Joseph Kelly joins us again on Liberty Chronicles for part two of our interview about his recent book Marooned, Jamestown, Shipwreck, and a New History of America's Origins. Welcome to Liberty Chronicles, a project of Libertarianism.org. I'm Anthony Comegna. Shifting our narrative over across the water back to Virginia, it's a mess. It's a total mess. It's definitely a failing colony. People are starving. The population is disappearing, the English population. The Native Americans are doing just fine. There are rumors that John Smith wants to set himself up as sort of a pirate king of Virginia along the James River. Tell us about what is going on in Virginia, especially with the attention to the fact that, really, this is still Sena Comoco or Native American territory. It's barely Virginia. Right. Right. Yeah. So this is, you know, while all these events are taking place in Bermuda, and even as the ships are sailing or getting ready to sail from England, it's a meanwhile back at the ranch situation in Virginia. From the very get-go, the Virginia company governance had proved itself to be incompetent in Virginia from April 1607 when they first come into Chesapeake Bay. By the time we get to the fall, half the people have died, mostly of disease. Of course, that disease is exacerbated by their malnutrition. The president, of course, John Smith himself began the plantation of this colony in chains because he had been suspected of sowing rebellion even before they arrived in Virginia. His chief kind of opponent was Edward Mariah Wingfield, who becomes the first president. When they get to Jamestown, Wingfield suspects him of insurrection even before they get there. So they put him in chains and Wingfield actually wants to execute him in Nevis when they stop in the Caribbean islands, but Newport prevents it from happening. When they get to Jamestown, they break open the secret box, which is going to tell everybody who the counselors are, who are going to be governing. They don't know whose names by the company until they get there, and they break it open and lo and behold, one of the names on the list is John Smith, so they basically have to let him out of his imprisonment and allow him to help with the governance of Virginia. But there's factions from the get-go, and within six months, Wingfield is deposed by a faction that John Smith is a part of. Settler counselor is executed. The faction that deposed President Wingfield splits into two factions, the Smith faction and the Ratcliffe faction. So from the whole first two years of Jamestown is this history of factionalism that contributes to their incompetence in providing for the settlers. So from the very beginning, the settlers could recognize this, and they saw that this was a disaster, and they begin deserting. From the very first summer, they are deserting to Indian camps. And so down there on the grass roots, the English settlers have these fantastically friendly and productive relationships with the Indians, even as some of the Native Americans are attacking the fort and some of the, you know, the English are fighting some of the Native Americans. Here on the grass roots, there's a black market going on, and there's all sorts of interactions. There's probably a lot of sexual interactions between the English and the Algonquins, because we know, from what we know of Algonquin society, unmet young women were sexually active, and there's no taboo against that. So there's all sorts of unofficial ties going on, on the low level, on the grass roots level. And these continue on for two years, and what's remarkable about, when John Smith eventually gets dictatorial powers, when he becomes president, what's remarkable about his presidency, he kind of puts an end to this. He starts actually billeting his people in Indian villages, but he knows where they are. He can't feed them in Jamestown, so he starts putting them in Indian villages. And essentially what John Smith is doing is what Wingfield had accused him, and Wingfield was afraid that he was going to be doing this, was at setting up his own kingdom on the James River. I don't think, again, this is maybe a kind of controversial interpretation of John Smith, but I think the evidence makes it pretty incontrovertible that John Smith, he doesn't set himself up basically as a pirate king. I think the analogy, the best analogy would be, he sets himself up as a werewolf. He's a paramount chief in the same way that the structure of Algonquin society on the Chesapeake was set up. The man we know as Palhoutan, of course, is a paramount chief of maybe high thirties, maybe thirty-five to forty different districts on the Chesapeake. Most of what we know as the James, the York, and the Rappahannock, and even half the Potomac Rivers were under his jurisdiction, if you will, as a paramount chieftain. And what John Smith does is he sets his own paramount chieftain up on the James River. He separates the districts, the Native American districts on the James River, from what's sometimes called the Palhoutan Confederacy. So he becomes a rival to Oahu-Sanacaca, the man we know as Palhoutan. So it's not really a pirate king, but he sets himself up as his chief and he has pretty much dictatorial powers. But because he acts as a dictator, he's got a lot of those grassroots settlers are very disgruntled with his rule. And they are, they're deserting. They continue their desertions and they aid Palhoutan in his attempts to overthrow, get his districts back from John Smith. So essentially there's like a civil war going on on the Chesapeake. And John Smith is allied with some Indian districts. And there are several English and other settlers, some German settlers as well, who are allied with Oahu-Sanacaca on the York River. So it is just as crazy what's going on in Jamestown as what was going on in Bermuda, except with larger, because there's more people involved. So this is the situation, well, you know, eventually John Smith, he loses his own power struggle to the English. And that's what, you know, the famous starving time that leads to cannibalism happens after James Smith, who has been wounded and what was probably an assassination attempt, has back to England. The failure of the Sea Venture, which got shipwrecked in Bermuda, the failure of it to arrive in Virginia begins the starving time. They didn't get the provisions that they expected from the Sea Venture because John Smith has gone, their relationship with the Indians completely deteriorate. So Jamestown stars. And this is what, you know, once Governor Gates has built this ship in Bermuda and forced the settlers in Bermuda to get on board and sail to Jamestown, they imagine that they're going to be rescued as they sail into Jamestown and they're going to find a vibrant colony that is flourishing. And instead what they find are, you know, people who are lying in their cot starved to death, another basically skeleton stumbling out of their roofless huts in Jamestown, holding out their hands to these shipwrecked castaways from Bermuda and looking for rescue from the castaways themselves, you know, a horribly ironic situation. So what happens, and immediately then is everybody, even Governor Gates recognizes how really precarious the situation is, he demands that they spend at least a couple of weeks trying to make it a go in Jamestown, but after those couple of weeks, even he has to give in and recognize that this is not going to succeed, that they better sail back to England right away or else they're all going to starve. And they get on the boats and they start sailing down the river. As they leave Jamestown, the settlers desperately want to burn the place down to make sure that they are not brought back to it and essentially, you know, enslaved again. Governor Gates prevents them from burning it down, and that's his little Purick victory as they get on the boats and they start sailing out. And lo and behold, before they make their way out of Chesapeake Bay, the fourth resupply shows up with the new governor who's bringing with him his own retinue of soldiers who forced them all to go back to Jamestown. And then what ensues in the next year is maybe the worst, not for starvation, but certainly for, you know, considering Jamestown a slave labor camp. The new governor is a baron, he's a lord in England, so he's got tons of status, baron Delaware, our Delaware comes from his name, and he spreads the colony out, he's got hundreds of new settlers and a giant contingent goes up to basically around the Richmond area where the falls of the James River are the highest navigable point, and there's a big rebellion up there where every, you know, probably dozens of people are trying to escape to the Indians to escape out of the English jurisdiction, and many of them are caught and they're horribly tortured in ways that are just, you know, just horrific to think about. The worst case is they're chained to trees and made to starve to death slowly, so their fellows can see them starving and therefore be terrorized away from stealing their own labor away to the Indians themselves. So the whole first three years of Jamestown is basically this struggle from common laborers who discover, you know, what the reality on the ground is and who try to escape. Many of them do, many of them do melt into Native America. Others get caught, get tortured, become examples for their fellows who didn't make it out. And that's basically, you know, it's a cycle that goes on and on. There's, I counted 14 different instances of what are described of as mutinies or insurrections by the Virginia Company in the first three years of the Jamestown settlement. And a lot of those will eventually emphasize Stephen Hopkins-like language that essentially we