So yeah, we're going to be talking to you guys today about a tool we've been working on called Barbecue Sequel. First we're going to talk a little bit about ourselves because we are narcissists. My name is Ben Taves. I'm a security consultant and researcher at NeoHapsis. NeoHapsis is a small pen testing shop and application security shop in Chicago. I do mostly network and application pen tests. And my name is Scott Barron. I'm a senior security consultant at NeoHapsis. A similar background has been doing app sec work. A lot of social engineering, pen tests, that kind of stuff and research. Alrighty, so we are here to talk to you guys, like I said, about Barbecue Sequel. Barbecue Sequel, it's a sequel injection exploitation tool. In some senses it's a new dog that we're teaching old tricks. Like I said, it exploits sequel injection. There's about a million other tools that do that. It's also though a new dog that we're teaching a new trick. It's stupidly fast, it's easy to use, and it gets those hard to reach spots. And we'll be talking a lot more about what the hell I mean by that. Alright, so just so we get everybody on the same page, and we know you guys all come from different backgrounds, we're just going to do like a really quick explanation of what sequel is and what sequel injection is. I'm hoping this will go pretty quickly. Oh yeah. And then we'll just get right, whoa. Sorry, dude. And then we'll just get right into it. So what is sequel, right? And I'm assuming most of you guys have probably set up a database at some point, or you write applications and interact with sequel, right? And it's a structured query language in which we use to interact with a database system. Sequel injection is when we inject syntax into the application sequel queries, right? And this is when we do all the fun stuff when we're doing, you know, application security assessments and that kind of work. So let's go ahead and walk through basic sequel injection, right? We got some pseudo code up here. Have the username Masthietti and the password secret, right? We kind of imagine this query is we're going to select everything from the user's table where username is the username and password is password, right? And so the query evaluates, and this is generic, right? This is database agnostic we're talking about here. So we have, you know, select star from users where username is Masthietti and password is secret. All right. So what does sequel injection look like, right? So sequel injection, we're trying to kind of break out of that query syntax, right? And when we break out of that query, or that query statement, we can kind of start to construct our own query on top of the query that the application is supposed to execute, right? So we have some more pseudo code up here. We're inserting in the value you name so we can kind of imagine like a web request, right? You know, you're passing in parameters and whatnot. So we have the username parameter and the password parameter and we're going to go ahead and pass in pwned tick or one equal one. There's a typo there. Basically, that's kind of going to, when you look down at the way the query evaluates to, you see that it kind of basically breaks us out of the way that the query looks. So if we step back and look at how the query should look, inserting that tick symbol allows us to escape out of the query and basically say, well, if the username is pwned or it's one equals one. And since one equals one always evaluates to true, we basically get access to the system, right? So blind SQL injection, which is what we're going to mainly be focusing on because this is the primary use case for our tool, is when you're still trying to alter SQL syntax, but you really can't see the results of what you're doing, right? So it's not like you're injecting something and something is getting displayed to the screen showing you what you're executing. You're actually more interested in other kinds of use cases, which will give you clues on if your injection string is working or not. It's a little bit more complex SQL syntax. It's not quite as trivial as some of the other SQL injection attacks that are out there. But the primary goal is still dumping the database and, you know, winning as much as you can, right? So let's take a look at the blind SQL injection case. And so we'll kind of walk through this and I'm sure you guys have seen this before, but basically we're going to do the same kind of attack we were doing earlier, but we're not going to be able to see the results, right? And so we're escaping out of the query with the tick and then we're going to do a substring, which I'll explain in a little bit what that is, to grab the user name. And the query evaluates to something like you see below. And the stuff in gray is commented out. The double tick, I'm sorry, the double dash is basically a comment character. And as you guys are being familiar with SQL know that there's a couple of different ways to terminate a SQL string. So let's go ahead and kind of walk through what the blind SQL injection looks like or what these components are. So you have a better understanding of how this works, right? So we're selecting star from users where password equals tick, and username equals. And then we kind of close out at that point and here's where we inject our code, right? So we're saying or the ASCII, which is going to take a character and turn it into an int, the substring command, which is going to basically slice this string, all right? And the way that works is it's going to slice the first position, so which happens to be a select statement. So basically what we're saying here is we're going to grab the first, we're going to first query the user object. And then you see the one and the one, let me highlight where that's at right here. We're going to grab the first character and we're going to grab one character. So we're going to select user, so let's say user's root, right? We're going to convert root, that first letter R into an ASCII equivalent, I don't know what R is, but, and then we're going to say is it greater than 63? 