make sure we're live. Hi everyone, this is Gicho. Welcome to my channel and welcome to another live stream. Today is November 5th and we're doing another comic book haul video. This is number two. We did one yesterday and we're doing one today. That thing, the time is fantastic. We're uploading maths. We did a math stream uploaded or we did a math stream previously. We upload a math stream and then a comic book stream. We do another comic book haul video and then we're going to upload a math stream. I think very appropriate. That way people can get a little break from some of the events that are taking place around the world. We keep our eyes on the prize. So we decided to teach Jason a rhythm. Thank God. A welcome distraction afternoon guys. Fun. Yeah, teaching Jason. I sort of intentionally planned on. We did a lot of heavy stuff leading up to the elections and we talked about this. We knew that this was going to not work out the day of or the day after. It was going to take a few days or a few weeks, maybe a few months for things to play out the way they're going to play out and then it's going to be a lot more stuff coming on. So we sort of roll with our own rhythm. That's one thing I've figured out to not allow centralized power, corporate propagandists to dictate my rhythm. So create our own rhythm that way we can process information better. And what better way to do that than comic book haul, right? Gluten tag. Hello. How are you today? Spark. Sparklets. How are you doing? Sparklets. How are you doing? Welcome, welcome. It's playing out exactly how we expected. Yeah, it is. Indeed.  I'm glad we've talked about it and we figured out that's the way it was going to play out, right? And some other people have done as well. Sleeping wave, Chicho.  Your work ethic is out of this world, bro. Brother, I've sort of got myself into a rhythm where I do things that I love. Try to anyway. Everybody has to deal with stuff that you have to deal with. Life throws your way. So I try to share that as much as I can. And it's a pleasure. It is hard work. I can honestly tell you it is hard work doing this, setting up, taking down, doing this, organizing, doing this, doing this, sharing, linking, decentralizing. It's a lot of work. But man, for me, it needs to be done, right? So I just do. Sparks, I'm good. Just listening. And it's very relaxing. Awesome. Glad you're liking. On charter days. Hey, how were you doing? Hope you and chat are having a fantastic day. Pretty good. And we're about to look at some more comic books. I need to make more bookshelves. I need to create more space. I gotta do a whole house of house cleaning and organize and stuff. Gina, how are you doing on charter days? Thank you for this Twitch Prime sub. I appreciate it very much. Hey, Chicho and chat. Gina, Gina, welcome, welcome. Twitch and Jason, yeah, I agree. It's kind of a masochistic, masochistic form of entertainment, or masochistic form of entertainment following these current events, like watching a horror film, knowing the threat is ultimately minimal. Indeed. But there was positives that occurred, right? And we can talk about those later. Masochists that love it, love it, love it. What comics have we got today? Ooh, the comics. We got golden age comics and modern age comics. Okay, there's only four different titles and one of them, there's three copies of it. Okay. Get along London. Hey, Chicho, Randall, how are you doing? Welcome, welcome. So it should be fun. I'm just going to give people my little intro. Gang, I'm on Patreon, if you want to follow this work, patreon.com, or slash Chicho, C-H-Y-C-H-O. Everything's later on, mathematics. I don't put anything behind paywall. Everything's quite of commons, share and share alike. Okay, for those of you who've been supporting this work through Patreon, thank you very much for your support. We're going to start kicking things up. I know I'm going pretty hard as it is, but I need to get into doing some writing and laying down some of the text we need for the math modules that we're going to start sharing, right? So I'm hoping to get into it by Christmas time. So thank you for the patience gang. Thank you for the support and thank you for being here. Okay, we are live streaming on Twitch, twitch.tv, forward slash Chicho live, C-H-Y-C-H-O-L-I-V-E. If you want to participate in that chat, Twitch is where you want to be at. For those of you who've been supporting this work, on Twitch, following, sharing, commenting, liking, coming on these live streams, participating in discussion, and the months, thank you for taking care of business. Thank you for the support gang.  You can follow the work there. All the links will be in the description of this video. And we do have a Discord page where people are sharing a fair bit of information regarding a few different topics. We've got a few different channels, a few different folders. So you are definitely welcome to join in the discussion there. Okay, yes, another time. Comics time now. Comics time now, Twitch and Jason. Starsky, quote, remember, remember the 5th of November. Gunpowder, treason, and plots. Some English guy. Some English guy. Some English guy. Very relevant. Starsky, welcome, welcome. Elder God watching London. I'm watching London. Thanks to Elder God keeping me updated and selling my feeds coming in. Step, thank you very much for the follow. I didn't get a notification on Twitch, by the way. You haven't gotten notification yet. Okay, let me see how many people are here. Yeah, I don't think notifications have gone out. So Twitch has been sort of a little slow on the notification front from or not even sending it. So we'll see where it goes. Thank you very much. Small was it for the follow. Appreciate it. For live streams where we don't have any visuals, we will be uploading the audio to soundcloud.com forward slash chico, C-H-Y-C-H-O as podcast, and they should be available in your favorite podcasting platform, including Spotify and iTunes. Okay, and at some point I'll, in our retirement age, maybe if we live long enough, another 20 years, 20, 30 years from now, we'll start pulling the audio from all these live streams that we're doing and upload those sound as audio on as podcast on Soundcloud as well, right? Well, we think long term. And we will be uploading this video to both BitShoot and YouTube. For those of you who've been following, subscribing, sharing, liking, commenting, uploading on BitShoot and YouTube, thank you for the support. I'll absolutely, I missed the name. Thank you for the follow. For those of you who've been supporting this work on those platforms, thank you very much for the support. And if you're on YouTube, you can support this work by joining YouTube membership. There's a button there. And for those of you who've been supporting this work through YouTube membership, thank you very much for the support. Gang comic book time.  Compared to yesterday's. Okay. Yay, more comic spider-man. Awesome, awesome. Fat boy, fat, 257. Hello, hello. Welcome to our live stream. So both notifications have gone out. Okay, awesome. And I can see the numbers popping up on Twitch a little bit now. Awesome. You won F920.  That's what I usually, I just try to set up and you know, just as soon as I know I can go on, I just go boom. I don't want to keep people waiting, right? I don't like the live streams when they announce the live streams. You're going to wait two hours for a live stream. No, 30 minutes is good for scheduled ones. I let my schedule go. I, you know, I set up the schedule countdown on Twitch. Yeah. And in a few minutes means a few minutes for me anyway. What up, Chicho? Unless something went wrong. And sometimes it does. It doesn't connect. Something goes wacko, right? Hoop. Hoopoo bird. Hoopoo bird. How are you doing? Hoopoo bird. Hoopoo bird. What up, Chicho?  But I'm doing good, man. It's, look, it's something that we, you know, we knew was coming. We're prepared. Like anybody, you know, you can only be surprised for a certain amount of time. I'm going to take these guys down. Boom, boom, boom, boom, boom. Hope everyone's doing well. Koda, how are you doing? Hi from New York City. Hoopoo, New York. Chicho, thanks for reigniting my interest in comics. Recently been working through the saga series. Also, I still haven't read it yet. I still haven't read it yet. I gotta read it. I gotta get my hands on the trades and have a read through it. I'm loving, there's amazing comics being put out. Really. Like, brilliant. If you're a fan of any genre, really, within reason, right? There aren't too many romance comics out there. There aren't too many political comics out there. There's science, fiction, and fantasies through the roof when it comes to what's being put out in the comic book medium right now relative to what was being put out in the past. Really, the science, fiction, horror, fantasy realm has just kicked into overdrive. It's insane and there's so many amazing stories being told. It's really hard to decide which one you want to read. It takes like commitment and then you want to sort of sample here, sample there. I'm in the sampling phase myself. I'm reading a little of this, a little of this, a little of this, a little of this, and just enjoying it. At some point, I'll read the whole series or catch up on a series that I've read a couple of issues of and whatnot, but right now it's chaotic for me personally. I've heard saga is amazing. I read a couple issues of saga and I really liked it. I read issue number one when the true believers, or not true believers, when image first came out, when they were putting out the $1 reprints. Washington 078. Thank you very much for the follow. Appreciate it. Gang, should we get into the comic book haul? Should we get into the comic book haul? It's a little one. It's a good one. It's a little one. It's a good one. And I got this yesterday. Okay, so we did our comic book haul yesterday. Fantastic comics. And we bought from this seller before. And let me tell you what's, not what's in here. I'll show you what's in here, but let me tell you the cost of this. Right? This comic book haul, I go view order details. This thing cost $162 Canadian. There was $8 tax and it cost $1750 for shipping. Total for this was $188, let's say. And that's about $150, a little bit less, $140 US. So this thing is about $140 US, $188 Canadian. And as I said, there's four there's four different titles in here. Okay. And there's three copies of one of them. Because it was a good deal to get it. And I wanted to have, it's a first appearance. And I liked the character. And again, it was a great deal. It was a good deal. The other ones were a great deal. Okay. The US and Washington, see if that's what you're asking. That's correct, this open gang. And I'll tell you what each one cost and what each one is when we pull them out. Okay. Aside from that, I hope you guys are doing well. Staying safe, staying sane. So $109 pounds UK. Okay. Let's take a look. Let's take a look. Nicely packaged. And like I said, we've bought from this guy before. And we've bought, safe is okay, but I've always been crazy. Elder God. We've bought from the seller before. We've bought CGC