can take out whatever's coming this way I need to make this this this stuff work for me. I don't really have too much Uh When it comes to like Black ants and I don't want to invest too heavily into them. Uh, yeah, here we go and just excavate all that all the other black ants Can take that we're getting there though. We're getting there There we go. What's what's here? What's here? Okay? Ah, that's fine. Oh god. Oh god. Okay. Okay. Well, we've Uh, we've probably made a little bit of a mistake here Um, because they they're going to grab loads of food and because they were grabbing food They haven't left many to take these guys on Oh dear And we've just made all of these this shouldn't be too bad. Just make the level 3s where we can Um, yeah, they're coming. That's okay. We've got 10. We've got like 10 seconds until next wave And then these guys should be absolutely killed here. They won't stand a chance Yeah, once those wood ants start firing and they're just clogged up Melted ears. They don't have any really good upgrades on them either. Okay. Where where's the next one? We have Tunneling ants. Okay. We're gonna need to get over here. How many? What are these?  Oh, they just trying to release stuff Okay, I'm being swarmed from all angles. So basically all we do is just stay by the queen. That's basically it Oh, they're deliberately avoiding the uh, the big thing. So that's not so bad Yeah, this this isn't much of an issue if I've got to admit They're just opening up. Um All the ways which I guess isn't too bad Uh, I'll send the level I'll send the workers over there to collect that food because we are actually low on food Yeah, and they're pretty much all dead. Okay. I will also send all of these over there to just collect all that 600 we're half we're at half capacity when it comes to food And I do want to just upgrade all of these that I can so now we're on 97 food So we've got 50 odd seconds to get stocked up now. Um because we're about to get loads of You know, they're okay. They're okay. And so we've got 40 seconds We need we need like a thousand food now. We're on what 40 odd. Come on. Yes Get out of the room at all. Sorry. I'm like completely hyper because I'm so determined that we will win this And I will survive for as long as possible. I am running out of food though pretty quick Um next is this But I kind of don't know what I should be worried about now. Um, all the food's coming in the food's coming in Yeah, happy with that 700 years. So let's see.  It might be 24. No, it's 23. Okay. It is just the devil coach horse Beals Um and some giant major ants from a different area.   No Oh god, oh god Oh god, they level three Oh, this is tough because they're coming in from loads of angles. Uh, my workers aren't doing too bad Um, so hopefully they're not being assassinated while they're going to place eggs and stuff Um, yeah, and the other ones are hatching. It's just a case of having to place those eggs Yeah, the majors. They're just taunting. They're not I mean they do a lot of damage. They're tanky, but I'm okay taking them out. Look at that. The workers see the workers can actually stand up to them. That's a level two major The they're all bark and no bite basically Um, okay, so there's not much food there. So the next big bit of food is over here So we'll just go over here. We've got 40 seconds. We can definitely kill whatever comes out I will just select them to to eat that and I will put one over there So it needs to just flip them to that one any other food that we haven't collected I guess I could put a waypoint there for so once they've got that Um, they can go grab it So I can just easy just yep once they got all that then move them over to level three So then go grab that the ants must fight 12 seconds Um Again, not much of it. I'll tell you I'll not excavate anymore I'm not excavate anymore and I'll bring them back to the center because I don't know what is going to come next And I want to be prepared because it could be quick and it is quick. It is very quick. It is these guys the crickets Okay, so we're good. It's a good job We've got them pretty far away from the queen because they'd like to do that little stabby dance And that does like a massive area of effect as you can see ants are dying over here But those are big freaking locusts or grasshoppers.  I'm they're gone. You might as well collect that food. That's brilliant. I will then put Uh, I'll move him on to waypoint four. Not bad. Um, and we'll we'll get this food We'll get this food because there's a fair bit here anything look at this. We're actually lagging the game now So many so many oh my god Um, and then I will send them over there. We'll we'll grab them over there So that's a lot of food grabbed Um, then we're going to grab all of this food and those ants should be going to collect this. Yeah I don't think there's a great deal here. There's about a hundred actually never mind fair fair amount fair amount And if they if something does come to kill them there, it's it's not too bad Yeah, apart from this big yield There's not a great deal of stuff over here In fact, I'm going to stop that excavation because we've got 15 seconds and I don't want to make Oopsie And then level two level three level three level three. So it's three more level threes of the black ants and they need it They need that health Okay, here it comes. What is it? What is it and where is it coming from? It's from the top. Oh, it's wolf spiders. Oh, it's wolf spiders and okay, and Oh god, I'm glad I'm in the middle. I'm actually glad I'm in the middle Um, because we need to protect. Oh my god. There's so many What? I mean like what how am I? Oh god, um, what are we doing? Uh workers are definitely dying workers are dying a lot. Um The queen is still alive. Um, we've got the grasshoppers down here. Oh, wow. They're actually tanking it. They are tanking We survived what? How on earth have we survived? We we cut our workers got cut down dramatically them But I guess good preparation because once we lost a lot of our workers Then um all of the babies hatched. So not bad and we're actually up on um Resources which is weird You know what I'll take it's a victory When I saw the amount of stuff coming I was like, oh, it's only a few wolf spiders I thought we were done. We're on full for the wood the friggin store Uh, what what was over here? Ah, nothing nothing to worry about nothing to see here. We'll see the food Um, is it that that I don't want to see? But I got to see the food. Yeah, that's a nicer view. Yeah, that's nicer Um, I guess if I'm not worried about yeah, let me just click on that upgrade those Yes, okay now we've got 400 Uh, and what the bloody hell? Oh lord Oh lord. Oh god. Okay. We're gonna have to bring the fight to them now Okey-dokey one two three four five five huge ginormous whip spiders That do massive area of effect damage Um, yeah, it's up to those it's up to the shooty bums The blackouts are just gonna die I mean that's their job. Um, actually not too bad Yeah, not too bad. They're focusing That's three dead three dead. Yeah, we got this we got this Yeah, it was just a fact when they were all attacking because the reach of those mandibles is crazy But now yeah, that's it. He's not the last two seconds now And gone. Whoo Took us down a fair bit took us down a fair bit But a lot of food each one was 80 odd food. Uh, and then it's just up to the workers Oh, I no no don't go there. You're supposed to help. Don't be coward is Um, yeah, well level twos that's okay. Not too bad Uh, you know it might as well just excavate whatever this is. There's a tiny bit of food there But whatever it is will also give us food Yep, so just collect we've got 15 seconds Um, it won't be too bad whatever it is and then just collect the rest of that food there we go Oh, okay, so nine seconds. I don't mind This isn't gonna make a difference. I don't mind releasing this.  