didn't, look, we didn't consent to all this. So then- Exactly. The most amazing thing perhaps about somebody like Stephen Hopkins or him in particular here is that this guy ends up signing the Mayflower Compact. How does that happen? As I said, true stranger than fiction, right? You can't make this stuff up. And again, this is something that people have known, you know, basically since it happened. And yet people don't seem to have made much of it. Even Caleb Johnson, the guy I mentioned to is the biographer of Stephen Hopkins. He does, he kind of suggests that he probably had a hand in the composing of the Mayflower Compact. I think circumstantial evidence demonstrates that he had more than just a little hand. He must have been the one who was dictating the terms of it. If you read William Bradford's of Plymouth Plantation, the way he describes the circumstances leading to the Mayflower Compact is that because the Mayflower had gone off course and it was, you know, they had a patents to settle in territory that was governed by the Virginia Company and they were far north of the territory that the Virginia Company was allowed by its charter. So strangers among them and Bradford describes, you know, the two classes of people on the Mayflower as strangers and saints and the saints, of course, are the people we know of as pilgrims and the strangers are those people, those settlers who are not part of the Pilgrim Congregation. The strangers were arguing that because they were about to settle in territory that was outside the Virginia Company jurisdiction, their contract with the Virginia Company was dissolved, was basically did not apply and once they set foot on land, they would be free to do whatever they chose to do. This is the very language that Stephen Hopkins used to persuade people to his conspiracy in Bermuda. According to William Bradford, that's what triggered the need for the Mayflower Compact and then we look at the language of the Mayflower Compact that, you know, we signees enter into the civil body politic. This is exactly what Stephen Hopkins was arguing that the settlers were going to do if they were able to get themselves off to their own island in the Bermuda Islands and set up their own village, their own little town. So the very language that leads up to the Mayflower Compact and the Mayflower Compact itself is identical to what the disgruntled settlers were trying to do in Virginia. And amazingly, I think this is, I mean, another thing that's not been recognized by historians, which I don't understand why not, is that this circumstance, in order to be thinking the way Stephen Hopkins was thinking, you know, we were entering into a contract or we were governed by a contract, that contract is dissolved. Now we are essentially political pre-agents. That whole concept depends on this confrontation with the wilderness, you know, where you are standing in territory that is not governed by any European power, which is what was the case in Bermuda, of course, and what was going to be the case in Plymouth when the voyagers on the Mayflower set foot on dry land. They were going to be entering into a wilderness that there was no patent for it at all. So they were entering into essentially what we now know of or would describe as the state of nature, man in the state of nature, where each individual is disconnected by any kind of obligations to every other individual and free to enter into any kind of set of mutual obligations where you give up certain rights in order to secure certain protections. So, of course, this is the language that Thomas Hobbes and John Locke are going to use later on in the 17th century, but Stephen Hopkins is pioneering this very concept 30 years before Leviathan is published. 40 years, 40 years before Leviathan comes out. Now, of course, I'm not suggesting he uses that language of the state of nature, but I think even chore those for Hobbes to conceive of the state of nature requires this confrontation with the wilderness that was taking place during the age of exploration and was being lived out by Stephen Hopkins, both in Bermuda and then in Massachusetts.  It should be a society built from the bottom up. We have an opportunity to begin government at the right end, just like on Hopkins Bermuda. Yes, and this is why I think this story is so important for us to... Well, for people today to hear this story, it's important for me to tell this story and what I certainly hope is that this book will kind of inspire further research into what is going on in early America. Essentially, what I'm suggesting is we rethink of these settlements as examples of the frontier thesis. You know, the first American frontier, of course, was the coastal plains up to the fall line, whether it's in Massachusetts or whether it's down on the Chesapeake Bay or in Bermuda, for that matter. I think we need to rethink what is the origin story of America, because what's powerful about this story is the notion that we as Americans are the inheritors of this people in the state of nature, who enter into a contract with each other, and we do this in every generation. We need to renew it in every generation so that people here today in 2018, here it is election day, today, right? What are we doing except entering into a contracted mutual consent with each other? That's what's particularly, I think, important and emphasized in the Hopkins story and the story of castaways and maroons, people being hurled into the wilderness. And it's a corrective, I think, for what is pretty much the reigning king of American origin stories, which is the Pilgrim tale. Now, of course, there are people entering into the frontier too, but the myth that we get with the Pilgrims is very different than the myth that I'm suggesting. We ought to think of it as our origin. The central thesis, if you will, of the Pilgrim story is a parallel to Exodus, and this is of course how William Bradford imagines the Pilgrims themselves when he's writing the plantation. God's chosen people who are oppressed to escape their bondage and head out into the wilderness, but the wilderness is a promised land, a land of milk and honey. And they make a covenant with God, the promised, the chosen people. The covenant, and this covenant is actually pretty well articulated in 1630 by John Winthrop on the Arbella as he's coming to settle the Massachusetts Bay colony. The covenant says, hey, if God will prevent us from shipwrecking, if he can keep us from crashing and being hurled into the wilderness, we will remain faithful to him. And that's essentially what Puritan Society of Massachusetts ends up doing, and they end up setting up a theocracy that's city on a hill image. It's a city on a hill because it remains faithful to this particularly kind of strict interpretation of Christianity. And by the second and third generation already people like William Bradford are complaining about the backsliding of the settlers. So the problem with Exodus is not just that we think of ourselves as the chosen people of God, but that whenever you think of yourselves as the chosen people of God, if you think of the foundation of our nation as being a covenant between ourselves and God as opposed to a covenant between each other, a contract between each other, always in the second or third generation, what follows the Exodus story is a Jeremiah. And now the great critic Sakhen Berkovich recognizes back in the 1970s is particularly distinctive former genre of American discourse, American literature and also American political discourse is the Jeremiah where a prophet rises up to harangue the current generation for not being faithful to the past, for not being true to the principles of our forefathers. So when you have the Exodus tale as your foundation myth, that's always going to be succeeded, the sequel to Exodus, if you will, is going to be the Jeremiah. And what that demands of the present generation then is that not that we ourselves make decisions about entering into a mutual contract with each other, but that we ourselves are bound to remain faithful to something in the past. Now, what that thing in the past is or what our image of that thing in the past is is going to vary from generation to generation, which is why you have Ronald Reagan, you know, resurrecting this image of a city on a hill for the United States and describing that city on a hill in terms that would actually be important to the pilgrims themselves. You know, William Bradford bragged about how unfree this society was that he established in Massachusetts. He was very happy that that Plymouth Plantation was less free. There was less liberty there than in England, and that was that's what made the city shine, you know, in his view. So Ronald Reagan, of course, borrows that image. But he says the city is shining because of the virtues of liberty and equality. So the version of the past is going to be different depending on whoever is, you know, who is the Jeremiah crying in the wilderness. And he's going to give us an image of a past that we have to remain faithful to. But in my mind, that's not a very healthy way to think about our democracy. Joseph Kelly teaches literature at the College of Charleston, and I really cannot recommend his latest book more highly enough. Along with good old Benjamin Lay, I say let's go ahead and name Stephen Hopkins another patron saint of Liberty Chronicles. And the Kiss My Arse Guy, too. Gotta love that. It doesn't get much more genuinely American than this. Liberty Chronicles is a project of Libertarianism.org. It is produced by Test Terrible. If you've enjoyed this episode of Liberty Chronicles, please rate, review, and subscribe to us on iTunes. For more information on Liberty Chronicles, visit Libertarianism.org.