63 happens to be a question mark. If that happens to be true, we're going to have some different interaction with maybe the response of the web server. So let's go ahead and say that we're doing a Boolean-based blind sequel injection, and based on the status code of the server, we might get a 404 if we do something that evaluates to true, or we get a 200 if we do something that evaluates to false, right? So that's the thing with blind sequel injection. We're kind of trying to, we're keeping track of different objects of the HTTP request, things like the amount of time it takes for, all right, we have to do a shot here. Yeah, I'm sorry. It's to have gone tradition first time speakers, they have to do a shot. How about a round of applause for these guys? That's good. My eyes lit up when they pulled out the whiskey. So, yeah, so what we're really kind of talking about here is, you know, we're thinking about these different ways that we can determine if what we're doing is correct and incorrect, and we're not going to spend too much time talking about the different ways to validate blind sequel injection. But we're going to go ahead and just kind of move forward here to kind of explain where this problem arise and why we kind of even started working on a tool in the first place when there's all these other awesome tools out there. When you're doing blind sequel injection, there are a couple different ways you can kind of search through the data, right? And the way that the current scripts and tools work, typically it's some sort of binary search. That binary search helps you determine if your character is, you know, the right character and it logs in, et cetera. Tends to be one character at a time. Some of the tools out there have options to do multi-threading and whatnot. I think sequel map, you can do up to 10 threads at a time. But we kind of noticed that performance can be a little bit questionable and sometimes you might get some false data. And it's generally very time consuming, right? You're not executing one query to get the results you want. You have to execute multiple queries and you kind of have to step through all this kind of junk to get the end result. And like I mentioned earlier, there are awesome tools out there. Sequel map, awesome. I, you know, use it on many assessments, sequel ninja, the mole. They all have great features and they're sweet. But when these tools don't work, what do you guys end up doing, right? You kind of end up maybe coming up with your own query. Maybe there's some weird nuance where your requests have to be double URL encoded or you can't use ASCII for some reason or maybe some command that you think you should be able to run on a database server just doesn't work. Maybe the database administrator has made some specific policy or rule that won't allow you to run some of these kinds of commands.   And we're kind of thinking about what if there was a way where we could kind of take that process out of it. The whole part where you have to write these very customized scripts for when things don't work. And that's when we enter awesome artwork. We take some really tasty meat on the left and some like sweet looking IBM graphic of how databases look. And then we enter barbecue sequel, right? Yeah. So like Scott was saying, the point of the tool is to exploit blind sequel injection.  So for those hard to reach spots, compared to some of those other tools that we're talking about, this is not automatic. The point of the tool is not to find the volume for you. It's not to do your job for you. This is for helping you exploit something that you already know how to exploit. This is not a skittie tool. So in a lot of the benefits that we see from making you do a little bit more of the legwork is that we can be very versatile. We can be very database agnostic. So it doesn't really matter where you're trying to use it, how you're trying to use it. It's just performing the logic. It's performing the request. So you do have to do more legwork, but you get a lot of benefits out of that, the versatility and speed. We put a lot of work into trying to make this thing very performant. And I think we really did a pretty good job with that. I'm going to talk a little bit about the use of the tool. So like any tool that is going to be making HTTP requests for you, you need to specify what request you want it to make. So you need to tell it what URL, the HTTP method. That's the basics. On top of that, you can specify any other aspect of the HTTP request. A lot of the other tools out there, it's limited in what it will allow you to do. The way that we built the tool, it's sitting on top of a really, really cool HTTP library that I'll talk about a little bit more later. And that library itself is very versatile and we really try to leverage that to give you as much control as possible and to really build out the exact request that you're trying to make. So you can specify cookies, headers, encoding methods, what it should do if it encounters a redirect. If you want to do a multi-part file upload as a part of your attack, you can do that. HTTP authentication, basic or digest or what not. If you need to chain it through proxies, you can specify all of that. So in addition to those things, which most other tools will hopefully allow you to provide, there's a couple of other things that you have to provide. And this is when we start talking about it being more of a semi-automatic tool as opposed to an automatic tool. You need to specify where the injection is going to go into that request. So it's not going to find the volume for you. It's not supposed to find the volume for you. This is an exploitation tool. So you need to tell it where the vulnerability is, where it's going to be injecting the SQL logic, the SQL syntax into the existing request. Additionally, you're going to need to specify what that syntax looks like. This is what allows us to be database agnostic. For people who have worked with a variety of databases, there's a lot of syntax variations, which is kind of crazy because it's SQL, you know. But whenever I find myself trying to exploit SQL injection on an Oracle database, I have the hardest time because I don't like selecting from dual. If I want to select one, I don't want to select from dual.  