Uh now in comes the oh, okay Oh, he's really big on the map. Okay.  He's coming. He's coming. Oh, no Maybe well, he's gonna attack us from the back. So this is a whole wood and colony. We've probably got like the shooters as well Um, we've got the majors up front and then these are either rapid fires or mortars Um, they look like what rapid fire is because I cannot I cannot see anything happening and we do have 800 reasons. So it's not so bad Um, this thing is he's still going. He's still he's taking on level two work. Oh my god Um, this is this is a pretty A carous predicament to be in. Um Oh dear Those out majors can tank Oh, because they're level threes.  Look at him go. He's killed my workers, which is actually not not good Okay, they're after they've got my wood ants now, which is a bit of a bit of an issue Um, actually, you know bottleneckings actually bad for me So I am gonna I'm gonna kind of retreat Um, because what we want to do is kind of just get round to them Or maybe they don't have shooties. I don't know Because we have numbers we have frigging numbers on us. I'd look at that our food is on 200 Oh doggy. Okay. Now it's okay. So now we can uh, oh no, they do have rapid fires at level three Okay, never mind. Uh, we got 130. Oh our food is dropping by a lot We and these ants the thing is when we're taking on these ants, they don't give us much They give us like nothing our workers have dropped. So, um, we're not going to get many eggs.  That's what's probably gonna happen Um, or not. I don't know. Oh, they're all being distracted by the queen, which is great because that means I can kill them Um, but a lot of my workers aren't going to be making eggs now Oh, how many? Oh my god Was that it? Was it just praying mantises that were gonna come? That oh that would have been great.  We're like 800 food or something and then Because the ants just give us nothing because we can't eat the air mages That was it. But I would have rather taken on those guys. That would have been way easier Yeah, they would have instantly killed one ant each but then like the mortars and everything would have killed them So it's just the ant majors that was the issue and I don't really know how to counter that Really, but let's have a look at our final score 716 points getting Do we have achievement tracking? Oh, I don't know what that does. Well, I oh my god I can't wait. Should we do another one? I'm really tempted to do another but I'll not I'll not because I'm addicted to this And it's loads of fun, but I am also tempted to see What extra abilities we can get so I'll go back on medium because when we start I have 1000 points now So the only thing I added Was the 40% damage for further physical attacks for 1.5 seconds. So that's why that strategy works Uh, really well for them targeting takes an extra damage for the venom attacks So yeah, I'm not really not really needing that um, but I didn't even upgrade my black ants at all and Maybe it would be good for a leaf cutter major. This and nearby creatures reflect 30% of damage back to the damaging creature This and nearby creatures reflect 30% Oh Oh, that's crazy. That would have been amazing and who cares about trap drills.  I love it. Anyway guys, we're gonna wrap it up here That was loads of fun. If you enjoyed it leave a like until next time. I'll see you later. Oh, bye. Bye


My favorite pasta alternatives, you know sometimes there's nothing better than a decadent hearty bowl of pasta But you may be saying dr. G isn't pasta loaded with lectins Well, yes traditional wheat pastas are terrible for your health But luckily there are plenty of delicious and healthy alternatives in today's episode I'm sharing my favorite pasta alternatives that you can enjoy right at home While staying slim and healthy. All right, let's start with millet pasta Millet is a seeded grass that most of you know like sorghum is Actually not a grain even though it's marketed as a grain that has absolutely no Lectins and it's actually very efficient in producing grain with very low water So as water becomes scarcer and scarcer Millet and sorghum become much more important grain alternatives for multiple reasons Now it can be made into a pasta that supports both heart and gut health It's rich in magnesium and potassium and it can work wonders for your gut It's great for digestion and may also support better nutrient retention There's a lot of dietary fiber in millet and as you know the dietary fiber in millet is what feeds your good gut bugs and This is actually got a great Mouthfeel like al dente pasta and it kind of holds up to cooking This one's made by big green. We use these we like them and that's why I'm showing you All right, next up Shirataki noodles Now Shirataki noodles are often called miracle noodles a brand name or Conject noodles there about 97% water and about 3% Glucomon and fiber Glucomon is a fiber that comes from the conject root Glucomon is viscous, which means it absorbs water aggressively and it's a type of Soluble fiber that has been shown to absolutely feed good gut bacteria now these noodles move through your digestive system quite slowly which makes you actually really feel full and They are not absorbed by us, but our gut bacteria think they're dessert So anytime you can find Shirataki or miracle noodles and I have a lot of recipes on YouTube A lot of recipes in my books that use Shirataki noodles. There's also Shirataki rice Next up is sorghum pasta Now this virtual spaghetti swaps is one of the great superfoods Sorghum is full of polyphenols and gut-boosting compounds that contains a lot of B vitamins Which play an essential role in metabolism nerve cell development and healthy skin and nails It's also a great source of magnesium that unfortunately almost all of us are deficient in What's more a half a cup of sorghum provides seven grams of fiber Which is about 25% of all you need on a daily basis and quite frankly I love my Gundry MD sorghum pasta to me It's got the best Mouthfeel of any of the pasta as you're going to see here today Sorghum is high in antioxidants that include flavonoids, phenolic acids, and tannins These antioxidants can absolutely go a long way in reducing oxidative stress Finally, this grain is a great source of plant-based protein In fact, it provides as much protein as quinoa A cereal grain renowned for its high protein content that unfortunately is loaded with lectins Next up fairly new one Green banana pasta. This is organic green bananas You've heard me talk about the benefit of green bananas and now it's available in a pasta The great thing about this is it's loaded with dietary fiber And it also has a really good mouthfeel The other wonderful thing about this it is ready in four minutes of cooking So if you've got kids who are screaming for pasta and no time on your hands Great new product with green banana flour Next up Palmini pasta made from hearts of palm Now I love this because very much like Conjac noodles There is virtually no sugar and it's mostly fiber So I prefer this mouthfeel to that of Conjac noodles But it's a it's an individual preference It's so easy to fix you fix it almost exactly like Conjac noodles But the beauty of this and Conjac noodles is it's all fiber and no sugar And before we go after we're done with all this I want to give you a warning about the carbohydrate content in all of these Except Conjac and Palmini Next up There are sweet potato noodles and vermicelli This one is made from sweet potato and purple sweet potato, which you can kind of see the purple color Sweet potatoes are another great source of