graded books, as well as raw books, not graded books, right? The CGC books are just CGC books. They're, you know, they were exactly what the guy had described. The raw books, his grading is higher than I would grade them, right? So I bid on these books, not based on what the grade he was giving, but the grade I thought they would be, based on the pictures and based on the experience I've had with the seller just once, by the way, we just bought one package from this guy in the past. And we've done the comic book haul video for it, right? So keep that in mind. That's when I read the description to you guys. And we'll take a look at them, right? Just to see what the grade is. Since there's only, you know, a handful of books here, like literally a handful is like six books or something. Nicely packaged, right? And he's got them in a bag, so they're tight so you can just take them out of the bag, which is a great way to do so. It's just, there's something nice about getting a shipment of comics that are nicely packaged, not just removing the tapes. Don't want these snagging anything, right? Because we're going to pull these things out of the bags and boards. Oh, nice copies. I thought they were actually going to be a little bit worse than this. Let me show you what we've got. Let me show you what we've got. Wow. It's warm again. I know we're intact. I like wearing tight tops. In the winter, I like wearing my two. My two keeps the head warm and I just stay warm. You wear wool socks and you're pretty much set, right? Take a look at this. I'll show you. I'll go with this one first. Let's go with this one first. Okay. This comic is, let me tell you how much I ended up paying for it first. This comic, I ended up buying it for $53 Canadian. Okay. And he graded it at 5.5. And in US, let me see if this will convert it to US automatically. Go from .ca to .com. Oh, it does. It's like $41 US. Okay. And it's from 1955. So first year of the comic code kicking in. Uncanny Tales number 30. Okay. And it's from Atlas Comics. Beautiful. I wanted this, right? I wanted this. So 30 pounds UK. And Atlas Comics is the company that was pre-marvel, right? Marvel. Atlas turned into Marvel, right? Nice. And he graded at 5.5. And just looking at the cover, it is a 5.5. It's pretty good. So maybe he didn't overgrade this, right? Atlas, right? There's an Atlas logo. And he's got this in Mylar, which I very much appreciate, right? We're very much appreciate. So let's take it out of the bag. And let me tell you who the creators on this are. It's a really good price gang. Okay. This was a great price. I'm happy with it, right? And this thing is the cover. The cover is who is the cover? The cover, I think. I don't know if it's Dick Ayres or not. It doesn't have the cover. Who the cover is for this? But this is Dick Ayres artwork. Bill, Bunalis, John Fort, Ed, Wunarowsky. I'm brutalizing the names here. There's a whole bunch of people that work in this. Okay. A whole bunch of people that work in this. And there's only nine of them graded on CGC. Okay. CGC only has nine of these graded. How old is this? This is 1955. 1955. Yeah. You know what? It looks better than 5.5 here as well. Nineties. No. 1955. 1955. A chess. And we have a chess. I really wanted this because I love chess, right? I don't play it as much anymore. I played a lot when I was a kid, right? And we put out a chess video where we talked about the knight's move, what's it called again? So, and the description. Let me read the description of what this guy said in this description. He is like overselling it, right? But here's what he wrote, right? The book is graded at 5.5. This book has the general wear and tear associated with the age and grade of the, with the cover attached to the inside and the centerfold is firm. Book is really nice and clean with great paper quality. The reason for the 5.5 grade is you can see a bit of chew on the top edge and a small piece missing from the bottom corner on the back. Such an interesting cover almost along the lines of something like toilet. Anyway, it continues on like that, right? So there is, is this chewing, I called us, let's check it out. Here's what it's saying. Now, I don't know if this is chewing or this is, I think this is chipping. I think he must have, because I looked at this in the images, right? So take a look and I'm double watching as well. Justice League number one has an awesome chest, awesome chest cover. Take a look at this. That's the chipping, right? I don't know if it's gonna, hopefully it'll focus. My computer is getting in the way. Come on. Okay, let me see if I can do this. Take a look. So that's the chipping. Now is that chewing? And that's only on the cover, right? And it doesn't go to the interior pages. Oh, this is a beautiful piece. And here's the spine. It's a good grade. 5.5 legit grade. It's a legit grade. Great. Would it be a six? Some people might grade as a six. I would say between five and six is legit. So 5.5 is a good grade, right? Yeah, beautiful cover, right? Beautiful cover. I really like it. Really like it. Look at the eyes on this. This sort of reminds me of, what's that black and white movie that death, the guy starts playing chess with death? Elder God, you should know. What's it called? It's black and white. It's really old. It's a classic movie. It's a beautiful movie. Laugh out a little, Tony. Thank you very much for the tier one sub. And here's the back cover. And the back cover looks great as well. And this is the little trunk that he's talking about that's missing. Ingram bearing. Yeah, the seventh seal. Oh, a rental. Yeah, thank you for that. The seventh seal gang. If you haven't watched the seventh seal, it's a beautiful black and white movie. Phenomenal movie. Very deep, very deep. Look at this. Beautiful. I believe this is Dick Eyre's artwork. The inside is phenomenal. Look at that. Very nice. Oh, we might have to read this one. We might have to read this one. The world was black and white when Elder God was in his prime. Oh, this looks great. The inside pages are fantastic. Like they're brown. They're not white. But beautiful. Nice. Great buy. Okay, so let's throw this back and look at the other ones. Let's put this back nicely. Beautiful. Look at this thing. I'm very happy to have this really. Very nice. Very nice. Hello from Northern BC. Hello, hello, Northern BC. Hello from Southern BC. Now, I'm going to show you another one from 1956 and then we're going to kick it down to the Golden Age. She said, do you know why Nevada isn't releasing the results? Probably because they're taken in bets. They have a lot of bets. They're hooked up with the casinos. So they want to make sure they maximize the money they're taking in. Nevada is the gambling state in the United States, gambling place in the world, really. So that is what it is. There's a lot of shenanigans going on. There's a lot of shenanigans going on. But comic books, comic books. Okay, I'm going to show you this one. This is headline comics number 74. Headline comics from 1974. Let me hold it up for you and I'll read you. Let me make sure I got this framed so you can see the cover. Here, I'll hold this up and then I'm going to read you who the artists are on this. And this is from 1956. And then I'll show it to you close up and we'll crack it open. And the contents for this is Marvin Stein did the cover for this. Nick Cardi, Marvin Stein artwork. So Nick Cardi pencils for first story. And then Marvin Stein inks. And then John Prentice pencils for the second story, Bill Drut pencils for the third story. And then Mort Meskin pencils and inks for the last story. Okay. And this was from prize publications. Very good. It's like nice comic. And it looks like to be great condition. Oh yeah, by the way, I paid. Once you see the next book in this, this was a two comic book lot. It was this one. And I'll show you the next one. It was $66 Canadian. I paid for this $50 US. Okay. For two comic books, this and the next one. And the next one is worth three times what I paid both of these. Okay. So it was a great deal. But let me show you this one. We'll crack this one out of the cover so you can take a look at it. Right. Laugh out Tony. Laugh out Tony. Or Tony. I'm just guessing. I'm just playing. We don't know. We don't know anything. That's the kicker, right? Oh yeah. And he graded this one at, let me see what the grade he gave on this one. He graded this one at a five. And he graded the other one or four. I'm going to read the description. All of these books have the general wear and tear associated with their grade. The other issue has such an awesome cover. How often do you see it? Two tough books, books that make you long for the olden days. Anyway, he starts going into the whole spiel where he's trying to sell the comics, right? So let's crack this open. And he's got this in Mylar as well, right? So I like the seller. I don't like it that he's charging tax. It's a YouTube thing, but it is his decision as well. But let's check it out. Let's check it out. Newspaper thrills. Headline, headline comics. January, February 1956. Take a look. And you know it's silver age because it's got the comic code on there, right? Is this a five? I would give this higher. Really. Just from looking at this right now. Five. Okay, five. I agree with the five. That one doesn't look as interesting as the last one. It still looks dope though. Color is really vibrant. Yeah, the color is really vibrant. And here's the spine on it. The other comic that I bought in the set is headline comics as well. And that one. Oh my, oh my. I'll show you who that one is. So this is a pretty good grade, right? Happy to have this. We need to do a comic book reading. We aren't trying to taste. We need to do a comic book reading. Here's the back cover. Headline comics. What was in the headlines in 1956? Brainwash at Hong Kong. Wow, wow, wow. Look at this. Brainwash at Hong Kong. By the way, gang, thank you for the follows. Thank you for the subs. Look at that. Relevant today. Surprisingly, no. Nice cover. And what are the tops here say? In this issue, Ace Lantern, crack reporter of the world. Wide news syndicate tells his exclusive story of brainwash at Hong Kong. Nice. The inside is nice. You know what? This is probably more than a five. Flash camera and photographer. Nice, nice copy. Oh my, you lived in Hong Kong. Let's check this out. Great. That's, I'm very happy with the grade on this. Let's look at the grade on the next one. Let's look at the next one. So let's close this off. Let's put this over here. This one, this one. Headline comics. Number 27. Number 27. Take a look. I'm going to show you this and then we'll take it out of the cover. Let me tell you who the cover artist is for this is Jack Kirby and Joe Simon. Let me make sure that I got that correct. I think they both worked on the cover. The cover, yeah, Jack Kirby pencils, Joe Simon inks, color by Jack Kirby. Okay. The first story is script is Joe Simon and Jack Kirby pencils. Jack Kirby inks Joe Simon. The second story is a Western. It doesn't have who did it. The third story is Bill Druth inks and pencils. Okay. The fourth story is Bill Druth as well. The last story again is script Joe Simon and Jack Kirby pencils. Jack Kirby and inks most likely Joe Simon. And this thing came out in 1947. 