Hi everyone, Joe for jazby'scasebrakes.com. We did it, we knocked out 20-22 tops of five star baseball. Eight box, pick your team number 45. There's the fresh case right there. Very big thanks to this group for making it happen. Now Tristan ended up with the last bot mojo with the Braves. So we got the last one before we pulled the remaining teams for a big team random that we did.  Kind of like a random team, but we just randomize your names, just not the teams. You can see that in the video. So we did that randomizer in a separate video if you're looking for that. Fresh case right here. And we did post another case as well. So if you missed out on your teams this time, don't miss out next time. Get your team before someone else does. And someone else will. All right, I love the five star. A lot of great stuff here. Two autographs per box. Yeah, playoff Jimmy is scary though Scott. That's true. We were trying a little basketball before we started this break. But I mean, Nuggets were just about my Lakers. They seem like a team of destiny. Everything seems to be clicking. Jilo's saying everyone's doubting Butler and proving him wrong. Every time gets old. Time for the Nuggets to humble him maybe. Here's Tyler McGill. Rookie Auto for the Mets. That's gonna be for Ryan Heights. I suppose now that the Lakers season, I can start focusing on baseball again. They're gonna nice patch Auto four out of five. Big Boppy, David Ortiz. And that's Chris Butler with the Red Sox. The Butler did it. Out of fives and under, get the train whistle. All aboard the Big Hit Express. Woo-hoo. That's great. Big piece of the letter right there. That's awesome. Wait, is that the T of Boston or is that the T of Ortiz? Do they put their names in the back of their frisbees? It'd be for Boston. Anyway, nice. Next case of the store, ladies and gentlemen. I feel like we've been getting some nice stuff out of these five-star cases. I got the wizard Ozzie Smiths, 45 out of 50.  That goes to Tristan, the Nationals. Or sorry, not the Nationals. That's where the Washington Wizards play. See my head still in basketball. D.Y. and the Cardinals with the wizard. The next one here is Daryl Strawberry. Metz, Ryan Hynes. There's Chris. Thanks for helping fill up that filler. Rewarded, that Ortiz. Ryan Hynes gets a straw man. Daryl Strawberry. All right. Another one. What do you got? Lars Newtbar. Rookie Otto for the Cardinals. Another one for D.Y. Lars Newtbar had a cool story with like Team Japan, I think.  That kind of level of superstar in Japan. And he was saying that they got to meet the Prime Minister, they went through like some secret tunnels to like exit those star players and Newtbar was just like, he's never been treated like that. 49 out of 50. Well, they were treating Shoei and Darvish, but. All right, here is Mark McGuire, Big Mac, A's edition, going to Ryan Hynes. We got Jackson Coar, six out of 15. Rookie Autograph of the Kansas City Royals, Tristan with KC. The Royals minor league pitcher of the year. We've got Matt Olson for the Braves. That's going to be for Tristan in Atlanta. Last spot, Mojo strikes again. My Dodger's beating the Braves earlier today. We got Matt Manning, M and the At symbol. Get it, Matt Manning, Rookie Otto for Travis and the Tigers. It's pretty clever Matt Manning. I see you. And there's Smoltz, John Smoltz. Nice, one out of 25. Another one for the Braves, Tristan. Yeah, that Otani trout matchup might go down as one of the best moments in not only the world baseball classic, it's just baseball history in general. How many times do you think they replay that in four years? Do you know when their world baseball classic comes back? All right, we got Jake Berger. Mmm, Berger. Rookie Otto for the White Sox. That's for Bartholomew. Bart with the Berger. I think Jake Berger's been playing pretty decently this season. Got him on my fantasy team. He was on the IL for a little bit, but yeah. Hitting some dingers, looking pretty good. And we've got Paul O'Neill. Six out of 75. So the Berger, the delicious Berger goes to Bart and Paul O'Neill goes to Tristan and the Yankees. Couple more boxes to go, ladies and gentlemen. Yeah, I wonder what they have. Yeah, to be a fly on the wall, when Otani and Trout met each other back at Angels' Camp. Probably some good natured trash talking. Otani probably said, I got you, MF'er. Trout was like, USOB. But they probably said those words. We're family friendly shows, so we don't say those words. Although you might hear us say it in the background. The hot mics might catch those words when we're watching sporting events. We got Patrick Mazzica. 33 out of 75 who had like a hot week with the Mets, right? When he got called up, he's on the Dodgers now. I think he's, I think he's maybe probably in the mind. They probably released him, actually. I don't think he made the team, so. He was on the Dodgers. And, oh, look at this. Jaren Duran Duran. Pentamorous Penmanship, 13 out of 25, he is. The baby Red Sox kind of looking good. They got Casas called up, too, right? Now, Jaren Duran Duran, hungry like the wolf. Hungry for his major league playing time. All those guys that you did not want to see during last year's breaks, and now all of a sudden. Yeah. People have been brushing off for Jaren Duran's. He's been good. But the year before they wanted Jaren Duran because he had a hot spring. And then the next year they didn't want him anymore. And then now this year, he's had an up and down sort of a, sort of poppy roller. Yeah, he did that big kind of blunder where he did just the ball in center field and all this stuff. Now, he's really figured it out. You know what I think it was on the screen? I think he listened to it. That Team Mexico experience. Maybe, yeah. It was there. It's a big mess on there. How many times do you think he guys asked if he likes Jaren Duran? All the time. Probably all the time.  Do you think you don't think he listens to Jaren Duran? He listens to, like, future. That's not easy, and me and young boy. All right, last two. We've got Brian Delacruz for the fish. Miami Marlins. He's hot right now. Nestor, yeah, he is. Have you ever been marlin fishing, Chris? I've only been fishing IRL a few times. But if your video game has fishing, your game is great, it's the best. I think you might be able to fish in Breath of the Wild. Yes, absolutely. All right, that goes in the new ones out. Once again, that goes to Nestor and the Marlins. And the final one is, ooh, ooh, we got Wade Boggs with a Chicken Man inscription. 19 out of 20. This is Devil Ray's version of Wade Boggs. You're the devil in disguise. Oh, yes, you are. Devil in disguise, mm. That goes to Ryan and the Rays, the Chicken Man. And there you go, boys and girls. 2022 five-star baseball in the... This is some great stuff. We've got another case loaded up. I feel like we can knock another one out straight up, or maybe with the help of a filler at some point tonight, make it happen. I'm Joe, I'll see you next time for the next break.


Alright, as you click on this, you're like, dude, I'm tired of, maybe I don't want to pay for leads, maybe I want leads for free, maybe I want people saying, Landon, I want to do business with you and they're doing it every day and it's because of stuff you did previously, right? I'm excited about this title because you can generate thousands of leads for free. Yeah, you have to understand that as long as you're patient and you're able to develop a content marketing strategy along with using the channels that we have that are free, you will get inbound leads. You will get inbound leads from that. We have a client that does Medicare and they have a big old website they've built and I think the other day they wrote 27 Medicare policies off their website with leads that week and they didn't pay a dollar for that lead cost technically. They just came in and also those are laydown sales. What's some numbers of the amount of leads they're getting from that? What do you mean, like how many leads a week they're getting? Yeah, I mean hundreds of, whether it's gated content, like we look at our website, for instance, we'll get about 350 inbound inquiries a week. That comes from gated content, contact us, forums, really just people trying to connect with our content and reach out on social. You're sending me screenshots of people reaching out to you on your personal social page almost every day to try and get in touch with us. Are we counting those? I get that every day as well. I'm not, no. Yeah, because we got a handful of those every day too. So that's the point, right? You eventually want people reaching out to you, right? As you talked about before, being the buyer versus the seller, right? You want to have people reaching out to you, asking you to do business with you. There is a way to generate leads for free. You just have to be patient and you have to build a good foundation. And one of the things, we just did a video on content marketing. You should go check that out. It's full like a sort of step by step on how to actually do content marketing. So go check that video out. I'm not going to get back into content marketing. But if you're the one that is educating the consumer over and over and over, you're going to be the one that gets the first opportunity at that business. So what I mean by educating is is writing articles, you know, creating value to the industry. What is being searched? What is the hot button topic in your particular area? Maybe a Medicare plan changed in your county and maybe that's going to affect hundreds of people. Well, if you're the one that's saying, hey guys, etna, just rolled out a new plan that's going to raise pretty much everyone's cost by 250 bucks, make sure you read that letter you get from etna. But here's your options instead or whatever that type of angle. Or that letter, 78 pages, we made it into one page and here you go. Perfect, dude. That's exactly right. That's exactly right. So not to say that that one Facebook post or article will get you tons of inbound leads, but if you structure correctly, continually educating the market and putting yourself in that position will get you those inbound leads. Not to mention, you know, you're able to use social media. If anybody's been able to leverage social media to its fullest potential in an organic state, it's been you, man. Talk to me about your strategy on how you've been able to sort of leverage that. That's how you started, really. It is, man.  