dietary fiber and these cook up pretty quick It takes about six minutes not very long. They're ready. Don't over cook these These become slimy, but another great change of pace this particular one is B green as well and It's lectin free. Yay Finally the old standby Capellos, Capellos make spaghetti They make fettuccine. They make other forms now. This is made primarily from almond flour peeled almonds It does have eggs. So those of you who are egg sensitive be careful This to me tastes the closest to Fresh made pasta. In fact, you'll find this in your freezer section Often in the vegetarian area. It cooks up quick again I think it is closest to fresh pasta that you make at home Now word of warning. I have a lot of people who say wow I had no idea and you know, this is great. I'm going to have it every day from now on not so fast most of these with the exception of The palmini and the shirataki noodles Still have a significant carbohydrate content and that carbohydrate even though it may break down slowly is Sugar eventually and I have a number of my well-meaning patients who want to go lectin free Want to avoid traditional pastas that? latch on to all of these and Use it almost on a daily basis and they often gain weight They often raise their triglycerides. They often raise their insulin and they're apoplectic when they see their blood work because they're eating healthy view these as Treats have them on the weekend have them as a special occasion, but don't make them a mainstay of your diet Lastly, you'll see a lot of other pasta alternatives out there made from pea protein made from legume protein made from bean protein made from lentil protein Made from corn Please please please stay away. These are lectin bombs hidden in pasta You don't want to come near them particularly since there are so many great lectin free alternatives And you're going to find one or more of these that's going to hit your taste button the exact right way And make it part of your diet, but don't overdo it. I Hope you enjoyed this episode of the Dr. Gundry podcast make sure to check out the next one here Just by adding the pistachios the participants showed an improved blood glucose level improved endothelial function


Hello and welcome to the International Daily Roundup with People's Test Patch where we bring you some of the top stories from across the globe. Let's take a look at today's headlines. Taliban declares that it will not agree to extend the deadline for evacuations. Israeli forces open fire on Palestinian protesters near Gaza's eastern border. Thousands of nurses across Denmark continue strike for fair pay. Soul Metro workers warn of country-wide strike against restructuring plans and in a video section, we take a look at the surge in violence against women during the COVID-19 pandemic. The Taliban has stated that all foreign forces must withdraw from Afghanistan by the set deadline. This was after US President Joe Biden said that evacuations might extend beyond August 31st. UK Prime Minister Boris Johnson has also stated that there is no hard deadline. The G7 countries will now hold a meeting on the issue on August 24th with restrictions placed around the Kabul Airport. The WHO has stated that 500 tons of aid supplies are stuck. Meanwhile, Afghan civilians have continued to gather at the airport to try and flee the country. Desperate families have also handed over babies and children to foreign soldiers. Murovan NATO officials have stated that at least 20 people have been killed in the area since last week. And Afghan soldiers also killed during a firefight outside the airport on Monday. German and US forces were also involved in the incident. Meanwhile, the Taliban announced that it had reportedly recaptured three districts from Afghan militias. A spokesperson stated that the group was now established in Badakhshan, Takhar and Andarab near the Panjshir Valley. 41 Palestinians were injured after Israeli forces opened fire during a protest on August 21st. Hundreds of people had gathered at the Gaza-Israel border to protest the ongoing siege. The day also marked 52 years since the awesome attack on the Al-Aqsa Mosque in 1969. Palestinians gathered near the Malacca refugee camp on Saturday following afternoon prayers. However, Israeli forces soon opened fire and launched wallies of tear gas at the protesters. The Palestinian Health Ministry stated that at least two people were seriously injured, including a 30-year-old child. 27 people were shot with live rounds in their lower extremities. Two people were shot in the arm and two in the abdomen. The Israeli military claimed that protesters had heard explosive devices. A sniper was also injured. Later on Saturday, Israel launched several air strikes on Gaza claiming it had hit Hamas sites. 11 people were wounded in the attack. Palestinian-resistant movements also opened fire on Israeli drones that were hovering at a low altitude. Israel has carried out multiple air strikes on Gaza in violation of the ceasefire declared in May, the 11-day bombardment killed over 260 Palestinians. Thousands of buildings including homes, schools and hospitals were damaged. However, the over-14-year-long blockade means that materials needed for reconstruction are not available. More over-Egyptian forces also announced on August 23rd that the Rafah border crossing with Gaza had been closed. Over 5,000 nurses have been on strike across Denmark since June 19th organized by the Danish Nurses Organization or DSR. They are fighting for a fair contract. The strike began after the unions. 75,000 members rejected an offer by public employers. They had offered a 5% pay increase over three years. The DSR has demanded a pay rise, additional staff and recognition of the work done during the pandemic. They have also denounced the pay gap in traditionally female versus male-dominated professions. In particular, nurses have rejected this 1969 civil service reform. The union argues that it placed female-dominated professions lower in the pay hierarchy. According to the DSR, nurses' salaries are 15-20% lower than groups with a comparable level of education. While negotiations seem to have reached a deadlock, the strike is now expanding. 225 nurses including fertility services staff joined the strike on August 17th. Another 315 people including workers from nursing homes will walk out on August 31st. Meanwhile, the striking nurses have also held protests and demonstrations outside the Danish parliament. Trained workers in South Korea's capital city have announced a strike. Unionized workers at Seoul Metro are protesting the company's restructuring plan. This includes a 10% cut in the workforce, which means that over 1,500 workers will lose their jobs. It also includes a freeze on wages or reduction in benefits and outsourcing to the private sector. Seoul Metro is expected to have a loss of 1.6 trillion won this year. Workers are demanding that the company receive the same government support as the Korea Railroad Corporation, 60% of Corals and the losses are recovered using government funds. 