1947. And there's only one of these things that I could see C.G.C. graded. Okay. Wow. Wow. Wow. Wow. Wow. Wow. It's a goodbye. This with the other one was $50 US, right? And this he graded at four. Just looking at this without taking it out of the Mylar, I would grade this more than a four. Okay. Laugh a lot, Tony. You're welcome, man. I've been following you on Twitch and YouTube for a while. About time to start support. Thank you very much for the support, Tony. Appreciate it. Appreciate it. Like really, we got two comic books here that I want to read, like the chess one and this one. I want to read them. We'll try to make sure we have a read through them. Okay. And let's crack this open. He graded this as a four. Now I was going into bidding on these, assuming that they're going to be a little bit lower than what is grading just from the previous experience. So far, I'm very happy with the grades he gave those ones. I would might even give it a little higher. So I'm even happier than what I was wanting. And I'm winning them. So let's check this out. He gave this a four. He gave this a four. Maybe a 4.5. Let me show it to you. Sorry, gang. Four? Four I'm okay with. Jack Kirby, Joe Simon, the FBI in thrilling action, headline comics. Stand back, you. Let's see if we can focus on this and I can read it off the screen. Stand back, you. What does that say? Saw bones. I'm operating on this copper. Only he won't be alive after I give him the treatment. Awesome. Awesome. Awesome. Beautiful. And he's a copper. Look at that. He's got his hat there. Right. Here's the back cover. Muscle man. Yeah, the coloring is fantastic for this. Beautiful. Beautiful coloring. Really stands out. Stand back, you saw bones. Nice, Gicho. It looks good. That's a great buy. Yeah, great buy. Great buy. There's a little chunk missing here at the bottom. Oh, look at this. The staples are nice and tight on this. Stella, Stella Maud Dickens, the Barbie socks banded queen. Look at that. Very nice. Fill them full of lead. Fill them full of lead. Oh, women gangster. Women gangster. The guns of Jesse James. Oh, snap. Look at this. The guns of Jesse James gang. Very nice. Very nice. Great buy. Great buy. Very happy to have this in the collection. This is going for, at grade four, the price we paid for this is insanely, insanely low. Like really. This was a crazy, great deal. Crazy, great deal. Crazy. And it looks amazing in the miler. It's cut on top a little bit. So some people call this, what do you call it? Misplacing. I forget what it's called. To me, it's the cut. Am I keeping it or flipping? I'm keeping this. I'm not. The comic books that I've sold on eBay, the ones we did last year and any additional ones that I do plan on selling a little bit, I've been meaning to sell a little bit just to raise funds so I can get the money coming in so I can do a serious upgrade to the hardware. But I held off because the US mail service was just insane. I talked to one seller and he said he had to refund everybody he sent books to a few months ago because none of the books got delivered. They're all sitting in a warehouse. So he had to refund everybody. So I was like, okay, I can't afford that. I'm not going to list the books, sell them, and then have to refund everyone. So I'm waiting until this election chaos is over before I list stuff. But any books that I sell, I have additional copies of those books or additional copy of that book. I don't flip where I buy really great deals and then sell them again unless all of a sudden I need major funds coming in, which I haven't had to do.  I take my own advice in regards to personal finance to a degree. Sometimes I don't. So I've decentralized myself where I've reduced my expenses and barring any catastrophes. I don't need any major influx. I just manage things and I do things slow mo and do multiple things in a row, layer things, right? So at some point I'll get back into it, selling some stuff on eBay. But I see put these on my lower two. Very good. I like the seller. I like the seller. They're arresting all the cattle. Oh yeah, the mail service is blocked right now in this day. It's a good call. Yeah, bird. I promised someone, you know, actually more than one person contacted me saying, hey, Chicho, when are you going to put the mermaid comics off? I want to buy some mermaid comics and when you want to support you by buying comics from your eBay page and whatnot. I meant to do it a while ago, but then this guy told me the books weren't being delivered. I had to refund them. There was shenanigans going on. So I just said, okay, I got to put it on hold. Once this is all over, probably next month, I might start listing some stuff. Let me show you the next lot we bought. The next lot was three books. Okay, and then up costing $43 Canadian, which is $33 US. Okay. And these books are X-Men number 160, first full appearance of magic, Eliana Rasputin, first adult appearance of magic, and it predates magic number one. So this was her first adult appearance and then this story, I believe, kicked into magic number one. Okay. So what they told in this story, the continuation of this went into magic mini-series, which was magic number one, two, three, four, okay, where we see the birth of magic, really. And the graves he gave these books, he said one of them was a for sure 9.2, another one was a for sure 9.4, and another one he said has a little bang on the edge top corner in the back, and he gave it at 8.5, right? And I already have this cover. I did not cover. I already have this comic. I have a huge, pretty nice X-Men run. Okay. But I don't think I have any additional copies of this. And this is an important book, right? And the story for this, the cover is by Brent Anderson, the pencils and the inks by Bob Wack. The story is Chris Wassette, I guess Bob Wassette. The story is Chris Claremont's story, right? And pencils Brent Anderson and Bob Wassette and so on and so forth. But this is a Chris Claremont story, right? Should we crack this one open too? Let's crack one of them open. Let me see which one is the one that's, the top is banged up. Hard to tell. They're beautiful copies, by the way. Very good copies. I think it's this one. Let's crack this one open. We'll take a look inside. And he put these in Mylar as well. Fantastic, right? I talked with this guy, you know, asking him if, because he put stuff up once a week. And, you know, he allows people two weeks to buy books. So this wasn't all in one shot. It took me three weeks to buy these. I was bidding on some other books and I got over a bit. So, you know, I try to win my low bid offers, right? Limited on funds. Go for the low bids, right? Why not? Is this the one? I don't even know if this is the one. He took a seriously close picture on it. This is the one I can't tell. Let me show you the cover. And I love magic. Magic is fantastic. And it's Colossal's sister, right? And Chris Claremont X-Men, you know, it really doesn't get any better than Chris Claremont X-Men. Classic, classic, classic, classic. And this thing came out, what year did this come out? What year did this come out? What year did this come out? This thing came out in 1982. Okay. So this is 1982. So Copper Age. No, that's beautiful. And the comic sits well. I mean, whoa. I mean, I have to hold the cover open, right? Shoots and ladders.  And the demon for this story. I've read this a long time ago. Beautiful artwork. Look at this. Classic, classic, classic. Look at Wolverine and his cigar. Look at Wolverine and his cigar. Classic, classic, classic. And here is Storm. Where is Ileana? That's fine, Ileana. There's the demon he appears. Ooh, very nice. Look at this. And it's the first appearance of, and it's the first appearance of this demon, this guy right here, that guy. I believe it's the first appearance of this guy. And his name is, what's his name? Good day, boss. Sim, S, comma, whatever, exclamation, not exclamation, apostrophe YM. So it's his first appearance. Okay, the adult Ileana. Oh, look at this. Here's child Ileana, right? In here. Where is it? Over there. Oops, hey, over there, that one. Right? And then there's Storm. Oops, over this side. Storm is crazy sexy, right? Look at Wolverine. Okay, we can't look at this whole thing. Maybe at some point we'll eat this thing. Where is the adult Ileana? Let's take a look at the adult Ileana. Oh, look at this. Oh, there she is. Yeah, look at this. There she is right there. This one right there. All right, she's a kid in this panel. Where is it? Oh yeah, she's a kid down here in the bottom, right? In here. And then she's an adult here. Goodbye. And it is a goodbye for $33. So basically $11 each. And, you know, we've done a lot of per unit grade, right? So $11 US each is a very good price for this. For 9.2 average, let's call it average of 9.2. 9.2, 9.4 and 8.5, right? Which is great, which very happy with me. Goodbye, gang. That was a goodbye. Thank you for the follows, gang. Life like. Thank you for the follows. Thank you for the subs, obviously. Thank you for being here, right? I thought it was a good idea just to do some chill streams and upload the chill videos, the streams with it with mathematics to BitShoot and YouTube, right? So while people are going through a little bit of chaos, a little bit of anxiety starting on November 3rd yesterday, we load on math comic books, math comic books. That's the way I'm going to do it, right? So tomorrow, I'm going to upload the math one, most likely, on BitShoot and YouTube, and then hit it up with another disc comic book haul video the next day. And then we're going to get into uploading an entheogen stream on BitShoot. It's BitShoot exclusive. It won't go on YouTube. GrayStream, thanks so much for that. Thank you for being here. I'm glad you were here. You were looking forward to this. Entheogen stream on BitShoot. And then we're going to load the two Julian Assange streams we did on BitShoot and YouTube, okay? And I believe that takes us just to let you guys know. I believe once we load on the two Julian Assange streams, that takes us to 999 videos on YouTube, okay? 999 videos on YouTube. I believe with the two Julian Assange streams done. If we're going to hit 1000 with the two Julian Assange streams, I might do, because getting questions, request to do a politics stream soon. I think we're going to have to do one because a lot of people are asking me to do this, right? So we might do one on the weekend, a politics stream, just to let everyone vent and talk about whatever it is they need to talk about. But we're going to do a 1000 video anniversary to load it up on YouTube. And I think what we're going to do is just do a very long Q&A session live stream on Twitch, multi-hour. I'm just going to sit here and we're going to celebrate and we're going to talk about whatever we want to talk about. I think that's what we'll end up doing, okay? And then we'll upload that to BitShoot for, I don't know how many videos we've got on BitShoot now. And we'll upload that as our 1000th video anniversary on YouTube. Okay. If you guys