And it's like, we're not that special. We just, you know, the one thing it starts with the same letters by name. I know what you're going to say. Dude, we were just consistent. We didn't give up. Like if we did the virtual conference, if you don't quit, you can't fail. We were just consistent. And I just, we just put out content. We, because my team and everybody else, Keith, Dylan, everybody else, right, did more than I did. We just consistently put it out every day. And what do you know? Four and a half years later, some people watch a few, maybe the biggest YouTube channel on YouTube, you know, an interest training, but okay. No, but that's the key though. It's like, you got to be consistent with it. And you got to be able to really, your heart really needs to be educating. Like if you're trying to create an article, yes, only to just try and fish the leads out, it comes across as disingenuous. Yeah. If it's like, if the goal is, I want to make money tomorrow, you'll quit. And you're also not going to do content marketing. You're going to go buy leads. That's it. And that's fine. Like buying leads is great for short term results. Like that's totally cool. Obviously we're a leads company, you know, but the point of trying to get organic leads is to educate the public. Now, in order to actually do that, you have to be found on Google, believe it or not, right? Yes. So, you know, one of the things that people don't understand about how Google works is Google is really looking for local professionals to give answers to the local searches. So like if someone's looking for a local Medicare office or Medicare settlement quote or whatever, they're going to Google is going to try and find a local presence there. If they can't find a local presence, then they're going to start giving the national presence, the authority in that area. But there's a wide open market for people to become a thought leader and authority in the actual specific market on the keywords you're going for. You're not competing against that on these big carriers. You kind of are on a national scale for sure you are. But like when it comes to like the local keyword research, their content is not going to have the geo tags, the actual cities and the actual tags. And they're also not going to have a Google My Business that says, I have an office here. So let me ask you a question. If you're an individual that's aging into Medicare and you're truly looking for the best solution Medicare office for you, are you going to want to go to an actual office in Springfield, Missouri or are you going to want to go to some random website? An office. Okay. Well, Google knows that too. So they prioritize local individuals over national and only give national people the credit when there isn't a local presence. Yeah. Does that make sense? Totally. And a lot of people forget there's like multiple pieces to that first page Google, right? There's ads. There's actual organic posts, right? Blog posts, websites. There's business listings like you're talking about. Also, they got to where if they find relevant YouTube videos, Google owns YouTube, they put those videos there too. And you've got like a little playlist of videos. And Google Maps. So if you're, if you're the keyword search that's happening in your city says like near me or whatever, they're going to throw up Google Maps. And if you're not a doll on that map, you're not going to have a chance to get in that business. Absolutely. Right. So, and you can also, I mean, that gosh, there's so much to learn about this, but like you can even put ads on the Google Maps and then get calls and there's all kinds of stuff you can do. But anyway, so in order to be found though, you have to have the content engine moving. And you also need to develop like a what's called a gated content strategy or like an ebook. So. Especially for lead gen. Well, if you go to security and leads website, you know, you'll see we've got scripts. We've got, you know, how tips on how to close our our final expense leaves or Medicare leads, whatever. And whenever we say we get 300, you know, inbound increase a week, a lot of that is that requesting to download an actual final expense script. Well, the individual that is downloading the final expense script, don't you think they're probably a prospect for us? Totally. Okay. So isn't that probably a good lead for our sales team? Yes. Okay. So that's how it all works, right? You got to be found on Google with content. You got to have lead magnets, gated content, something that gets the information email address after you've provided the value. And then you'll start to get those inbound leads. It's really not that hard.  And ratio wise, we are one point something throughout the month. But also if you search like Spanish file expense leads, we're always one or two organically as well. Yeah, even across the country. I think if you Google Spanish final expense leads, I think we're like one or two. Yes. I'm on that no matter where. Yep. Which is pretty impressive, honestly. But it takes time. Totally, totally. But it's listened to stuff like this, but a lot of people will listen. The real question is will you actually apply what you learn? And that is true. That's the reason why 92% fell is they they everybody knows stuff. Everybody wants to learn. Everybody kind of wants to be successful to talk about it. But most people the stuff you're talking about, most people don't actually do it. Well, it's it's incredibly important. And it's a long term strategy. So if you if all of your marketing budget is going towards buying leads, you're you're best you're creating an unsustainable situation. Totally, right? You want to be building a brand and also lead generating along the actually I should say it for better this way. You want to generate leads but also brand along the way. Yes, because if you stop buying them one week, it stops the whole thing. You have no engine. You turn the faucet off. Exactly.  So at the end of the day, you know, what we want to try to encourage you guys to do is yeah, buy leads. Obviously, that's an important part of the insurance industry, right? But you also need to carve out a portion of the budget to work on this organic lead flow that you will get. Okay, I know a final expense producer. I don't want to name his name. Everybody maybe even know who he is. He has a big old final expense website. He does a million dollars of premium a year and his own pen off that stinking SEO site. Yes. That's crazy. Why is he doing that? Because no one else is sprinting and competing with him. He just, yeah, he started the race earlier and his freaking outlasts everyone. That's exactly right. And he's continually consistent in what he's doing.   Now, totally. That takes a lot of time. I did a video with Jeff Root. He talks about spending an hour a day on your SEO. So if you don't have an hour a day, you should probably hire an SEO company like Securities and Marketing. But if you have more time than money, then that's an absolute vital thing to be doing is build a WordPress website, use Elementor page builder to be able to add these pages, create a blog feed, and then just go to work, create content, and then just tell me your way into it. You can find a bunch of Google. I've we've gotten on our YouTube channel, but whether it's your YouTube channel or ours, there's plenty of videos on how to actually do SEO. Oh my gosh. So totally. Anyways, what am I missing, man? That's it.  The whole thing about this is I want to eventually have leads, which means what you probably explained in other videos is you got to structure it right. Yep, which we do talk about in other videos. So go back and watch the content marketing video and we'll talk about the structure. So if you guys want to get organic leads moving, you got to start going now. This was, you know, hopefully beneficial to you guys. You can buy leads all day long, but that's unsustainable. You want to be able to work towards creating your own marketing funnel to generate your own leads as well without paying per lead. Yep.  Go to scourgemarketing.com and we'll make sure you get a free strategy call. Yeah. All right. Let's do it. All right. I was looking forward to working with you guys.  I'm like, I want it all, man. Dude, I'm with you there. Okay. Insurance marketing secrets. Landon just shot a video with Mr. Jeffroot. You guys check out this video. Okay. It's literally right there. Okay. Go click on it. We'll both be in there and we'll see you there. It doesn't matter what platform it's on. I think they're caught up in trying to get the lowest cost per lead instead of...