81.6% of workers at Seoul Metro have supported a strike after the vote held last week. They have stated that they will stage a full walkout on September 14th if their demands are not met. Workers are asking for state subsidies for lost income and a new process of hiring. Meanwhile, the strike could extend beyond Seoul to at least four other cities. Workers in Busan, Daegu, Rajon and Incheon have all voted in favor of a walkout. And for a final story, we look at emerging data on violence against women during the COVID-19 pandemic. According to the UN, one in three women worldwide experienced physical or sexual violence. Preliminary data by various sources shows that this violence grew in 2020. In Argentina, emergency calls from gender-based violence help lines grew by 39% after the implementation of state home orders. Domestic violence grew by 8.1% in the U.S. In Brazil, 649 thymocytes were documented in the first half of 2020. UN agencies and rights groups have termed this surge in violence the shadow pandemic. Here is a video feature by Brazil Defato on this issue. Vazalgas is the 15th anniversary of the Mariana Pena Law, legal device for the protection of women suffering domestic violence. According to the Brazilian Public Safety Forum, every two minutes a woman is victim of this type of violence in Brazil. With the pandemic, the isolation had an impact on these figures. In the Northeast region, the state of Pernambuco has a 36% increase in the number of complaints. It is the state with the most occurrences in the entire region. The Mariana Pena Law helped us to achieve this. It helped women to recognize something that happens to them. The law was very emblematic, because it is named after a woman who was attacked, almost murdered, a woman who reacted and shot the victim. Despite the law to restrain this kind of violence, the housing health demands are still very high. Therefore, several non-governmental organizations such as Tamo Juntas give free support and guidance. Not for the third sector, women would be much more helpless because the demand is higher than the given support. So when we see the media saying that every two minutes one woman is a victim of violence, there is no government, no city that has the necessary structure to support these victims today.  A society cannot be considered democratic. It cannot be regarded as egalitarian or human if women are treated that way. And that's all the time we have for this episode of The International Daily Roundup. For more such stories and videos, visit our website, peoplecest.org, subscribe to our YouTube channel and follow us on Facebook, Twitter and Instagram. Thank you for watching.


All right. Hello. Can you all hear us okay? Cool. Welcome, welcome. Well, thank you for joining us. We're going to do a quick introduction of who we are as a team, and then we'll have our solo introduction as well. Corbin and I have been friends for a while. We've been hacking on bug bounties for a very long time, and we have found some really cool stories that I think it's valuable and also very entertaining, I think, that we wanted to share on a big stage. So thank you for joining us. We'll do it quickly about me. I'm Nahamsek. My name is Ben Sadegui, but most people online know me as Nahamsek. I'm a bug bounty hunter, content creator, and I've been bug bounty hunting since 2015. I'm the former head of hacker education at Hacker One, and I'm the co-founder of Hacking Hub, and the good news is with Hacking Hub, everything that we're going to talk about today, you can also try on your own. Just got to go on their website and give it a try and make some of this stuff as well. And yeah, I'm a public speaker and a trainer. I'm actually doing a training for Defcon next week, so if you want to come and learn how I find these crazy things, please join me next week as well. And I've hacked into a bunch of companies, including Apple, Amazon, Zoom, Airbnb, Snapchat, and more, and I think I have more than a thousand submissions on a hundred or more companies so far. And I'm going to let Corbin quickly introduce himself, and hopefully we'll take you guys on a good ride of hacks that we have done in the last year. Well, hey, I'm Corbin. Sorry, I'm like four foot two, so you can't see me over this laptop. My bad. So yeah, I'm Corbin. I go by CDL on Hacker One. I've been doing bug bounty since like 2016. I like hacking stuff. Also a long story, but I'm a co-founder of a mattress company. So I guess they let anyone in here. So if you want to apply for a talk next year, just put something really random in there, and they might say yes. No, I'm not money laundering. If you need a mattress someday, you can go over there or you can tackle my co-founder sitting over there. Yeah, hopefully you guys enjoy this talk. Thanks for coming. Oh, just kidding, I'm back. So this is a story about hacking an auto manufacturer. So this is, they had a bug bounty program. So it started with me scanning their IP range, and by their IP range, I mean the entire internet for SSL certificates. And I found a host, an IP that had SSL certificate for just their main domain. And when you would hit it on HTTPS, it would just respond with back end IP not found. And their SSL certificate was just wildcard.apps.redacted.example.com. And so my main idea is, okay, this is an ingress endpoint. If you look at LinkedIn job posting, et cetera, you can kind of see what sort of services they're using, and my assumption is they're using a lot of microservices. And so a good tip for finding good word lists is to do subdomain enumeration. Also look at, I guess that includes SIRS-SH. Another good idea is nowadays, everyone's using microservices. So if you look up Helm charts, that's what a lot of people use for Kubernetes, for deploying services. You can scrape 13,000 different Helm charts that have DNS names in them, and you can use that to brute force stuff too. So after some brute forcing, I found a host called configurator prod.apps.redacted.com, or .example.com. And so from there, I knew that this host was hit because they got a different response. I didn't say back end IP not found, the response was different, and said path not found or something is pretty obvious. So basically I did FF with that host header then, and it turns out a spring boot actuator, and it was misconfigured, so if you don't know what spring boot actuator is, when it's misconfigured, there's a couple of different end points, and so there's like env, which dumps a bunch of environment variables, and then there's heap dump, which is just like the memory dump of the application. And so within this, I looked through the environment variables in this env end point, and there were some interesting things, but the most, nothing that was like, really like the jackpot that I was excited for. And in this though, there was this field called, like spring.cloud config URI, and it had like an OAuth 2 end point, and it contained the credentials, but the client secret was redacted because spring boot like redacts like secrets, or it's supposed to.  And so what if we use just those, like what can we reach with those OAuth 2 credentials? So I grabbed those, and you can actually vhost, you can actually hit this like OAuth 2 server externally still, so I hit that and authenticated and got a AuthBare back, and then actually, you see the spring cloud config server, you can also vhost to that, and so I vhosted to that and used the AuthBare to authenticate to the other internal service, and it turns out it was also spring redactuator and also misconfigured again, and both end points were also, you know, like open, and this time, in this environment, there was a field called source URI, and it was pointing to their GitHub instance that was hosted, as a GitHub enterprise, and there was the source username and a source password, and that was also redacted, and it was also a private key for the GitHub user, so I hit heap dump again, and I just grabbed the password, and so then we could, I hit their API and just like GitHub.example, API v3 user, I'm with that username and password, and it turns out it was a super overprivileged account, and it had access to every single GitHub organization and every single repository for this auto manufacturer, so it's like all the source code for everything ever, and yeah, that was a fun time, and they paid me $5,000 for that bug, which is like, yeah, dumb. Anyways, and