have any other ideas, we could do. And one thing we can do is Q&A session. One thing we can do as well, I know a lot of people have racked up a lot of points on Twitch. So what we could do is I'll say we can talk about anything, but if you redeem points, 99.9% chance, I'll answer, we'll talk about whatever you want to talk about. Maybe Discord Collins. We haven't done that yet, Elder God. I'm not sure how to do that. Maybe redeem points for Discord Collins, I don't know. We've got to set up some kind of filter system on that, right? Because we don't want to get knocked off Twitch and YouTube and whatnot, right? Discord Collins, prepare for the troll. Yeah, that's the kicker, right? And since all the technocrats, the platforms are not really, they're too busy censoring creators, they're not taking care of troll actions and spam action, like YouTube is crazy. I'm deleting multiple posts of these female bots saying, I love, love, and it's weird. It's weird. It's controlled access. Gang, thank you for the follows. Thank you for the subs. Thank you for being here. And if you want to know what this is all about, I'm on Patreon. We're live streaming on Twitch. We announced these live streams on LOMinds, VK Parlor Gap, Twitter. We upload audio to SoundCloud when we don't have any visuals involved as podcasts, and they should be available on iTunes and BitShoot, just a new locked voice channel. We need to do something. We do, in the next thousand videos, we put out Elder God. And we will be uploading this video to both BitShoot and YouTube. Okay, Computer Blue 12 came in late. I hope I was doing well, Computer Blue. Thank you very much. We're just a handful of videos away, probably just one live stream away from our being able to load 1,000 videos on YouTube. So anniversary for us. Pretty good one, actually. 15 years of uploading, sharing content on YouTube. Not bad. Not bad. And it is, in large part, because of the support we're getting on Patreon, Twitch, YouTube, BitShoot, on all the different platforms. And thank you for the love, Gang. I hope you enjoy the content and expect these videos to be loaded on probably back to back one day apart on YouTube and BitShoot and expect a politics live stream on probably the weekend, just to get everyone, you know, whatever they want to talk about. And those of you watching on YouTube, that politics live stream will not be loaded on YouTube. If you want to follow the politics content that we're creating, you need to be either on Twitch during the live streams and watch a video on demand for a couple of weeks on Twitch that are available, or watch them when they're loaded on BitShoot.  And we don't want to get deep platform. Right. Gang, I hope you have a fantastic day and I'll see you guys soon. Bye, everyone. The Twitch Discord bot is the one to use, I think. Bye, everyone. And thank you for being here.


I love the colors in this one because it reminds me of a sunset or media sunrise. It's called Does Freedom Love Me? I am not a crime scene. My eyes are not red beans. My hands are not loaded magazines. My lips are not a Glock 19. My voice is not a scream. I'm neither a fiend nor a thief. I am the light that you need to see. Look at how bad I want to be free. I love freedom. Does freedom love me?


All right. It's about 12 o'clock, so we can go ahead and get started. Good afternoon, everyone. Thank you for coming to my talk, Hacking Your Way to Better Security. My name is Colin O'Dell, and I'm a lead web developer at Unleashed Technologies, we're a web and hosting firm based just down the road in Columbia, Maryland, and we are hiring, so if you are interested, stop by our booth downstairs. Some of you might know me as the co-organizer of the Baltimore PHP Meetup Group, or as the maintainer of the Lee Common Mark package, or even as the author of the PHP 7 migration guide ebook. But something you may not know about me is that I won the PHP World 2015 Capture the Flag event. For those of you who aren't familiar with Capture the Flag, it's a security competition where basically the host stands up this website that's full of security vulnerabilities, and all these different contestants gather around and try and hack it. Each vulnerability is considered a flag, so if you're able to find a SQL injection attack, you capture the flag, and whoever can capture the most amount of flags in the quickest amount of time wins. Now, you may notice that my job title is Lead Web Developer.  That's not what I do. But I was able to win this because I was familiar enough with security concepts. And that's really what I want to try and get across to you guys today, is that you don't have to be an expert to be good at security and to secure your sites fairly well. So for today's talk, we're going to explore several top security vulnerabilities from the perspective of an attacker. So for each one, we'll first understand how to detect and exploit that type of vulnerability, and then once we understand how it works and what kind of damage it can cause, then we'll look at how to protect ourselves against those vulnerabilities. Now, I do have to get a couple of disclaimers out of the way before we begin. Number one is that you should never test systems that aren't yours without explicit permission. Some people like to live by the rule that asking forgiveness is easier than asking for permission, but not if you're in jail. So if it's not your website, if you don't have permission, please don't try and hack other people's websites. The second disclaimer, kind of on a lighter note, is that the examples in this talk are fictional, but the concepts I'm going to show you and the demos I'll show you are very real. I don't want to go out and try and hack different websites just for the sake of this presentation, and I don't like live demos because they always go wrong, so instead I have a bunch of pre-made examples here. So even though the examples are fictional, the behaviors that I'll show you are very real, and if you found one of these vulnerabilities in the wild, you would see that same exact behavior. All right, so those disclaimers out of the way, let's go into the OWASP Top 10. So the OWASP Top 10 is a regular publication by the Open Web Application Security Project, or OWASP. And what they do is every few years they put out this publication that lists the 10 most critical security vulnerabilities facing the web. OWASP is a nonprofit organization. They do this for free. They have a lot of really good material on their website if you want to check that out. They provide free resources, articles, and tools for web security, and if you were to go and look at the OWASP Top 10 website, you'd see a list like this showing you the 10 most prominent web vulnerabilities we're facing today, and then you can click into each one and see some more details about them. So if you were to click into the injection one, for example, you'd be able to see how easy is it to exploit, how prevalent is it, what's the potential impact? Am I vulnerable? How do I prevent that type of attack? So for today, I'd like to go through several of those Top 10. I unfortunately don't have enough time to go through all of them, so I've chosen the ones that I think are most interesting, at least from the attacker perspective. So let's go ahead and look at the first one, which is SQL injection. SQL injection attacks are when an attacker is able to modify the SQL statements that a server runs. So an attacker could use this to spoof their identity and log in as a different user that they shouldn't really be able to log in as, or maybe they tamper with data in the database, updating things, changing things, adding and deleting records. They could even use SQL injection to disclose hidden information within the system that they should not have access to. At its core, SQL injection works like this. We take some value from the user, might be a malicious value, and that value is injected directly into the SQL statement that our server runs. So if that value is malicious, then the SQL query that runs will contain that malicious code. Let me show you an example of it. It might make a little more sense. Let's say we have this fictional banking website called My Bank. They've got this nice little padlock icon over here, so it looks like it's kind of secure. But for the sake of this demonstration, let's say that they're not. Let's say that they are vulnerable to SQL injection attacks. And us, as attackers, we want to break into this bank and do some bad things. How would we go about doing that? Well, at first, we may not know that they're vulnerable to SQL injection, so maybe we'll try logging in with some common passwords. Maybe we'll try logging in as admin with the password password, and hopefully we get this error message, otherwise the people at the bank have some explaining to do. But if this doesn't work and we can't figure out any other passwords, maybe we haven't stolen any, we don't know what the passwords are, let's try to see if this site is vulnerable to SQL injection. A really easy way to do that is just put a single quote somewhere in that form input. So let's try password, single quote, and see what happens. We click log in, and now we see unknown error. Well, that's different, because when we tried admin password, we saw invalid username or password. But now we're seeing this different message, unknown error. Why might that be? Well, if we had server access, we could go ahead and take a look at the logs on that server. If we took a look at, say, the Apache error logs, the PHP error logs, we'll see an error like this. MySQL error, you have an error in your SQL syntax near password at line one. If we were logging the queries, we could take a look at what query was executed, and we'll see that we do indeed have a syntax error. There's an extra single quote here. Because there's a syntax error, that error is bubbling up. It's not being caught and handled properly. It's bubbling up as this unknown error on the page. So now we have kind of a good idea that this site might be vulnerable to SQL injection attacks. Let's try a slight variation of this. Instead of putting the single quote at the end, let's put it at the beginning. Let's do single quote space test. Why not? Click log in. We'll see the same unknown error. And when we go over to the logs, we'll see very similar messages there as well. So we have the same MySQL error. There's an error in your syntax. And when we look at the query logs, we see something kind of interesting. Let's look closer at this. This is the query that the server is running as a result of us submitting our password as single quote space test. And it looks kind of like this query. We have select star from users where username is admin and password equals empty string. But then there's this little bit on the end. And that little bit, that test there, we were able to add that in. So is there some way that we could take advantage of this vulnerability to be able to hack this bank account or hack this banking website? What if instead of putting test, we put in some condition that is true? We have or something that is true. Because when this runs, MySQL will look at this