Hi everyone, Joe for JasperiesCaseBrakes.com, coming at you with 2022 Panini Limited Football, 7 box half case. Pick your team number 6. Second half of the case. We have those little marks right there so we know they're from the same case.   So this is pretty much a random number block break minus the few people that bought some teams. Derek and the Dolphins, Ryan and the Raiders, Hans and the Packers, Ed with the Cowboys, Ryan Heintz would be Cardinals. Alright, here are the results of the random number block. Thanks for spending a bit of your Easter Sunday with us, ladies and gentlemen. So we got that, we did it in different videos if you're looking for that, but those are the results. Zero gets any and all redemption for this giant group of teams right there, including one of one redemption. So rare occurrence, but that's what it says in the description. I guess we'll keep this next to me over here. We'll probably have a lot of number block cards right here. All right. And away we go. Two autographs and one memorabilia card per box on average. Good luck, boys and girls. So we'll randomize this to one person in the break. Winner take all on those points. Hopefully those will be the only ones, the only points we'll see. All right, there's Justin Fields in 99.  Bears are a number block team, so that goes to Bears 2, Chicago 2. And your hits, we got Traylin Berks, 104 out of 125. So that goes to Tennessee 4. Again, we go by that digit right there. Jeff with number 4. Now you're thinking, Joe, there's a ton of non-numbered rookie cards and base cards, what about those? We're gonna randomize that as one lot. There's one big lot to one person in that group.  All right, and we got Hassan Haskins, 98 out of 199. Nice patch, Nato. Tennessee 8, Hans with number 8. All right, another box, Logan, what's going on? How are you? Happy Sunday, I'm sure that was the hit. We got a CD-Lam, 119 out of 125. That is for Ed and the Cowboys picked up the Cowboys straight up. All right, and your hits is another Cowboy. Cavante Turpin, 8 out of 49, rookie auto for Ed P. Behind Daniel Jones is a Tyquan Thornton Relic, 44 out of 99, that will be for Patriots 4. And that is for Jeff. And behind Tom Brady is Jersey and autographed Zemir White from my Raiders, 7 out of 90. I think the Raiders are picked up straight up.  Hopefully we'll see Zemir White get some more touches this year. Keep Josh Jacobs fresh, create sort of a two-headed monster, call him Zeus out of Georgia. I think he was doing pretty, running a pretty well in Georgia. Next box, all right, we got Sam Elinger, 40 out of 125, that's for the Colts, Colts 0 for Adam. You got Tua revealing a Trey McBride. Here comes McBride, 25 out of 99 for Ryan Heintz, Ryan H. And the Cardinals. McBride, Relic going your way, Ryan. The middle here is another Cardinal for Ryan H, 52 out of 75. That's Jalen Thompson, rookie autograph. What are the Cardinals doing at quarterbacks? Does anyone know? I think Kyler Murray, I don't think, is going to be ready for the start of the season. They might have someone fling that ball around for a little bit. All right, and the RPA is Desmond Ritter, three-color patch and autograph to 199. That's 132 out of 199. That will be for Atlanta 2. That's for David M. All right, another box. Good luck. Sam Elinger, 52 out of 99. They'll go to Colts 2, that's for David M. All right, behind AJ Brown is a Ram rookie autograph. That is Lance McCutchen, 42 out of 99, that's a catch. And that will go to Rams 2, number 2, David M. Behind Sterling Shepard is a cool-looking patch. Here comes McBride with a three-color patch, 24 out of 25, Ryan H. Cardinals. That's a cool-looking patch. All right, and back here is Jersey and Autograph, your offensive rookie of the year, Garrett Wilson, 72, that is, out of 99. Jets 2, David M. This might actually fit better in a 120 top loader here. Yeah, it feels a lot more secure in this. There we go. Three boxes to go. All right, we got a Darnell Mooney, 12 out of 125, Chicago 2 for David M. All right, let's see what we got here. Behind Jalen Hertz is his teammate, Dallas Goddard, 65 out of 75. Eagles 5, Chris Butler with Eagles 5. Limitless insert. Sky's a limit. All right, behind Zach Wilson is 25 out of 25, David Montgomery. Bears 5, number 5 is Chris Butler. And behind Mike Evans is attiring Davis Price, 29 out of 199. And that is for Chris and the number nine. Number nine, number nine, number nine, number nine, all right. Next box, Allen looking for upside down nines. Yeah, come on upside down nine. That plate is a one of one, A.J. Brown. Eagles one, Chris Butler with an extra spot that you won, Chris. All aboard the Big Head Express, whoop, whoop. For the fly, Eagles five. Here is two out of five, Derek Carr, silver and black patch, going to Ryan G. And my Raiders. The Saints was a good landing spot for old Derek. I hope he does well. Just not against the Raiders. All right, Raiders, Ryan. All aboard the Big Head Express, whoop, whoop. Behind George Kittle is CA3, 72 out of 75, two color patch and autograph. That goes to 72, so that'll be for David M. Steelers two. And then behind Deontay Johnson is Jersey and Otto for the, no for the Titans that is. Hassan Haskins, 47 out of 99. David M. With number seven. All right, and final box coming up. Good luck, everybody. Gilo, what's going on, Gabe? Happy Easter, happy Sunday. When I randomize those points, everyone has a chance at it. If it ends up with the, if it ends up with a number block team, which it most likely will, I'm gonna make that the consolation prize because it'll be like the non-numbered base cards. Right? And then name on top will get the non-numbered base card. Second name will get the points. We'll do it that way. Just gonna put it all in one dice roll. DK Metcalf, Seattle 32 out of 125. That goes to David at number two. All right, good luck. We got, we got a David Bell. And that is six out of 99. Brown six, it's gonna be for Allen Murdoch. Last spot, Mojo on the board, Allen. Then we have 11 out of 49. That is Taekwondo and Rookie Relic. It's Patriots one. It'll be for Chris. And the last one here is gonna be Sean Alexander. Game day aesthetics, 15 out of 15. Seahawks five, Chris Butler. The Butler did it. Hitting you with a, with a Psalms 37-4. If you're into that sort of thing. Maybe on a Easter Sunday, you are. All right, let's flip over here. Should we look it up? What sort of poignant Bible verse has Sean Alexander given a Psalms 37-4, delight yourself in the Lord and he'll give you the desires of your heart. Let's see if someone's gonna desire some non-numbered base cards. Actually, let's do the points first. So let's gather all the teams, put your names in there, and then non-numbered base card opportunities right here. All right, let's roll and randomize it. One and a three, four times for each list. One, two, three, and four. After four times, it's the Jets and the Jets are a number block team. So on to the next randomizer. So name on top, non-numbered base cards of that big group of teams. Second name, 250 points. Same dice roll, after four. One and a three. One, two, three, and four. So it'll be Chris Butler with the non-numbered base cards. Hans, you'll get the 250 points. There you go, gang. I'm Joe for Jatsby's casebreaks.com. I'll see you next time for the next one. Bye-bye.


My name is Fyodor from Insecure.org. Can you guys all hear me? No. No? That wasn't up! All right, well thank you all for coming. DEF CON is always a blast and it's an honor to be here giving the opening talk to start out the conference. This year I'm going to talk about end map hacking. Basically there are a lot of security people who use end map, but many of them don't understand its full power. And end map deserves a lot of the blame for this because it kind of is too helpful sometimes. If you do a scan such as endmap scan me dot end map dot org, you're leaving end map to worry about deciding on the scan type, the timing options, the output format, the target ports, the source ports and addresses, and more. Well that's helpful reducing that complexity in terms of making end map easy to use. It's also troublesome in terms of a lot of people never explore the literally hundreds of advanced options that end map has for making your scan more effective. So in this presentation I'm basically going to go over three real world common examples and scenarios. And then I'm going to demonstrate how you can use end map effectively to solve them with an emphasis on options that are a little bit off the beaten path. I'm also happy to be releasing a new version of end map, a special for DEF CON. End map version 3.83 DC 13 is available at this URL here. You definitely want to get the one on the web rather than the CD as it's a lot newer. It is a lot of cool features which I'll talk about in this presentation shortly. Also I'm going to give early warning now that this presentation does use real uncensored IP addresses and host names. That's because I trust you guys not to abuse the information. Also, okay, okay, but if there are any black hats in the room who would use this information maliciously, then I'm sorry, but I'm going to have to ask you to either leave or when the IP addresses come on the screen just cover your eyes. I'd appreciate that. Before I begin, it would help me to get an idea of how much introductory end map material I need to cover. So if I could get a show of hands for anyone here who has ever used end map. All right, everyone. So we'll skip end map for dummies and move directly to host discovery. Host discovery covers the real common case where you just want to look at a network and find all the hosts on that network that are online.   Or maybe you're going to do a more intensive scan, but you want to figure out what hosts are up first so you can focus your efforts on those. End map used to only be able to send an ICMP echo request message and later a TCP act to a port. And at the time, you know, that was useful. And that's still the default because there was a time when end map could send a ping request and expect that the vast majority of hosts would respond. Unfortunately, that time is well past.  