I'm a my SQL guy, so I like the fact that it doesn't matter what the database is because you are the one providing the syntax. Once again, this is what makes it a semi-automatic tool as opposed to an automatic tool. And by the way, we made up that verbiage. There's no such thing as an automatic, like we made up the term semi-automatic. I hope that's okay with you guys. So yeah, that first part I was talking about where you specify where in the query, I'm sorry, where in the HTTP request the SQL syntax is going to be injected, where the vulnerability is essentially. I don't know if I can get my mouse. Yep, there we go.  All right. So right over here, you see what looks like a templating language. And that is because it is a templating language. I opted not to use an existing templating language. I kind of rolled my own because it was simpler for this. So here you see a URL, or here too actually. You see the URL and then you see this thing called query inside of this dollar sign curly brackets. So that is where the syntax, that's where the vulnerability is, that's where the SQL is going to get injected into the URL. But the cool thing is I was telling you how you can use, or how you can specify pretty much any part of the HTTP request. You can specify anything you want. You can also put the injection anywhere you want. So if you have some, if the vulnerability is in the host header or if it's in the user agent or if it's in a cookie or if it's in the file from the multi-part upload, I'm pretty sure you can even do injection in the HTTP method. I think that that would probably break a lot of things and probably not a good idea and probably wouldn't work. But yeah, so you use this templating language where you specify query with this in these brackets. It's kind of a templating tag and you can put that anywhere. So down below you see the data. That's going to be the data section of the URL or of the HTTP request. You can put it in there, in the cookies. One of the other kind of cool things that I tried to do and I got some flag from some Python guys for this. I made it so for specifying cookies and for headers, you don't have to write it out like it is in the raw HTTP packet because that's how a lot of tools are. You can specify it as a dictionary, like a Python dictionary. I know a lot of security folks are Python people so I thought that would be really handy because I really hate trying to specify in SQL map how I want a header to look. So yeah, as you can see here with cookies, like I said, they're exactly the same with headers.  Sorry. The fourth line down. You can specify cookies and headers as a dictionary and I think that's pretty cool. But yeah, the benefit of this, making you specify where the vulnerability is, is that the tool doesn't have to understand your data. You can be doing some totally bizarre serialization format, anything you want.  The tool just wants to know what your request looks like and where it needs to inject. So yeah, this serialization format, if there's some weird processes that you have to go through to make the request work, doesn't care about that. Encodings doesn't care. We'll actually walk through a demo later. Yes. Something we've been seeing very frequently on web application assessments is requiring HMAX signing of particular values and the URI. We've been seeing this more often. So we actually, we'll talk about ways to use the tool to do some of the more kind of advanced stuff that might be a little bit more difficult using some of the other tools that are out there. Yes. So yeah. And then the second thing that I said that you need to provide that you might not need to provide another tool is some of the SQL syntax. Again, here you see the templating language that I was talking about. So here is the, what is going to be injected into the spot that we were talking about in the previous slide. And you're going to need to specify a variety of things in order to make a blind sql attack work. Scott was talking a little bit earlier about how usually when you're doing a binary search in blind sql injection, you're going to be trying to modulate things like what row you're trying to select, what substring you're trying to do. So if you're selecting a user from the database, you're trying to grab the first character and you're trying to figure out what that is before you move on to the second and third character. So you need to use this templating language to specify where all those variables go. And we'll actually, when we do the demo, we'll step through pretty much all the tags that you can use when using the tool and how they work. So if this seems a little confusing now, it actually will make a lot more sense when we go through and run the demo. And nine times out of ten, you're hopefully going to be able to reuse one of these queries that we've already written. It looks a bit intimidating. I agree. I'm intimidated. But yeah, the benefit here, like I was saying, it's database diagnostic. So if you're using a database that isn't using sql at all, but you can still do a blind sql injection attack, or I guess it would just be a blind injection attack, but if you're using something with a screwy syntax, it doesn't matter. You just need to specify what the query is going to look like overall and where you can control these pieces of information within the query. So yeah, this helps you to not need to care about sql syntax, character limitations. It also can be useful for evading IDS and IPS because a lot of times, you'll see people doing, taking ASCII codes and generating their strings from that to, because of character limitations. So if you need to do that, you can do it. That's the point there. The other cool thing is if you need to do something really crazy, like Scott was saying, HMAX signing, I don't know any tools where you can specify that some parameter needs to have an HMAX signature. Let's say you need to do quadruple URL encoding. If you need to do something weird, we put in hooks. So you can provide