this is another fun story, this is how I found a bug a couple years ago to publish fake news, so I've been doing an unholy amount of virtual host fuzzing again against this big media company that shall not be named. We're talking like, this is, there's, I have like thousands of sub-domains, like massive word lists, and this was like leading up to a hacker one live hacking event, and so the day of the event, I was hacking with another hacker named Nafi, and we had found a couple cool bugs, and during the day of the event, I found this weird host called like, this is like completely redacted, it's like xyzproxy.prod.ka, it's whatever you can read, and it responded with a different 404 page than like everything else had, and so I started actually brute forcing, and I had like no idea what it was doing, but there was a couple endpoints like slash create and slash update, and so if you hit like dash create, it just responded with like 405 method not allowed, so obviously you just tried doing like a post or put request instead, so I just tried posting like x equals x, and it gave me an error and said, it's just not 405 method not allowed, it should be like 405 content type, so it gave me an error saying like the content type was wrong, and so I tried JSON instead, and just did like CDL, CDL, and it dumped every known property that should be posted in that JSON body, so I made it really easy, okay, thanks, and so I spent the next like three hours of the event trying to figure out what this JSON body was really supposed to be, just like random characters in them, and I just got like a bunch of more errors, but it was really helpful because it gave me exactly what the error was, and so gave me an error about not being able to read tags into an array, so it's like, okay, well tags shouldn't be a string, it should be an array instead, so I just changed that. Another error was like in the streams tag, it was like A, or I just put A in there, and it said like, oh, I just changed that to base64, decoder, encoder, whatever, and so I was like, okay, let me just put some random base, I'll just change that to base64, and okay, it worked, but what did it do? I had no idea what this API was doing, and so it was actually really funny, the event ended, and I'm like, dang, I thought there's gonna be a cool bug here, and so I had some drinks, I left Vegas, actually no, I didn't quite leave Vegas, I was sitting in the airport the next morning, and I went back to this, I'm like, okay, well what is this update endpoint actually doing? And I was really curious about the UID field, so I just went to their main news site, and just view sourced an article and saw UUID in the meta description, I was like, well what if I tried specifying that in the update endpoint, there's no way that would actually work, right? So yeah, we post it, we changed the news article to my name and say, this is a demo release, and by the way, this was like a testy front page, not a good idea, and it actually worked, so I could just change the news whatever I want, it was like during an election too, so I thought it'd be really funny to put some shit on there. And then the best part, and so I wrote this really fast, I got in a plane and like, what the hell just happened? And then they thought I was working with an insider, and I had to spend like three days writing exactly how I found this issue and how I found everything, so I had to write like a 10 page paper, actually I was still in college, so it was just like an extra essay assignment, but they ended up paying for that bug as well. Got to love a good verbose API. Alright, the next one I'm going to talk about is a prison break. This is actually a prison system that is used in a number of different states and a number of different areas that we cannot name also. This application was originally created for inmates to be able to talk to their friends, they can talk to visitors, they can talk to make a request from the people that work at the prison, and also hold things like their social security number, and their records, the conversations they've had, you can send photos, everything, their medical records, you name it, it's on this website. And some of it is public record because if you're a felon, apparently you don't have to do that. But the cool thing is there are some private data that's not supposed to leak. So there's a couple of different assets that are connected to each other that we're going to understand. The first one is the app prison system.fake, we're just going to call it that for security purposes and reasons. They gave me access to this, it was limited functionality, there were some JavaScript files that indicated there was some functionality that does not have access to it. So if you're a felon, you can do that. Shift Z, it will take you to this page, shift F to this page and so on, you get it. So there's also a limited session for now at least that we have access to. So it's very limited on what we can do on this page. And anything that I like to access that's leaked into the JavaScript file, this may redirect it to the main site that I'm on. So we don't have access to it, I couldn't access anything and I was just staring at a blank page for this application. So this is kind of what the shortcut looks like. So I hit ctrl U for example, it takes me to the admin site, with the users, I hit ctrl A, it's the activity on the users, ctrl S and then there's ctrl D and N which is a doc site. So this is a different site, somehow this session was supposed to carry over but obviously I probably wouldn't be able to access it and every time you go to these sites right here, it will take me back to the main site from the last night called apt whatever.com. Well, the JavaScript leaked this thing that said if you hit this site, it will authenticate you to the doc site, so all you have to do is directly go to this API call and it would redirect you to the doc's website and then it would give you an authentication token in your request. So to print it out, it's not heading anywhere and I was like, oh, okay, like how am I able to authenticate to this doc site but originally I didn't have access to it so the user token makes sense. So what do you do? You just grab that user token and you start throwing things and see if it sticks. So naturally I try to do admin, give it the auth token, nothing works, I try doing a slash admin, maybe I have to have the right path, doesn't work but turns out if you have the right path and the right functionality and then you give it this auth token, it suddenly opens it up so I can see these settings but still what can I do with this information, I want more, I want to know what I have access to. Well, it turns out that I have access to a lot. So I'm doing this thing called reset password and this is a short version of it, it's fake but more of the story was it took a user ID and a password and it would give you the new password that you set up so I can say user ID equals one, password is password one. Cool, we can do that but the problem was it comes back and it says success. I don't have two things here, I don't have a password and I couldn't do anything with it so I go to Twitter, I like crowd sourcing things, I worked at a crowd sourcing platform for a while so I just posted this tweet, I was like hey, I can reset passwords, I just don't have any information, how do I log in and I got a bunch of answers, none of them worked. Well turns out the answer was in the JavaScript file for me. There is another thing that I have to do right, so all I have to do now is I say okay, I have a password, I have the user ID, I want admin, I want user ID one, the password is password and I ask for it so the chain one, the first chain