The internet is a much more guarded and filtered place nowadays. Fortunately, end map has also evolved with the times and offers a wide variety of options to make your host discovery more powerful. For example, you can send SIN probes. If you want to get through a stateful firewall that only allows SINs, you can send ACP probes for those stateless firewalls that watch for SIN packets but can't tell, you know, that the ACP's not part of an established connection. UDP probes you can send, and all three of these types you can send to a big list of ports in the hopes that you'll find just one of them that's responsive. Also, ICMP echo requests and pings, time stamp requests, net mask requests. So you have a whole lot of options there. You can combine those options almost arbitrarily. But with so much many options, that leaves you to the question of, well, you know, what's going to be most effective? And sure, you know, I can speculate on what might be most useful or what networks I've seen, you know, have available. But the best way to answer these questions is empirical results. So let's start with what are the most valuable TCP ping ports to use? I did a scan of more than 10,000 IPs on the internet using NMAP's random target selection option. And I took that and looked at just those hosts that are heavily filtered because the unfiltered ones we're going to be able to find anyway. And of those, I said, hey, which ports are most responsive to a SIN packet? And this is the list starting with the most common. SMTP is also popular, SSH, HTTPS, FTP, OFF, telnet's down there, but it's nice to see it below SSH. And these are the sort of things that you would expect to see. You know, if you have your firewalled host, you still have to have port 25 open if you want to receive mail. You know, a lot of times they make 22 widely open, so if they're off it, well, DEF CON is a bad example. But if something bad happens while you're away, you want to be able to connect in and remotely administer. So your best bet is to pick a variety of these. The next question then is what sort of TCP probes do I want to send?  You know, the answer is just send both. That way, if it's the stateful firewall, like Microsoft.com, your SIN will get through, but your ACP won't. Whereas a stateless firewall, your ACP's more likely. So send them back. All you need is one response to tell you that the host is open. So send them both. What about UDP ports? Here you have a little different idea than with TCP. With TCP, an open port is still responsive, so it tells you that the host is up. With UDP, NMAP's blank UDP messages are unlikely to elicit a response from an open port, and so you don't want to hit an open one. So your best bet is probably just to pick a high port, like 22,131 or whatever, that's less likely to be filtered. And a little exception to the rule is you might want to try 53 as well, just because DNS is so common. Yes, if it's open, you probably won't get a response, but sometimes administrators open it for a whole section of network, and so from those machines that aren't running DNS servers, you can still get through. For PING types, I would recommend an echo request, and then either a timestamp request or a netmask request. The idea is that some hosts, for example, Google or insecure.org will let you PING them, whereas there are other hosts that have said, hey, I'm going to block PINGs, but they do it poorly and they forget about the sister options like timestamp request and netmask request. But the ones who block the latter are likely to block them both. So your best shot is generally to do both, or to do a PING request and then one of these others. So let's put that all together. Take all of these ideas and put it into one intense discovery combination. And here's one that I would recommend. Here we're doing an echo request, timestamp, a variety of SIN probes, ACP probes, and also setting the source port 53. You never know when that little trick will work to get through port configurations. One thing to note when doing this is that this is 13 probes rather than two. And host enumeration time is going to be roughly proportional to the number of probes that you send, and so you want to consider whether it's worth it. But in many cases, you really do want a comprehensive list so it's worth taking a little longer. And like I said, speculation is all well and good, but when you're deciding whether you do want to spend the extra time or what's going to be most effective, empirical data is the best to have. So I did a test. I used the random target option again to generate a list of 50,000 random IPs. And then I ran it and mapped with the default scan types. And it chugged away and chugged away, and eventually it said, okay, out of those 50,000 IP addresses, 1,770 are up. All right, so now let's try it with the more intense discovery. We use all these probes, and suddenly instead of 1,700, it gets 2,698 hosts up. So we see a 50% improvement just by adding these extra options. And yes, it did take four times as long, but in many cases, if not most, you know it's worth it for you because you really want to find all of the hosts. And there are a couple of notes that I want to make regarding this sort of scan and these results that we've found. One is that it's not quite as exciting as it seems because some of these 2,698 hosts are going to be network artifacts. For example, in my last DEF CON talk, I showed an example where a host that was a firewall was spoofing reset packets to any probe sent to port 113 on any of the hosts behind it. And so some of these are network artifacts and you'll have to use the sort of techniques I talked about last time to discern which are the artifacts and which are the actual hosts. The other thing worth noting is that these techniques will give the most improvement in a case like this where we're doing a worldwide scan over the internet against tons of firewalls and filters and such. If you're scanning a local LAN, the defaults may work fine. But while we're speaking about scanning a local Ethernet LAN, that crops up with its own big bunch of issues. Here I do an Nmap command for a ping scan of a host on the Ethernet LAN that's not really up. SendIP is a new option that I'll talk about later. But for now, you just need to know that that does the same default behavior as all of the pre-DEF CON releases. So I run Nmap and I've pasted in some ethereal output to kind of show what's going on under the covers. I give the OS an IP packet. It sends an ARP request looking for the machine immediately. Then after one second, it sends yet another ARP request. And after two seconds, it sends a third ARP request. And finally, it gives up and Nmap ends after just over two seconds. And there are a couple of problems that... Can you guys hear me better? All right. There are a couple of problems with this two seconds. You know, it may sound, oh, two seconds big deal, but if you're scanning <IP_ADDRESS>.8, that's 16 million hosts and two seconds is going to add up. Even 192.168 is still 65,000 hosts. And Nmap scans these in parallel, but still it's not as fast as you would like it to be. And it's wasting time waiting for these ARP requests. Another problem is that most operating systems, you know, they have an ARP table and that ARP table is finite. So when they have an incomplete entry such as this, they'll add that ARP table will fill up and sometimes Nmap has to wait, you know, as much as four minutes for those ARP entries to expire. You may have seen that if you scan a big network, Nmap is like, hey, I can't send right now waiting 60 seconds, then waiting 120 seconds. It's very frustrating. And since scanning your own local LAN is extremely common, that's something that's worth optimizing. And so one of the features in the new Nmap is ARP scanning. The idea is give Nmap full control to send those ARP packets. That way Nmap can worry about the timing and the retransmissions. It can skip over the ARP table for the OS entirely and do the scan a lot faster. Another advantage not only is that it's much faster, but it's more accurate. As we've already seen, many hosts have all sorts of filters that can block your host discovery packets. But if they want to communicate on the network, they generally have to reply to ARP. So if Nmap gets an ARP reply, it knows that it's online. So here's a quick example I have here where I scan the same machine as before with the new Nmap and instead it sends one ARP at the beginning and then one ARP after a tenth of a second. And then it gives up in two tenths of a second. So it takes less than an eighth of the time that it took before. I can try and do a live demonstration here, which is always risky at a conference, but we'll give it a try. So here I'm doing Nmap, a ping scan. I probably have to make this bigger, don't I? Or can you guys read it? All right, huge we are. So I'm going to do a...what a mess this is. So I'm going to do a ping scan. PR is the new ARP feature, and I'm going to scan the wireless network that I'm on now with aggressive timing. And so it goes, it starts showing you the machines that are up and it shows you their MAC addresses. Right now we're only seeing one because I'm just scanning the short subnet, but we see that it finished and showed that Dell guy. Another tool that you can use to do this sort of scanning is THC Root. How many people have used that? It's a nice little tool by the hacker's choice. So here I'm going to do the same scan, and I'll make it huge again, with THC Root. And again it goes through, it finds the gateway machine, and it thinks and it thinks, but you can see that it's taking a bit longer. Nmap took five seconds and it took ten, which is no big deal, but on a large scan, having it go faster is a lot helpful. But it's worth noting that while Nmap may be faster, THC Root still has a lot of great things going for it.   Or can it? Yes, I'm pleased to announce that the new DEF CON version, yes, we've got the ASCII art for you, it's just not quite as violent. So that's ARP scanning, and another feature I added just for you guys is ARP spoofing. When you've been kicked off as many networks as I have, you start to appreciate the values of stealth and misdirection.  