thing, this whole bottom part that and password is blank or something that is true. If this is true, then this entire bottom line evaluates to true. And therefore, this is essentially the query that's being run. Select star from users where username is admin. Totally bypassing the password check. So what string do we need to create to put into that field to make that happen? Well, we know if we do single quote space test as our input, that goes into the query like this. And that's essentially what gets executed. So let's clear that out and let's build up the actual queries that we want to run. Well, we know that we want to start off our password with a single quote. Because that's going to terminate this string here. Well, we've got another single quote on the end. So let's put a second single quote towards the end of that string. All right, that's looking good. But now we need to have that or something is true part. Let's put an or. And how about string containing one equals string containing one. So if we were to submit this into the form, this is the query that gets executed. Let's try that out. Go back over to the site, put in that password, and we're logged in. And now we're in admin. We can give people money, take it away, deny credit cards, close accounts, do whatever kind of malicious things we feel like doing. So SQL injection can be pretty dangerous. And as you can see, it can allow you to log in as users that you really shouldn't be able to log in as. But there's more you can do with SQL injection. There's a really cool type of SQL injection called blind SQL injection. Blind SQL injection is where we use SQL injection to issue queries to the website. But the website can answer those directly. So maybe we want to know, does this user exist? Maybe we want to map out the database structure and say, does this table exist with these columns? Does this credit card number exist in the system? The system won't tell us yes or no directly, but we can absorb its behavior to figure out whether the answer was yes or no. Now we know from the previous example there were three different types of messages that could appear on the top based on what our input was. The first one was this unknown error message. We would get that anytime there is any kind of invalid query. Maybe there's a syntax error. Maybe we have a single quote missing its pair, something like that. Maybe we're trying to reference a table or a column name that doesn't exist. If that happens, that's what the browser will see. And so we can kind of infer that there must be some kind of error in our SQL. Now if we get this message instead, this is telling us that the query was valid, but there were no results returned. There was zero rows returned from the database. So if we tried to do a SQL injection and saw this, that tells us that our injection kind of worked. Our database table names were correct, column names were correct. Everything was correct. There just was no data. So the answer to our question that we were asking is no. But if on the other hand we saw this, we know our query is valid, and the answer to our question is yes. So let me show you what that looks like. Let's say we want to map out the database of this banking application. Maybe we'll try a SQL injection attack like this. We've got a subquery here, select ID from user limit one. And when we run this, we might see an unknown error. Now if we had access to the server side, we'd be able to check the query log and see, okay, that looks like a valid query. There are no syntax issues there, but if we check the MySQL error log, we'd know that there's no table named user. So that's why we got the unknown error. But maybe there's a table named users, plural. Let's try that. So we'll wipe that away, add the S to user, run that, and we'll see invalid username or password. So now we know there is a table named users, and it does have an ID column. Now we can, of course, repeat this process, figure out all the table names, all the column names. We can even use this to figure out if certain data exists in those rows. We could say look in this table for a username called admin or a credit card starting with the number four. And we can kind of force our way through that, and that could work, but it's going to be really slow and tedious. So if we really want to get a lot of information from this banking website, we'll want to use a data disclosure attack. Basically have the website output that data for us. Let me show you a different example of this in action. So here's a fictional bookstore website, onlinebookstore.com. And when you go to slash book slash 123, you see a listing for one of the book products. Well, how do you think this website works? Getting to the mindset of an attacker, knowing what you know about web development. How does this work? That when you go to this URL, this appears. Well, we know we have to be grabbing the ID from somewhere. In this case, it's the URL. And then there's probably going to be some kind of SQL query asking the database, hey, do you have a record for this book? And then running that query, getting that data, outputting it through our template. Now what if we try an ID instead of 123? What if we try something that probably doesn't exist, like 999999? Lots of nines. We might see a 404 error page. And when we do that, as developers and as hackers, we can kind of infer that it must be going through that same process. It's still running that same query, but there are no rows. There's no data to return. There's got to be some other code after this that detects that and then shows a 404 page instead. But what if instead of 123 or 99999, we put some kind of malicious query up there and then had that value injected into the SQL statement, have that return different data instead of a title, author, and price, and have the website show that in the template? How could we do that? We can do that using the SQL Union operator. A SQL Union query basically takes two select statements, takes whatever the results are, and then combines them into one set. So if we were to union the actual book data with something else, maybe that's some malicious select query that you built, that data would be returned into a single result set. There's a problem with this, though, because when we go to slash book slash some ID, the website's only expecting there to be one record. Your network are going to have two books with the same ID. So it's only ever going to look at this first row and not actually show us the data we're trying to query. Well, cool thing about the Union operator is that if this left side is empty, if there's no data, then the final result set will be just our malicious query. So we know that we need to build a URL like this. So have 9999 to select that empty data and then union that with some malicious query to grab credit card numbers or something like that. Now there is one other gotcha, and that's when you use a Union query, you do have to have the same number of columns in both sets. So I can't simply grab just the number. This won't work. I'll have to kind of figure out that there are three different fields that are being grabbed. And so as a result, my query needs to return three fields. So let's modify this up here. Instead of selecting just the number, we'll select the number and we'll call that title. And then for author and price, we'll just select a dummy value of one. So what happens when we hit this URL if this website is vulnerable to SQL injection? This query gets executed. This is the data that is sent to the template and there is our credit card number there. So we can use this to get the credit card number out of the database. Now, of course, we can automate this process and get all the credit card numbers. So we could add a limit clause here and say, skip the first one, show me the second one. Skip the second one, show me a third one. Throw that in a bash script and now you have all the credit card numbers from this online store. So how do we protect ourselves against SQL injection attacks now that we know how they work, how they can be taken advantage of? Well, remember, a SQL injection attack is basically some malicious untrusted value being injected directly into the query. So maybe we could block input with special characters. We know that single quotes can be dangerous, so why don't we just block those? Well, we could do that, but then if you have an Irish last name like myself and you try and sign up for United's rewards program, you'll get this message saying your last name is invalid. It's not just United. I'm not just picking on them. This happens maybe every week or two. So we obviously don't want to do that. We don't want to make our users angry. Maybe we can escape the user input instead. Maybe we'll take that raw untrusted data and run it through a function like MySQLI real escape string, which is a really long name. And what that'll do is if there are any single quotes, it'll just put a backslash before them so that when that query gets passed into MySQL, it'll see the backslash and then a single quote. It'll say, oh, this single quote here, that's not ending the string. That's inside of the string. So this is a valid approach. However, you need to make sure you're not escaping things more than once or I get letters in the mail like this. This also happens every week or two. All right, so maybe we don't want to escape user input. Even though it would work, you know, not the best approach. A better approach would be using prepared statements.  