that I got from this vulnerability was I log in, I change the password for admin or whatever user I want and I impersonate that user, I have a read-only account, I can't change anything in my account and then you can just go back and re-log in and get into that website. They give you everything you need, it's a very weird one, but I'm a CDSS fan and this kind of looked lame because you see how it says privilege is still high, that means you have to have an account to log in and be able to do this so the prison system gave us an account, the foothold that we got in was given to us by the CDSS and turned that high on the third one on the left, whoops, too fast, there we go, we want to turn that third one that says high into a low because the score goes from a 9 to a 10 and we're almost there, we're like 0.9 away from it, well, there is something really funny, since I can see everything, I can see what the admin see, I can see what the functionalities are, I can test for things that I could use as a visitor, so you can do an XSS in the name, you can do an XSS in the address, you can do XSS in the account details, but you can put special characters in the email field because I don't think anyone's going to put special characters because Gmail doesn't allow that, but I don't have to have a real email address to be able to inject a payload into this page, so you put a XSS payload which is a script tag pointing to my website at gmail.com, you sign up and whenever the admins go to look at the list of users on slash users, they don't have to go to my username by the way, the email shows in slash users, so whenever the slash user is opened up, the XSS is fired, so the chain that we have, the second chain is we bind XSS to the user, we log in or force them to the user and we take over their prison and we just let everybody out and put money on their books, and that becomes from a 9.1 to a 10.0 base on just looking at the chain, so more of the story is there's always a way out even if you're stuck in a prison and technically we found it for this one, I'm going to have Corbin to the next one. So this one's about hacking a crypto exchange, I've been called from hacking proof, it said it's the biggest bug bounty reward amount of crypto exchanges, you can get anywhere from $50,000 to $1 million for a critical bug and I'm like, sick, let's do it. And so I signed up to this crypto exchange called KuCoin and just started proxying my browser, traffic through Burp Suite and I just clicked every single button and every single button and then I just started going through my burp history and I came across this Git request, it's just Git, forward slash, API, Zendesk, I'm not going to read actually all that, it's way too much to read, being kind of see how that looks and it responded with just some adjacent blob about their help center and in that was like a URL to kukoin.zendesk.com, I thought that was a little bit more interesting because API v2 instead of the API Zendesk. So I was like, is this endpoint just proxying to the Zendesk API? What if we just hit other paths besides that help center endpoint? So I just hit the API v2 and it just responded with just like a big HTML 404 page and I was like, okay, this is kind of curious and interesting. So I filled the Zendesk API documentation and found the following text, you must be a verified user to make API requests, you can authorize against the API using either basic authentication with your email address and password, with your email address, an API token or an OAuth access token. So now I'm thinking, if you have to be a verified user to make API requests, can we just use this API as an endpoint? So I found in the documentation there's an endpoint just API v2 tickets.json and it just loads all the support tickets. So I tried it and it actually worked. And so, yeah, you can see there was request for some sort of criminal investigation that was one of the earliest tickets and even more fun there's a search.json endpoint which allows you to search for a query language. So what if we tried searching for session tokens or something? So I looked up the query language and you could specify the created date. You could search tickets by the created date. And I also searched for just the word session. And it turns out if you use the mobile app it actually leaks their session token and I don't know why that happens but it does. So I looked up the query language. So I looked up the query language. And then you can also just dump all of the users with the users.json endpoint. So that discloses the person's name, email, their phone number, their location. And this API is even better because you can paginate so I can just hit every single page and I can just go back to the query language. And so I reported it to them and they're like oh yeah okay this is like a high. Okay that's fair. And then they just gave me $5,000 and said go away. So that's the end of that story. I'll hand it back to Ben. This is where the fun begins. So everything we talked about is different in a different industry. There was the news media and there was the cryptocurrency stuff. But now we're going to do a back-to-back casino because we're in Vegas and we're at a bunch of casinos and for once we were able to beat the casinos at their own game. So this one, yeah we got some money from the casinos. So this is one of the bigger European one. We have a US version of it. He's going to do the US version. I'll do it for the European folks. They could do things with their lottery site. I don't know what the purpose of it was being in California. Apparently you can't have access to this site. But I could at least see some of the functionality. So you have this login page that comes back to you. And the login page says hey this is how my login works.  You say username and password and it's auth login. And there is also a forgot password link in the description. There is no registration. At least that we can see. There is nothing else. This is an admin panel. It's not just a lottery system. It's a backend of the lottery system. I'm assuming some sort of a online thing. So the thing to highlight here, I wish I could point to it, but this right here it shows an auth login within API v1. So the problem is that there was nothing that I could find that was useful or usable to get access to this site. Well, you start to do a brute force for API v1. I did API v1 auth login. We have that one. We have forgot password. There is one that hits for a 405. That's new. So it's just slash new. And then there was users, which is 401 because I don't have access to see the users. So there is the ID of one, two, three, 401, user me, 401. And then there is also a verify for users. But the interesting one out of them all is the new, auth slash new, which piqued my interest. Well, it turns out auth.new is also very verbose, just like he was mentioning. It told me, hey, you're missing an email password and a password verification. So all you have to do was hit that API and you can create an account. You can log in, but the trick was this is an internal panel, so somebody had to actually confirm this account for me. There's a way to confirm it. We're not sure how. I didn't get an email, so even though I gave it an email address, I didn't get anything that says, hey, come and confirm your account because this is supposed to be internal, so I'm assuming if I didn't have an ad domain or whatever that domain was, I wouldn't get any emails from them. So we do know two things. There is a verify and there's a user slash me that I have access to. Those two that I'm showing on the screen are from the previous scan that I did, but I remember to have access to those two things. So if I'm authenticated to my