So with the new spoofing option, I did this at the hotel last night, I specify spoof MAC Apple, and Nmap looks through the OUI table, finds the MAC prefix registered to the company you specify, fills out the last three bytes randomly, and then you can point at the Apple guy and say it must be him. Thanks. You can also specify it, you know, in other formats, if you want to specify a specific MAC address, or just give another prefix, it'll fill in the rest, or just give it zero, and it'll give you a fully random MAC. And it shows you down here what MAC that it selected. So that's basically host discovery. As you can see, there are a lot of different options that you can do there, a lot of different things to play with, and by manipulating these different options, you can get much faster and more accurate results. Now let's look at another common scan, and that's single host discovery. Say a new vulnerability comes out in some product. You want to scan your network before the bad guys can and identify all instances of the vulnerable product. Or maybe there's a new worm going around, and you want to scan to find infected hosts before they can do much damage so you can quarantine them. Or maybe you're doing forensics on a compromised host, and you find that they've left a back door open on some unusual port. Well, scan your network real quick, and maybe you'll find other compromised machines that have the same back door. So here we're going to do an example of this, which is a little bit unusual, but basically covers the idea. Our mission statement is to locate web servers on the Playboy.com network offering free images. The idea here is that I was thinking, hey, you know, they charge $10 a month for their content or whatever, and I'm a cheapskate. Maybe they have a development server or a staging server somewhere where you can download all the images for free. You know, it's worth a try. So how are we going to do this? Well, first we need the address to scan, and that's pretty obvious. Just do a look up on Aaron for Netblocks owned by Playboy. The first one we get is this slash 20, 4,096 hosts. There are a lot more Netblocks they have, but for this example, that's enough for us. And so let's give it an initial try. We're going to do end map. We'll say don't ping because we're only scanning one port. The ping would take longer than the scan. The port is 80. Save the results in greppable format so we can easily grep out the open servers, and then we give it the network. And it chugs along and it completes, but it takes 20 minutes. You know, even for 4,096 hosts, that's longer than I want to wait. So how can we speed that up? One thing you can do is help by giving end map timing information that it is trouble getting itself. On a responsive network, on your local LAN or whatever, you can usually, end map is able to calculate its own response times based on the responses it's getting and usually optimize those pretty effectively. But when you're scanning over the internet on a highly filtered network, end map's not actually getting much responses. And so it doesn't really have a good idea of how long it has to wait before it can time out and retransmit. So the idea here is we'll try and figure out some of that ourselves, and then we'll pass that information along to end map. So I look for hosts on the network. First I try their web server, and I see that that's on a different IP, so that's no good. There are two different servers, and we lucked out there are two of them that are both on the networks we're trying to scan. Normally I might just take one host on the network, but here, you know, we don't know a lot about the network configuration, and also given the names, we can tell that this one's probably in Los Angeles and this one's in Chicago, so the latencies are likely to differ dramatically. So how do we figure out the latencies? Well, let's ping the hosts. But they both say 100% packet loss. They're blocking our pings. Well, that's a bummer. But, you know, they're mail servers, and so they've got to have port 25 open. So let's use HPING2 to do a TCP ping of those ports and see how long that takes. So we say HPING2, send a SIN to port 25, like we're opening a connection, send five of them, and we do it to both the Chicago and the LA networks. And here, the information you really want is not the fastest time, it's not the average time, it's the longest time that any of those pings take, because you want to be a little bit conservative here. If you try and get too aggressive, you'll actually make the scan take longer because NMAP will be retransmitting when the response is in transit. So even though the longest we saw out of these two was 61 milliseconds, you know, LA is a lot faster than I was scanning from California, we're going to pick a bit higher numbers to be on the safe side. So we're going to say the max RTT timeout is 200, so we'll wait up to a fifth of a second, and we tell NMAP to start out with 150 milliseconds so that NMAP will only go up to 200 if it needs to, and NMAP can still go faster if it determines that it can. Another optimization is to say scan in bigger groups. We're going to specify a minimum host group size of 512 that breaks up the 4,096 machines into eight groups of 512 and allows NMAP to go much faster by more efficiently handling them in larger groups, and the rest of the options are pretty much the same. So how long does that take? NMAP chugs away, and it still takes almost 15 minutes. That's better than 20 by a long shot, but let's be honest. When I'm looking for these free images, I'm not a patient guy. This is an urgent matter, and so I say, how can we make it a bit faster here? Well, think about what NMAP is doing under the covers in this case. NMAP, you may know, does reverse DNS resolution by default, and when I'm doing P0 scans, no ping, that means that NMAP is considering all of the hosts up, and so it's doing a reverse DNS resolution on every host. And reverse DNS, I'm afraid, is one of the few NMAP functions that's not yet parallelized, so that may be taking quite a lot of time. So I do the same scan, but this time I add hyphen N to get rid of reverse DNS resolution, and here we see that it only takes about three minutes, which is perfect, because that's about as long as I last. And so, by just manipulating these different values, we've been able to reduce the scan time from 20 minutes to only three. But enough about timing, let's look at the results. We did that big scan of 4,000 IPs, but we only found two that are open. Well, that was sort of a little bit worrisome, but you never know, maybe they're good ones. Let's take a look in Firefox. So we'll go to the first one, which is <IP_ADDRESS>, and we see Microsoft Outlook Web Access. Now, that would be really exciting if we were trying to break into their network, but it's not very gratifying for our particular goal here. What this does tell us is that, hey, maybe the network we scanned was the corporate network when we really should have been scanning the production network. It is nice to note their cute little Playboy Mail logo up in the URL bar. But all is not lost because we still have one more site. And I'm very pleased to report that that one has gigabytes of free images that I downloaded immediately upon download. In fact, I think I'll even show you. So this one is 142.135. And so here it chugs away, and we see free BSD ISO images right over here. We see Fedora images, lots of them. And if you're on the kinky side of things, they've got the whole Perl network right around here. So whatever your tastes, this is a great site to download images. And I would also like to mention this is also named mirrors.playboy.com, and it actually is a real valuable site that I use when I need to download. So we can say mission accomplished on that goal. But let's look at another quick single service discovery option. And that's NMAP's version detection. In many cases, you want to not just know what ports open, but you want to find out the exact service that's listening. And so with version detection, instead of browsing the well-known ports table, NMAP actually interrogates the ports and tries to figure out what's running there. And so that way you can maybe distinguish the vulnerable services from the invulnerable ones or find the services, even if they're listening on a non-default port. And NMAP now has more than well over a thousand different version detection signatures to identify all sorts of crazy things. In this example, this is just one that someone sent last year when my DOOM was basically causing havoc. Right when it was released, he posted this to the NMAP dev. Here's a probe you can add so that you can identify compromised machines or infected machines. So I'm just showing this as an example to show that it's actually pretty easy to add your own custom identification if you want to add services that aren't in the official file. So you just say, do a TCP probe. We'll call it my DOOM. These two bytes are the data that you need to send. These are the ports that it normally listens on. And you'll match for service my DOOM if you get this back in the response. The program is my DOOM. The number he just put, you know, the data was found in the wild. So that's a real useful thing to add. And to add it, all you do is add this little s capital V and NMAP does the rest of the work for you. So that's enough for single service scanning. Let's try something a little different that's also common. What if you want to defeat a firewall? Sometimes you really want to look at what ports are open on a machine, but those pesky firewalls can get in the way and NMAP has some techniques that can help you resolve that problem. So we've got another mission. This time we want to discern the open TCP ports on docserve.caldera.com. Now I was a little reticent about using SCO as an example because at one time they were kind of considered a threat to free software. But lately, you know, their litigation is in shambles and they're pretty much a laughing stock. And so it feels kind of like beating a dead horse. The problem is it's so useful because every time I want to find like really pathetic network configuration, you know, I can find an example right there. Also, they are a fun horse to beat, so let's do it. If we want to find the open ports, the first thing we're going to want to do is a SIN scan. You know, that makes sense. It's the default. It's often the most useful. So we do a SIN scan against the machine. We find port 80 open, port 5,507 open, and 113 is closed. So did we do it? Well, not really. Because while we figured out the state of three ports, the 1,660 remaining ones are in the state filtered. So we don't know if they're open or closed. It's worth noting that in a real scenario you would probably want to add hyphen p hyphen so that it'll scan all 65,000 ports. But just like with the Playboy example, I'm limiting it just to be a useful example. So we've got three, but there's still a huge number that we've not really determined. Those ports could be open and exploitable, those 1,660, or they could be closed. We just don't know. So what do we want to try next? Let's try a different type of scan. Let's try