your own Python that will, it's a method and it will be provided with each HTTP request before it's sent. And if you need to do something absolutely bizarre, you can specify that that needs to be done. And that's another thing we're going to talk about in the demo. We're going to give an example of the HMAX signing. And I think this is one of the really cool features about this tool is that it really allows you to totally customize things. If you need to do something totally crazy, you can do it. It's not our problem. It's not the tools problem. You just need to do it. So you need to know what you're doing. And there's multiple places where you can get the hooks at. So if you need to do weird processing on the response, you can do that too. Pre-request and post-request. These are all things that I'm borrowing from this request, HTTP library that I was talking about. We'll get into that a bit more later. Now I believe it's time for a demo. If anyone's still away. This is the chopper. What website should we try to attack? You think we should try to go after the NSA? I bet you can pull this out. All right. I guess we're going to try to take down the NSA. It's going to look pretty cool. All right. So let's see. What's their website? NSA.gov? All right. So here we have the NSA. Awesome. I'm sure there's probably a really awesome admin login for this website. Let's see if you can find it. We just ran Durbuster on it all day. All right. So look what we found. There's a file on the NSA.gov called sqlvom. Never expect that. Look at that awesome login, guys. It's crazy. All right. So basically the password for this user's secret. So we get a message when we log in. It says you are authors. These are one. Here are some secrets. When Ben types an incorrect password, we get a different response. And we're going to kind of use this as a seed for our attack, right? So we're going to conduct a blind sequel injection attack against this login form. And we're going to use the fact that the response sizes are different. And as you see Ben right now, he's kind of doing the or one equals one. He's trying to. Yeah. Good job, zoom in on that. Trying to. Yep. And now we're off to user one. So go ahead and do or one equals two. Bad credits, right? So now we have kind of a true and false statement. And we know that we can pivot off the fact that the response code size is going to be of a different length, right? So that'll be what we're going to use when we actually conduct the attack to determine if what we're doing is working or not. All right. So go ahead and do a little bit more of an advanced string here. Actually, I'm going to build this out in an editor. Excellent. Or I could be lazy and just use the one I wrote earlier. There we go. So we're going to go ahead and copy out a kind of a pre-built out string we've done here. This is very similar to the demo we walked to earlier, right? We're going to do a substring of the user and we're going to see if it's greater than the value of zero. We're going to comment out the rest of the query. Yep. So we're taking the first character of the username and looking at the ASCII value of that and we're trying to guess what that is essentially. Right. So this is pretty straightforward blind sequel injection. We wanted to keep the demo simple but you can kind of imagine that query string could be anything you could possibly imagine. We'll show you why that's the case when we actually run the tool. And the reason why I just copied something different is because that is a URL encoded version of that. So things like the hash character don't get interpreted as the fragment portion of the URL. Alright cool. So we know that we got our query built out and we know that it's working. So at this point go ahead and do it's false statement. So see here we're looking at the first character and if we say it's greater than zero, it turns out to be true because the first character has an ASCII value that's greater than zero. If we ask if it's less than zero, we get a false statement. It interprets as false. Cool. Alright so at this point we got our query built out. Now it's time to run barbecue sequel. And so I'm going to talk a little bit about the UI here. Basically this probably looks familiar. Anybody use the social engineering toolkit? Anybody? Okay. Handful folks. Yeah so Dave, I talked to Dave because I really like this UI. He said go for it.  Added a couple of feature improvements to make it a little bit more slick but this user interface gives you a really nice way to set up all the complicated request options that's here. And so we'll kind of go ahead and just walk through some of the different configuration options, some of the features of barbecue sequel that make it distinct and unique. So first let's go ahead and take a look at the barbecue sequel options. Step back. Cool. Alright so barbecue sequel has a following configuration parameters and we'll kind of walk through each one. Let's go ahead and take a look at query first. Cool. You guys see, is it okay or is it pretty hard to read? Working on it. Okay. That'll do. That's what we're injecting. Cool. So this is what we're injecting. So I'll talk a little bit about the template tags here and how this works. As I kind of mentioned before, you need to specify template tags for particular areas of the query that you want to inject in. And it's pretty straightforward here. We're basically saying we're going to do the substring for selecting data from data. And we're going to use row index, right? So row index is going to specify which row we're going after the data. Character index is going to specify which character position are we going after. You'll kind of see this notation that we have a print or colon and then we have a number. These are kind of the default values you want to specify. So we're basically saying we're going to start with row one. We're going to start with character position one. And then we need to specify our comparison operator, right? Typically you're going to want to specify the greater than operator. And then we're going to compare that against the character value zero. Once