It's going to look like this, but there's going to be some value that I want to search on. Some value that might be coming from an outside source and untrusted source. And MySQL, I want you to escape it for me. I don't want to have to deal with did I escape it, did I not, did I escape it twice, did I unescape it? I don't want to deal with that. You do it for me. Here's the query I want to run. Here's the value I want to insert as that first parameter and then execute it. And that's basically all you have to do with a prepared statement. Now, you can do this natively in PHP if you're using MySQL I or PDO MySQL. You can, of course, do it in Drupal. Drupal does support this, as does pretty much every framework and library out there. Doctrine, Eloquent, ZendDB, Magento, Symphony, Laravel, they all do this. So if you are taking user input and using that in a query, use a prepared statement. That's the best way to protect yourself. Now, SQL injection, interesting enough, isn't the only type of injection. You can actually have no SQL injection. You can have injection attacks occur with operating system commands, LDAP queries, SMTP headers. Basically, any time some user submitted data gets put into an instruction that the computer must run or interpret, it could be vulnerable to an injection attack. So for these other types, if they don't offer prepared statements or anything like that, you will need to escape the input and make sure people aren't putting in weird things like single quotes, amber sands, things like that. So that's SQL injection in a nutshell. The next vulnerability I'd like to share with you is cross-site scripting, commonly abbreviated as XSS. Cross-site scripting attacks are when malicious code is injected into a web page. So it's injected into the HTML or the JavaScript sent to the victim's computer and the victim's computer interprets that code and executes it on their machine. So as an attacker, we could use that to execute malicious scripts. We can hijack user sessions, install malware, even deface websites if they're vulnerable to cross-site scripting. At its core, like I said, cross-site scripting attacks happen when raw code or scripts are injected into a page. Those malicious values can come from any number of sources. They can come directly from user input. They can come from a third-party source like an RSS feed or an API or some other system. They could even come from within your own database. If there's some malicious code in your database that gets placed into that value and you're echoing it out directly into the page, the computer may run that. Think about it. When you request a page from a browser, it's sending all that HTML and JavaScript over. And whatever it sees there, it's going to execute. Let me show you an example of this. Here's a fictitious link shortener I've called Shortly. Basically what you do is you provide a URL like colonlodell.com, click on Shorten, and it gives you a short version of that URL, which you can post in a tweet, send to your friends, print out on a business flyer. And when they go to that URL, they're shown that they're going to be redirected to that longer URL, so far so good. But if this website was vulnerable to cross-site scripting, what could we as attackers do with that? Well, let's try something like this. Let's try submitting this as our URL. We have a basic JavaScript tag here, and our JavaScript should show a pop-up box. So we put this in the field, click Shorten, and we immediately see Hello World pop-up. Why is that? Well, let's close that pop-up and... Oh, where's that original URL? I would totally expect to see this here, but I don't. Well, let's look at the source code. There it is. It was put into the HTML of the browser, but the browser saw that as an instruction to run, not as something to show to the user. So that's an example of doing this with JavaScript. What else could we do with this? Maybe we could do an iframe. Maybe we could do something like this. Click Shorten. And I don't know if you can hear it, but we can rig-roll our friends. Better yet, we can send them a short URL, and they'll be stuck on this page because there's nothing to redirect to. So we could do that. It's, of course, a lot of fun to do, but that's kind of a really basic, not very dangerous type of thing we can do with cross-site scripting. Something more malicious might be having the browser execute code like this. Let's say we have a website like reddit.com. For those of you who aren't familiar, reddit is a social network where we share stories and share stories with each other. And they can fill out what the title of the story is in a URL. And that is shown on the homepage in the big list, and right next to that list is a login form. Now, if we were able to inject this code into the homepage of reddit as our title, then anyone who visits the site will have this JavaScript execute. This JavaScript is looking for the login form and changing the URL of it to malicioussite.com. So if we get this onto the homepage of reddit, anyone who logs in is actually sending their credentials to us. So cross-site scripting, really bad. How do we protect ourselves against cross-site scripting attacks? One possible approach might be filtering user input. So maybe we run the user's input through strip tags, strip out the HTML, the iframes, JavaScript tags, take it all out. You could do that, but what if you're trying to build a site like Stack Overflow or Pastebin that people want to share HTML and not have that deleted?  So strip tags, probably not the best approach. A better approach would be escaping the user input with something like HTML Special Chars. This is a built-in PHP function which will take your less-than signs, your greater-than signs in the HTML, and encode them as HTML entities. So when you echo this out into the browser, it'll know, okay, this isn't a tag to run, I need to show a less-than sign, the word script, and then a greater-than sign. This is totally valid to do. My preference, though, is to escape the output. So not doing it on the input, doing it on the output. So regardless of wherever this data comes, I just leave it as is until it's time to generate the HTML. And at that time, that's when I choose to escape it. The reason I do it this way is because if you do it this other way, if you do it on the input, you have to remember to do it every single time. Anytime you're grabbing stuff from the request, anytime you're grabbing stuff from an API, anytime you're doing stuff with a database, you need to escape it. And if you forget once, you're in trouble. Also, what if you need to process that data? Now you have to un-escape it and then re-escape it. It can be kind of annoying. So I prefer to just keep the data as is. Whatever they send me is fine. But if you do it in the HTML, that's when I'll escape it. However, make sure you don't escape more than twice, more than once rather, or I'll get emails like this. Again, common occurrence here, common theme. Now what's really nice about TWIG, which is in Drupal 8, is that by default, TWIG will escape this kind of stuff for you just by using the double curly braces. And if you really need that raw HTML, maybe you're building your HTML database, you can use the raw filter to get that raw value. But it takes care of it for you by default. Really nice. You don't really have to think about it. And this type of functionality is common in a lot of templating systems. So if you're using Laravel, Laravel Blades has that. Smarty Templating Engine has that. Other platforms like Magento and CakePHP have the ability to escape things for you. Maybe they don't do it automatically. Maybe you need to call a function like E to escape it or something else. Or you need the ability to escape that output to protect yourselves from cross-site scripting attacks. So that's cross-site scripting. And that leads nicely into the next vulnerability I like to talk about, which is cross-site request forgery, or CSRF. CSRF attacks allow the attacker to execute unwanted actions in the victim's browser and make their browser issue HTTP requests to other services. And if those services are vulnerable to cross-site request forgery, they'll see those requests as being legitimate requests from the end user. And so we could take advantage of this as attackers to do things like change the user's password to something that we know so we can log in. We could use that to transfer money from someone else's account into ours. Basically anything the user can do in a browser, if the target website is vulnerable to CSRF, we can take advantage of that. Let me show you what I mean by this. So let's say that I want to log on to Facebook. What does that process look like? My browser goes out to Facebook and says, hey, here are the credentials. Log me in. Facebook says, hey, Colin, I recognize you. Those are the right credentials. Here's your newsfeed. And also, here's a little session cookie. Next time we talk, send this cookie back to me so I know who you are. You don't have to log in every time you try and do something. So I go on Facebook, check my newsfeed, update pictures of my cat, do whatever. And then later on, maybe I browse to a potentially malicious website. And when I go to that site, I say, hey, site, show me your home page. It says, sure, here you go. And then inside of that HTML might be something like this. Here we have a form. It's pointing to facebook.com slash password.php. Maybe that's the changed password page. Here's a predefined password and some JavaScript to automatically submit that. So when my browser gets this, it's going to say, oh, I need to do this thing. I need to tell Facebook to change my password to hacked one, two, three. So my browser is going to send that request up, including my session cookie. And Facebook will see, okay, this is Colin. We know him from this cookie. And if they're vulnerable to CSRF, they'll say, all right, your password has been changed. And I'll talk a little bit more about why that happens and how to protect it, protect against it in a moment. But something I want to show you is that you don't necessarily have to execute this type of attack using a malicious server that's out there. You don't have to trick the user to go into a malicious site. We can actually use cross-site scripting to initiate this type of attack on an otherwise trustworthy site. So here's an example of our shortly website. We know that if we put any HTML into there, it'll show on the page. So let's try putting in this image tag. We'll set the source to paypal.com email is me at evil.com amount is lots and lots of money. And when I shorten this and send it to my victim, this is what they'll see. We'll just see a page with an image that doesn't work. But behind the scenes, the browser is saying, oh, I need to send an HTTP request out to paypal.com slash pay. User is this person amount is lots and lots of money. And if PayPal is not double checking for CSRF attacks, they could potentially cause that transaction to go through. So this also sounds really, really bad. How do we protect ourselves against it? You might think, oh, well, we can avoid that whole image source get thing by using post requests, right? Well, no, because post requests are vulnerable too, like I showed in that first example. That's actually one of a few common misconceptions that some developers have when it comes to protecting against these types of attacks. They might say, well, image tags can only make get requests. If I make everything post, anytime someone wants to transfer money, if I just make that post, I'm safe. Not necessarily. They might also think, well, if a user doesn't click the form, it's not going to submit. Again, JavaScript can do that for us. So only using post requests is not a valid approach here. Maybe we'll say, all right, well, what if we have like a secret cookie, like a super secret cookie that we can check that and know if that really is the user we can't really do that either. Because remember, cookies are something on every single request, just like that session cookie. So having a super, super secret cookie isn't really going to do that for you. What you really want to do is use what's called a randomized CSRF token. Basically what we do, if we're Facebook and we're trying to protect ourselves against this type of attack, is we generate a random string for every user, every time there's a form that they're going to submit. We take that random string, we store it in our session. So on the server we store it in the session and then we also add that value as a hidden field to all of their forms. That way when they submit the form, we can check that value. So if they submit the change password form, we'll look to see is there a CSRF token, does it match? If it does match, we'll go ahead and proceed with doing that action. If not, we'll