non-confirmed account and I hit this slash me, it's going to give me my user accounts details, but it is going to also give me a verification code. So it says, here's your user ID. I'm going to give it a user ID and I'm going to give it a user ID anyway, which doesn't make sense a lot at the time, but then I realize that I have verified that I can use to activate my account. So I've also stashed verify that I have to go through. So the way the verification thing worked was you give it a user ID, you give it your verification ID, it verifies that it is a user ID. So if you're in a corporate environment or whatever you work for, usually they create email addresses like this, and there's one more thing to say, the login page asks for a user name and not an email address. So I don't know what user name is, but the company usually gives you your first name .lastname at domain.com. It's pretty standard. So when you send this verification email, it takes the email address, not the user name it says what's your email address, what's your verification ID, you send it back and it says success. So when we go back to the user ID convention, it's asking me for a user name. I have my email, verification took my email address with my verification code, but I still don't have a user name. Nothing was emailed to me. Well I thought let's go back to the stream before the add sign. It's probably the user name. So we're going to go ahead and try that really quickly. So as I mentioned all this, we're going to take that and we're going to log in and it actually logged in. So I give it my user name, it becomes whatever it is before the add string, it's automatically your user name, the password is what I gave it, my account's activated, and when I get into this account where it's verified, it gives me access to other users, the forgot password I don't care about, auth new we don't care about, then there's a user you can do like one, two, three, there's user slash me and user slash verify. But it turns out the user's one is the best one because it gives you a list of all the users and all their details and it's only in read only. So my account isn't an admin fully, it's just a read only, probably something like I don't know, operations person and just need to have access to read all the functionality access, but what I do have is a list of all the user names in their email addresses. So what we do is we just grab the list of users, so whatever the user names are, I'll grab them because I need that for the login. I took a good password list and when I say a password list I mostly mean password one, password one, two, three and password two and then the company's name in the year and it turned out I can actually get an access to one of those accounts with password one. So one of the actual admin accounts that I dumped a user name from the read only account had a password of password one and it actually gave me access to it which turned out to give me access to this entire casino's back end for the lottery system and you had not file upload, you had other users, there was a lot of details but being a bug bounty hunter you don't really get to have a lot of fun and see what happens. But more of the story is there's also passwords that work. I don't know, it's 2023, somehow password one and password one, two three still work. So if you have a good list of user names when you hack into a company and you can dump it through an API, it never hurts to try these easy passwords. So yeah, this is the original thing that I had. It's just a bunch of non-access things to finally getting the keys to the kingdom from one of the biggest ones that I'll let this guy handle. This is a story about fishing not a casino. So a little backstory on this one. This was for like a live bug bounty event and so they invited a bunch of bug bounty hunters and they thought it would be a good idea to put social engineering in scope. The only rule they had was don't email more than 100 to 200 people. That was the only rule and they said they'd pay like a thousand dollars per user fished. So I was like okay, well what if I get 200 people to fall for a fishing email? It's also like a really bad idea to invite a 23-year-old with no good filter on what I should and shouldn't do. Yeah. So a little recon on this company is they used Okta and Duo 2FA and it was not a casino.okta.com and when these users would login, they would enter their username and password and then they'd be prompted to enter a six-digit number from Duo to login. So I just bought a domain that looks similar to theirs. I set up Evil Engine X2 Go Fish and Mail Gun. I'm not going to get into all the infrastructure but basically with Evil Engine X, it basically allows you to basically reverse proxy to the real Okta instance but also in the middle and capture everything between the two. So that was kind of a pain to set up but I googled enough, read documentation and set up all the infrastructure for it and the next challenge was to figure out who should I actually try to fish here. So God bless LinkedIn Sales Navigator. I just signed up. We had like $100 for like a subscription for a month and I was able to figure out their email format was like the first character with their first name, last name at thecomby.com so I wrote like a really simple Chrome extension that let me just scroll through LinkedIn Sales Navigator and just grab their first name, last name and just generate this. And so okay I have emails but what should I say in this fishing email or in hindsight now it's like this never do this. And so like I've actually never done a fishing campaign against a real company in like environment and this is exactly why you probably shouldn't invite a 23 year old bug bounty hunter to do this. But I just was thinking like okay what would I fall for and what would I click on and so again it was really rough and I'm a complete douche bag for doing this and so I typed a few different variations and I'm like okay we're gonna have like a reference number and like brackets and like just to keep it like short and say like action required because like okay you have to fill this out. And so I mean you guys can read the questionnaire actually pointed to a sub domain of theirs if you like covered the link it would be like casino.com and I abused a cross-site scripting bug to actually redirect to my fishing page so it looked I guess even a little more. So yeah I sent this to like 200 employees within like not even a minute the cookies just started rolling in and so then now I can just authenticate to Okta and within two minutes I had access to their root AWS account so that includes like all their EC2 instances all their databases literally everything you could possibly dream of so here's a picture of me just sending the email here's 30 seconds after so the result is ended to 200 people and I ended up with 40 pairs of credentials I had access to Outlook Word Calendar I fished of like one of the vice presidents actually I had access to AWS console the GitHub their like customer search tool a buttload of internal applications and then they never did this again because apparently like the Nevada gaming commission like requires these casinos to report each instance and finds them and so I think I cost them like several million dollars in like legal legal fines but hey I guess they learned their lesson and I don't mind they didn't pay a thousand dollars per user but they paid me a twenty thousand dollars for that so that was a fun bug not bug but yeah you can yeah I mean we don't have usually supposed to end your talk with solutions we don't have any solutions for phishing verbose APIs yeah he says get good is a good answer good solution for it yeah but I mean if you want to try these out they're all on the on our website you can give it a try if you want to come and talk to us actually we think we do have a little bit of time we ended a little bit early for questions if there are any questions we can answer them otherwise please connect with us we're both on Twitter I'm at Nahamsek he's at Hacker thank you and then yeah if there's any questions I'm glad we were able to answer all of you guys's questions thank you for attending our talk