the fin scan. That basically sends a fin packet, and if it receives a reset back, the port is probably closed, whereas if we get nothing back, the port is either filtered or open. And this isn't true of all machines, since some of them aren't susceptible to this issue, but it's true of a lot of them, so it's worth trying. So we try it against Docksurf, and as you can see, we get a whole big long list of ports that are either open or filtered, and then the rest of them are in the state closed. So that's very interesting. It's limited the number of ports quite a bit here to just a few dozen that are either open or filtered, and one would hope that most of those are actually in the filtered state because it would be pretty pathetic to have that many open, but this is SCO, so you never really know. So how are we going to figure out, differentiate, because it's very important distinction whether the port is open or filtered? Well, let's try yet another type of scan against them. This time, we're going to try an act scan against Docksurf, and that sends an act packet, and if it receives a reset back, it knows that the port is unfiltered because it got a response, whereas if it receives nothing back or an ICMP port filtered message, it knows that it's filtered. And so this gives us a lot more information. Here, the vast, vast majority are unfiltered, but it tells us that just two of them are filtered. So what's an interesting thing you can do is combine those by looking at the last results and comparing them with these. For example, look at port 135. Here it says filtered, whereas before 135 was open or filtered. Well, if you kind of take the logical end of those, you see that it's got to be filtered. Similarly, 1434 looks like it's really filtered. Let's take another example. Say you want to know about the SSH port, 22. In this case, it says that 22 is unfiltered because it's one of all these other ports, and in this case, we see 22 is open or filtered. So if we have open or filtered on one scan and unfiltered on the other, that just leaves open. And so if you combine all of these different results from the two scans, what the hypothesis is is that 135 and 1434 are filtered, but all of these other ones on this huge list are open. And so that tells you a lot. And you can see a little bit of confirmation in terms of the two that we know are open to the SIN scan 80 and 507. You see here as well 80 and 507 in the open or filtered. So we have a pretty good idea about what we're seeing, but networks can be tricky. It's always good to check your results, try different things, see what's matching up. So let's try yet another type of scan. And that's the Windows scan, which is a little-known scan technique, but it's very similar to the ACC scan, except that it noticed a property that certain hosts have where when they send a reset back from a probe to one of their open ports, they set the window as they would if it was a SIN act for a real connection. Whereas when they're sending a reset back from a closed port, they set the window to zero. So by looking at that window, TCP receive window value carefully, we can determine which of the ports are open and which are closed. So we do an ACC scan against this machine, and sure enough, like we thought, all the ports are open except 135 is filtered, and I think 443 is the other one, or no, it was my MS SQL was the other one, 1434 was filtered. So that sort of confirms our results now. We've tried a lot of different things, and now we have a good idea where they're open. And it kind of shows the value of taking the SIN scan and seeing it doesn't get you all the results that you want, so you just keep trying different things until you meet your goals. So that was basically our three missions. And so now I'm going to just give a quick overview, since I've got, oh, about five minutes, of some of the new features that I have in the DEF CON version. There's the ARP scanning that we've already talked about, the MAC spoofing. One nice new feature is raw Ethernet packet sending, because raw IP packets can be a huge mess. You know, a lot of systems screw them up, and Microsoft, even worse, they recently banned them with their Windows XP SP2. So now we're saying, well, screw you, Microsoft. We're just going to send at a lower level and send the Ethernet packets directly, and that should be a lot faster. It also has 350 new OS fingerprints for a total of 1,690, from this ACC Amazon WAM concentrator to the Xyxcel Xywall. 250 new version detection signatures. So there are now 1,312 of those, covering 212 protocols, such as SMTP, SNMP, KAZA, all sorts of bizarre things. It integrates Doug Stong's excellent libdnet, which helps with the raw Ethernet packet sending. Version detection now helps you find OS information. So the version detection now can find three extra things in many cases. If it sees a service that only works on Windows, or if the service responds with a certain platform name, it can now report, and MAP now reports that next to the OS detection results. The OS detection results are this, and version detection says it looks like this OS. And some people would say, hey, combine those to get just one result. But in reality, what you really want is to have both, because they may be distinct. If you're scanning a firewall that proxies to an IIS server, you should get checkpoint firewall one or whatever for the OS detection results via TCP-IP fingerprinting, whereas it should say Windows for the application version detection results. And that's pretty common. You'll get the same thing if you're scanning, you know, someone's Linksys network, for example, where they've NAT forwarded different ports to different machines. Version detection also now gives a device information and host name information, which can be valuable. I broke the Windows support, I'm afraid, for the moment, but that may be fixed eventually. And when it is fixed, though, we'll have the advantages of the raw packet sending. But for the DEF CON release, I figured the priority was to get the UNIX versions out, and I've tested this one on Linux, OS X, Solaris, FreeBSD. And then there's also quite a few more features, which you can find in the changelog. What's coming next? Well, I'm happy to report that Google has sponsored 10 students to work on NMAP for the summer. And, yeah, they're student programmers, but some of them are serious students, like PhD students, in doing very relevant research. And so that's pretty exciting, and they're working on a whole lot of projects. There were 233 applications, and I picked the top 10, and we worked out some pretty cool projects. One of them is NCAT, which is sort of a re-implementation of Netcat that adds a bunch of new features that I've wanted.  There's a connection brokering feature so that two nut hosts behind a nut can connect into the Netcat listener, and then it brokers the communications between them. You know, all sorts of cool features, and you'll find a man page that he's posted so far on the NMAP dev list, and he's working on the implementation. New GUIs. And GUIs sort of sometimes have a reputation as, oh, this is just for newbies who can't remember those hundreds of NMAP options. But these are more advanced user GUIs. Things for, they're mostly results viewers. So you've scanned, you know, tens of thousands of machines. These make it easier to identify which machines have this port open or compare the difference between two scans and show me what's changed. You know, features like that. There's probably two user, two of these SOC students writing independent GUIs. Potential scripting language. I'm not sure if that's going to work out yet or not, but this guy is working on that. And when that is added, we'll probably use that for host discovery stuff. Information gathering, as opposed to, you know, trying to add a thousand different vulnerability detection modules will focus on, hey, have a script that does trace route. Have a script that checks whether a proxy is open. Have, you know, scripts for all these different things that it can look up once NMAP has determined the OS and port service version and such. Windows performance is a big priority. Also, I've been chugging away at my NMAP book, which has taken a long time, but I'm pleased to report progress. I've got more than 200 pages of it here now, and I think it's looking out to be pretty good. Given how slow publishing is, you know, it'll probably be six months, but I've added a bunch of cool network scanning goodies and corny jokes, so it'll be great. There's a hyphen hyphen reason option I would like to add so that NMAP can say, hey, we think this port is closed because we received a reset back. We think it's filtered because we received nothing back or because we received an ICMP port unreachable or destination unreachable message back. So that'll be useful for more understanding what's going on under the covers. And then I might add proxy and sock scanning. So that's basically my presentation, which is good because I'm about out of time. I'll just take two questions here if anyone has them. Yes, I'll put the slides. Yeah. Yes, docserve.keldera.com. No, right now I have the new version of NMAP up here at presentation slash defcon.13 and I'll put the slides up there shortly as well. Thank you very much.


LibGuides have a clearly defined structure. First, there is the guide itself. Each guide is made up of pages. Pages contain boxes. And boxes hold content like assets and rich text. LibGuides allow you to assign different roles to different people. In addition to full editing control, guide owners can assign subjects and tags to their guides, as well as change the guide type. These settings all help users find the guides they need. Guide owners can also choose the publication status of a guide, whether it's unpublished, private, or published. Published guides show up in our public list of UWM library guides, while private guides are available only to people who know the URL. Unpublished guides are not available at all. Only owners and editors can see them when they are logged in to the LibGuides platform. UWM Libraries assigns guide ownership to permanent staff so that there is always someone to make sure the guides remain current and useful. Interns can be given credit for helping maintain or create a guide by adding them as editors. Editors can add, edit, and delete content from guides that they have been assigned to. Editors should work closely with guide owners and get approval for the changes they plan to make.