just reject the request. The reason this works is because other services can't see what that CSRF token is. If you're running that malicious website, you can't tell what that CSRF token is to put that into the request that you make the browser execute. And that's due to the browser's same origin policy. Basically, the browser will prevent that website from going out to Facebook and seeing what that value is. So by only putting it on the form only when they're actually viewing that form we can ensure that yes, they are actually submitting the form at that time. It's not some automated process being kicked off from some other website. So that's how we protect against CSRF attacks using randomized CSRF tokens. The next vulnerability I like to share is what's called insecure direct object references. This is a really long name, which really means accessing and manipulating objects that you really shouldn't have access to. And it's pretty straightforward. Let's look at an example here. So here we have a photo I took at the Sunshine PHP conference. And you'll notice that up in the URL we have this ID. This ID is a reference to a photo in Facebook. It is an object reference. It's referencing that photo object. It's a direct reference to that specific object. But what happens if we change this number to something else? What if we just change that nine on the end to an eight? Maybe we'll see Beverly Cooper's awesome selfie. I don't know where I found that, but I love that picture. So even though Facebook never linked us to this page, we were able to change that object reference and access it. This is assuming that Facebook doesn't check those references and that they're vulnerable to insecure direct object references. In reality, they do check it. So if you try to go to that URL, you'd see this message, sorry, this content right now, the link you followed may have expired or you don't have access to see it. So they do protect against it, but if they didn't, you'd be able to just change the ID and see other pieces of data in the system. Viewing other people's photos, yeah, that's kind of bad, but it could be worse. Because we're not just talking about IDs that appear in URLs. What about IDs that appear in forms? What if you had a banking system? What if your local bank had the ability to transfer funds between accounts? And if you looked at the HTML behind the scenes here, you'd see that each account has a unique ID. So maybe this fictitional checking account has an ID of 68465. We're going to transfer money from that to savings. But what if we want to transfer money from someone else's account? What if instead of 68465, we do 09810 and submit that form? If our bank isn't double checking the reference that we're using, we could potentially transfer money out of someone else's account into our own. This is bad. Luckily, protecting against this is really, really easy. Essentially, you just check permission on any type of data input you're getting from the user. Any type of object they're trying to reference. So maybe that's an ID in the URL. Maybe that's a slug or a machine name in the URL. Maybe it's not in the URL. Maybe it's in a form field. Basically, any time the user tries to do something kind of identifier, some kind of object reference, double check it and make sure that they should have access to view or manipulate that object. And if they don't have permission, either show them a 403 forbidden page or maybe a 404 not found page. Technically, the correct one to use is 403 forbidden, telling the browser and the user you don't have access to this. But maybe we want to mask the fact that the thing they're referencing does exist and they don't have access. So maybe we don't want them to figure out what bank account numbers are real and are fake. So in that case, maybe we'll just show a 404 message even when it really does exist and is found. So that's totally up to you and your use cases if you want to do 403 or 404. Of course, we'll also want to check permission on data output. What I mean by this is anytime you go to show someone a list of objects, make sure that they do have access to those things. Don't show the photos that they can't see or a list of bank account numbers that aren't theirs. Pretty straightforward. Do they have permission to access it? Do they have permission to know it exists? Now, when I talk about this and when I talk about using 403 versus 404, I want to make it clear I'm not talking about security through obscurity. Security through obscurity is a term that really means hiding the IDs or hiding the fact that they exist but doing it as the only line of defense. You really want to take a defense in depth approach where you're both checking the IDs and determining do I want to show 403 or 404. So having both layers of defense as you're doing your security. So that's protecting against insecure direct object references and that takes us into the last section here. And in this section I've combined three different vulnerabilities because they are somewhat similar. But if you were to look them up in the OWASP you would see three separate entries. These three vulnerabilities are sensitive data exposure, security misconfiguration and using components with known vulnerabilities. So let's start off by looking at the sensitive data exposure aspect. Sensitive data exposure encompasses many things. One of the things it does encompass is exposing files to the web browsers and web traffic, web crawlers and bots that could give attackers an inside look into how you've set them up.  An attacker can use these files to glean information about your site making it easier to attack you. Let's look at some of these. Let's start by looking at the changelog. What if you have a Drupal 7 site with a changelog in your web root? An attacker might be able to go to your website.com and see you're running an old version of Drupal 7. They could then go look and say, okay, what security vulnerabilities exist in 7.9 and use that against you. Some people also have a composer.loc file available in the web root. We can see Google has indexed 491 instances of this. So I can go to any of these results here, pull that up and I can see that this particular person is using an outdated version of symphony. They're using symphony 2.1. In fact, they're not even using a stable release of symphony 2.1. They're using a development version. So again, I can figure out what types of vulnerabilities exist for this. How can I use those to attack this website now that I know this additional information. A more dangerous one is exposing your .git folder. Here are 578 websites that do that. I can click on these results and browse the repository or I could just do a git clone command and just clone down their entire repo. Which is kind of bad. It's even worse if they've committed security information in there. If they've committed something like their MySQL password or API credentials. Maybe they've said, oh crap, we need to delete those and they did a git rm. But that original file is still in the repository. So we can pull that down and we can find that. So that's pretty bad. Another one that's a little more interesting is the robots.txt file. Of course, using a robots.txt file tells web crawlers like Google and Bing and Ask Jeeves. Well, they're not around anymore. But if they were, it would tell Ask Jeeves that, hey, I have these things that I really don't want you to index. But you have to be careful with that because sometimes they'll index your robots.txt file. And even if they didn't, anyone can pull that up and see, okay, this person is running PHP MyAdmin 2.5.1. So now I know they're running that version. I can look for vulnerabilities that affect PHP MyAdmin. So when it comes to robots.txt it's kind of a balancing act. How much information do I want people to see versus, you know, do I want them to know that this exists? Do I want it to be indexed? Probably a better way of protecting PHP MyAdmin would just be putting HTTP basic off on that area. So they have to either pop up, enter a username and password before you can even load the page. Something like that is probably a little bit more secure than just trying to hide the fact but not really hiding it. So, sensitive data exposure. We've talked about these web accessible public files, but there is a lot more to it. Basically, anytime you have any type of private information that is stored, transmitted or backed up in clear text or even with weak encryption. Weak encryption isn't much better than no encryption at all. So if you're going to encrypt something, you don't have information, encrypt it using strong encryption, put it outside of the web root. So I'm talking about things like customer information, credit card numbers, credentials, things like that. So if you're doing any kind of automated imports or exports with a three-party system that requires FTP transfers, don't put the customer data in the web root. Put it in a separate folder and lock FTP to just that folder. Things like that. So we're going to talk about sensitive data exposure. We also have security misconfiguration and using components with known vulnerabilities. When we talk about security misconfiguration, we're talking about things like using a default account, having that enabled. So using the default admin admin or admin password. I'm sure many of you have seen that when you set up your home Wi-Fi routers. That's the default password. If anyone can get access to that page, they can log into your server. So if you have that, make sure you change those passwords. This also covers things like your security configuration. So is your SSH server set up to allow root access? Can someone log in with the username root? Are you using weak encryption keys? Also, are you using out-of-date software? Are you using an old version that has known issues? Are those version numbers exposed? Because if so, like we saw, anyone can go find out you're using SSH 7.9 or symphony 2.1 and go figure out some common vulnerabilities for that. Another more interesting aspect of this is having unused software running. Maybe you have an old FTP server that you used to use five years ago and you've kind of forgotten about it. Well, that's still running. That's a potential attack vector. And there are more other interesting types of attacks, like with the drown attack. Now, it's been a while since I did a drown attack, but if memory serves, drown attack is an attack against SSL TLS. Basically, the latest and greatest versions, you know, TLS 1.2, are really secure. But there are known issues in things like SSL 3, which is an older version. However, some really clever security researchers found out that if you're running both at the same time, people can use SSL 3 and attack that to gather you and break the stronger connections based on information they found in this older protocol that you're still running to support Microsoft XP users. So be careful what kind of software you're using. Make sure you're not running anything that you're not using anymore. Now, when I talked about using components with known vulnerabilities, I said we can go ahead and look that up. The US government actually runs the National Vulnerability Database where you can search for these types of vulnerabilities that you want. Let's try and attack that. What types of vulnerabilities exist for it? I can search the database and I can see this nice issue here. There's a session fixation vulnerability in the remember me login feature in symphony 2.3 before this version and symphony 2.6 before that. Okay, so now I know there's some type of vulnerability. What I can do is just search for this identifier here, the CVE ID and maybe I'll find a blog post about that vulnerability. And then if I scroll down, I can see there's a patch available. I can pull that up and if I maintain a symphony site, I probably want to apply that patch. But if I'm an attacker, I could go ahead and look at this patch and I apologize you can't read it. But let's say you could read it, you could understand what is it patching and kind of figure out what was the original issue that existed. How can I exploit that? And if you know you have, if there are websites out there using the CVE ID exploit and use it to infiltrate that website. So how do we protect against sensitive data exposure and security misconfiguration and using these types of components that have known vulnerabilities? The number one thing to do is to keep your software up to date. If there is a critical patch, if there is a security update, apply that immediately. Do not wait. Now if there are other non-security updates out there, you still want to apply those regularly.  