A computer program ultimately is made up of machine code, binary instructions which are read and executed by the CPU. In the earliest days of computers, back in the 1940s, these machine instructions were input by flipping switches and moving vacuum tube plugs around. This of course was extremely clumsy because it required a lot of work by hand every time you wanted to run a program. So to fix this, computers began to store code on punch cards. A punch card is just a thick piece of paper with perforated holes and patterns to denote data, and programs can be stored as stacks of punch cards to feed into the machine. The process of creating these punch cards was still extremely tedious, and it was a huge headache when the stack got out of order, but at least now a program could be loaded multiple times without manually inputting each instruction one by one. In the 1960s, computers began to use terminals, devices which combined an electronic keyboard with some kind of text display. The earlier terminals printed out text on paper, later terminals introduced electronic screens, though usually these screens could only display monochromatic text, not graphical images. Also in the 60s, computers began to store code and data on electronic mediums, most commonly magnetic tape. In combination with electronic screen terminals, computer users for the first time could read and write text directly on the machine. So the question is, how does text entry help us write machine code? Well, one answer is to use a hex editor, a program which allows us to create and edit a file byte by byte using hex notation. While feasible, this approach is very impractical, even if you are extremely familiar with the machine code of the processor for which you're writing, it's just very taxing and cumbersome to write code directly in binary form. The better solution is to use what's called an assembly language. In an assembly language, each binary instruction is expressed in a more human-riddle way, usually as short mnemonics. For example, an ad instruction is commonly denoted with the mnemonic ADD. Of course, the machine can't execute text data, so this text has to be translated somehow into binary instructions. We call this translation process assembly, hence the term assembly language. Here's the Hello World program written in an assembly language. A Hello World program recalls simply prints the words Hello World on the screen. Understand that assembly code is always processor-specific because the binary instructions for one processor differ from the binary instructions for another. In fact, there really is no such thing as the assembly language, there are different assembly languages for different processors. Collectively though, they're often called assembly language. So there is assembly for x86 processor, assembly for ARM processors, for MISP processors, and so forth. This particular example is x86 code. Also understand that system calls are operating system-specific, so assembly code written to run on one operating system generally won't run on another. This code here is written to run on Linux, so even though it's x86 code, it won't run on Microsoft Windows. Like in all programming languages, the assembly code written as text by the programmer is known as source code. The computer of course can directly execute this code, rather the source code must be translated to machine code by a program called an assembler. For any particular processor, there may be multiple assemblers available, and the precise assembly language understood by one assembler may differ from the assembly understood by another assembler for that same processor. For example, one popular x86 assembler is Microsoft's assembler, often called MASM. Code written for the Microsoft assembler won't be understood by other x86 assemblers. So assembly code is not only processor and OS-specific, it's also assembler-specific. In any case, let's say our source code is written in a file called hello.asm. When we run this file through the assembler, what we get out is not an executable file, but rather what's called an object file. To produce an actual executable file, we run the object file through another program called a linker. The reason for this extra step is that in practice, we usually write the code of a program in multiple source files, files which we may wish to assemble independently. For example, if I've written my code in two files foo.asm and bar.asm, and I want to produce one single executable file here called baz, I first run each source file through the assembler independently, producing an object file for each, and then those two object files are run together through the linker, producing the executable. A linker is so named because it must resolve the links in code between the object files. Though we may write our code in separate source files, the code of our program is interdependent, such that code in one source file may invoke code written in another. For example, in foo, we might invoke a function defined in bar, but because the source files are assembled independently, the assembler can't know the actual address of the function in bar when assembling foo. What the assembler does then is leave a stub address where the function is invoked. Later the linker will fill in these stubs with actual addresses. Now we could just combine the linking and the assembly phases together in one single program so that we don't have to run two separate programs. However, we'd like to keep the processes separate so that we can minimize work when we make code changes by assembling only the source files we've changed, then linking those new object files with the other object files. By default, when a process runs, code in its address space comes just from the single executable file which launched the program. However, modern operating systems like Windows and Linux allow programs to link in code from other files during execution. These files of code are called dynamic linking libraries on Windows denoted with the file extension.dll and shared object files on Linux denoted with the file extension.so. More generally, they are sometimes called shared libraries. To make use of shared libraries requires instructing the linker to leave some stubs in the executable for the operating system to dynamically link at runtime. To create a shared library file, we simply run the object files we want to include in that library through a linker with the appropriate options. So you may be wondering, why would we want to use shared libraries and dynamic linking? Why not just statically link everything into one executable file? Well, one reason is to avoid producing needlessly large executable files. The concern these days, though, is not that the executable files will waste storage space – storage space today is very, very cheap – the real concern is memory usage. When multiple programs running simultaneously all make use of the same common code, it saves memory to load only one copy of that shared code. And this is exactly what modern operating systems allow us to do with shared libraries. When multiple processes all use the same shared library, the libraries included in each processes address space in their virtual memory, but the actual code is stored just once in physical memory.