Because what might happen is that you fall 20 updates behind, security issue comes out. Now you're not just updating from one minor version to the next. You're updating through 20 minor versions. And all those versions might have cell breaking changes that you have to go fix and you have to test. And now it's taking you a lot longer to get that critical update applied. So keep your website up to date. That way when a security issue does come out, you can immediately patch it up. As we mentioned before, you want to make sure you're keeping sensitive data outside of your web root. You can do that one level up. You can do a separate folder of the server, whatever works for you. So we're talking about files that contain version numbers. So readme files, change logs, composer.lock files, your get directory. Keep those out of the web root. If you have any database credentials or API keys, try and keep that out of your web root as well. If you can't, maybe you're kind of stuck to have your passwords in settings.php in the web root, just make sure that file is locked down. Make sure no one can see that output. Make sure no one can mess with that file. Set your permissions correctly. We're also talking about encryption keys. I know, I believe an older version of UberCart, I want to say in Drupal 6 had like a CC keys encryption key. I don't know if that's still the case. I haven't touched UberCart in a while. But it used to store an encryption key in the file system. And if you weren't careful and you put that in some kind of publicly accessible area, someone could download that encryption key. So the best practice for that was just keep it outside of your web root. Same thing here. Of course, when we talk about encryption, we want to make sure we're using strong encryption. We want to encrypt with a strong private key, keep that out of the web root, and then make sure any sensitive data we have is also encrypted. If we can, we want to encrypt our backups and any kind of data in transit. So if we're communicating with a third party API, use HTTPS. Make sure you're securing that communication channel as well. Now, when it comes to passwords, you don't want to use encryption on passwords. You want to use hashing on passwords. Encryption is a two way operation. You can encrypt and you can decrypt. Hashing is one way. Once you hash a password, there's really no way to figure out what the original value was. So if you're dealing with passwords, make sure you're hashing them and you're using encryption. Don't use MD5. It's outdated. It's vulnerable. Use something a little more modern. And then lastly, test your systems. There are a lot of good tools out there that can automatically scan your site and look for these types of issues. They can look and see, do you have a .git folder? Are you exposing version numbers? Are there issues with your encryption? They can check that for you. Of course, you can also test the critical components yourself. Maybe you write your own automated test to check some of this. Maybe you just manually click around and see, okay, is my .git folder vulnerable? You can do that. And this is kind of good advice for all the topics that we've covered in this talk. Just go ahead and test it. Scan your site to see if they're vulnerable. Now this does wrap up on the last set of vulnerabilities I did want to share today, but I would like to provide some next steps. So now that we know this information, what do we do with it? What do we do once we leave this room alone? Again, number one, test your own applications. See if you're vulnerable. If you are, fix them. Maybe you want to just test it just for the fun of it and see, okay, can I hack my own website? What does that look like? That can be kind of fun, and it'll help you protect your website and lock it down. Maybe you want to get more into security. Maybe you want to get into ethical hacking. There are people who hack websites for a living. It's awesome. If you're interested in that, go check it out. Maybe you even want to enter security services, and you can get a lot of information about the security services that are being used to capture the flag events. Some conferences have them, some meetups have them. There are even meetups dedicated just to capture the flag events. Go find them. They're a lot of fun. But more importantly, I think everyone here should stay informed. Stay up to date with what the latest security trends are. What types of software are being deprecated and are no longer secure? If you have any questions, go to robots.txt. Just stay up to date with what's going on in the security community so that you can protect your own applications. So, at this point, pretty much done. I would like to open it up to any questions. If you have a question, if you could step up to the microphone so we can get it recorded as well. I'd appreciate that. Okay, I got a couple. First of all, robots.txt. We've got to have that. Just be aware of what you're putting in it. Obviously, if you want to protect your admin area and say, don't go to slash admin, that's fine to do. But make sure you have security on slash admin. Don't just kind of use that as the only way to hide things. What about comments in JavaScript and stuff like that? Because we have a scanner that goes through and it grabs and it says, hey, you've got these comments. You've got to get rid of them. They could have bad information in them. Do you recommend getting rid of all those of the linting process? If it's easy, you might as well. If it's difficult, if you're not really compiling them or doing any kind of automated process, it's probably okay to have them because anyone can de-uglify your JavaScript if you're at what it's doing anyway. One more. Pantheon, I believe, uses the changelog file as a key to know when, when you've pushed up a oh, you've upgraded your Drupal Core. Are you sure you wanted to do this? If someone like Pantheon is using that, what do we do? Does it get in touch with them and say, hey, we want to get rid of changelog as part of our security measures? Or what do we do? I'm not familiar enough with Pantheon to know if they make that publicly accessible. If that file does become publicly accessible from your website, I would say, just make sure you don't mention any security vulnerabilities. Or if you do, keep it really vague. Say, we fixed the security of that vulnerability with this ticket number. And then only you know what that vulnerability was. Okay, thank you. Hi there, that was a great presentation. I really liked how you showed it out. I was just wondering what automatic tools there are, because you mentioned Check Your Site with an automatic tool. Do you have any names? I should have anticipated this question. To be honest, I know they exist. I haven't really used them myself. I have used them, but I don't use them often. I'm not a security professional. But I know the OWASP top 10, if you go on their website, they do have a lot of tools. And I'm sure other people here have great recommendations on tools you can use. Okay, all right, thank you. I think I've heard of that one. Thank you. Appreciate that. Thanks. Yes. I was just wondering how much of this stuff Drupal already takes care of just in core. Drupal does a lot of it, but you do have to remember to take advantage of it. I have seen examples where newer interns aren't really familiar with how to bind parameters, and they'll just stick variables right in their SQL queries. So, yes, while Drupal does take care of it for you, I think it's good to know about it, just so you don't make those mistakes, and if you end up working on another platform, you know what to look for, and you know what questions to ask to do things securely. Good question. Appreciate it. Is this presentation going to be available to access? Yes. This is my Twitter handle up here. I'll post the link out to the slides in a few minutes. Okay, perfect. And then I think kind of the only other point would be while Drupal does take care of a lot of it, think about all of the other scripts that you have for other things that are kind of ancillary to Drupal that could give away into something somewhere. Absolutely. So I think that's the kind of your biggest vulnerability when you're using a pre-dump platform. Definitely. Good point. Thank you. Alright, if anyone has any other questions, you're welcome to come up and ask me. If you'd like to leave feedback, just go to I think this link here, find my talk. You can leave feedback on it, leave me a comment. Let me know how I did. Thank you.


Welcome back to the sixth annual Mustang gala. My name is camera summers and I'm here with Jasmine Wilson. Okay, Jasmine Is this your first Mustang gala? Good good. I hope you have a good time So are you on a team here? Yeah, I'm on the track and field team rapper. Hi We look good tonight. We came out strong. I'm really excited to see how like the people who win the awards and stuff I'm really excited. Do you have any encouraging words for those who were nominated for a war tonight? You definitely deserve it I I was aware of the nominations and the people who are are up for nominations I've seen how you work hard and I'm just so proud good job and hard work is definitely paying off Okay, okay. Well your outfit looks amazing. Thank you actually just interviewed someone with the very similar color Way to this did you guys coordinate at all? No, he's my son. We didn't talk about it at all I just came in and saw he had the exact same color same with glasses and every No, he's my son if he asks So he got his inspiration from you. Yeah. Yeah, okay. Okay. Well, I hope you have a good time tonight your first gala Of course, of course