again, that's just a default value. So you don't need to be too concerned about that. There's a couple other tags that you can actually specify that we're not using in this example. Let's say you're doing a time-based blind sequel injection attack. And you'll see in the description here, we try to do a pretty good job with the documentation. You can specify the template sleep, for example. And then you can specify the number of seconds or milliseconds you want to sleep. So you can do time-based blind sequel injection as well. And one other thing that's important to note here, we're talking about how queries will either evaluate as true or false essentially based on the comparator value. So these default values, you want to build out something that's going to evaluate as true. And that way the tool can start to learn what a true response looks like versus a false response when it starts switching between the greater than and less than symbol. Exactly. All right, so let's go ahead and... So a couple other options we have here and we'll just kind of just walk through them. We have the CSV output file. So if you want to, you can dump all your results to a CSV. We can specify techniques. One thing that Ben was doing when he was doing the research for some of the libraries here was could we improve our exfiltration of data by doing a frequency-based analysis search. And in some circumstances we actually found that it was more effective. But in general, binary search is what we recommend using. Comparison attribute, you'll see when you actually click and take a look at that particular section. But you can specify. Go ahead and show that so they can see all the different options. We can determine if we're doing the injection correctly based on the following attribute. Status code, URL, time, size, text, content and coding, right? So you have all these things you can kind of cue off of. And the tool is intelligent enough to help you determine if those things are changing or whatnot. So let's go ahead and do size. Cool. And then one of the really sweetness things about barbecue sequel is concurrency. Ben will go into greater detail when we finish the demonstration about how this tool is wicked fast. But here you can specify the number of concurrent micro threads you want attacking the database. We're going to go with 75 because that sounds pretty cool. So one other thing to say about the comparison attribute. So this is what's changing when you switch between true and false. So if it's time, if the query takes longer to a value when it's true, you specify time. If it's the size of the response, you specify size. Just to make that clear. Cool. And then let's go ahead and take a look at the HTTP parameters. At a minimum, you need to specify the URL and the method that you're going to use. But as we kind of talked about earlier, you could specify any of these different attributes. You could specify data. You could specify if you need to provide off, basic off or something like that. So here you just kind of configure. And one thing we should mention is that if you enter something incorrectly, so let's say you're typing out a URL or some sort of value and you just botch it and you have like seven backslashes or something in it. We have these validator methods and we'll talk a little bit about that later. That'll make sure what you're entering is like actually well-formatted data. And that can be kind of handy when you're setting up a really complicated request. If you imagine doing that on command line and not really working very well and you're like what the hell what did I do wrong? Well here we're trying to check each individual component when your SQL command takes up the whole terminal.  Alright. Do we need to talk about this one? Yeah so in the URL you'll see that we're basically specifying the tag injection right? So this is where we're going to say, this is where we're going to inject our query into. The tag must be specified in some part of the HTTP request. As Ben mentioned earlier, it doesn't need to be in the URL. It can be in a cookie, it can be in a header. It could be in pretty much any part, any object of the HTTP request. So. Alright so let's go back. And now for the fun stuff. So let's go ahead and run the exploit. What it's doing right now is like I was saying, trying to establish what it means for a response to evaluate is true or false. Oh it's doing some test ones and then it asks you for confirmation. So yeah we're kind of seeing here right? We see this, the response size for the following is 3644. We can kind of tell that that's definitely different than 3602. And when we are kind of building out and testing our query in the first place by hand. This looks pretty good. So let's go ahead and fire it up. Alright so basically what's happening right now is we are at super crazy high speeds doing boolean based or binary search, blind sequel injection based off the size. So this is all data from the database. You see the number of requests in the bottom left here. Number of failures. We see how many rows we've numerated. We see the working number of threads. We see the time of the attack and the amount of characters per second. So right now we're averaging 38 characters per second which is pretty damn quick. And we'll wait until the tool finishes running.  Cool. Alright thanks guys. So at this point it dumps out all your data into a list object. A Python list. And you can just hop into your Python interpreter and start working with the data. So Ben's going to go ahead and just reformat it. Maybe print it out, clean it up a little bit. There we go. So it gives you the data right at your fingertips so you can start munging with it and formatting it the way you want to format it. Cool. Alright. Back to PowerPoint. Alrighty. So like I mentioned earlier one of the things that we really tried to work hard on with this tool is getting it to be very, very fast. There's two main things that we were playing with with this. The first is how we're making our HTTP route. So a lot of tools and I historically also have used threading when I needed to do many things at the same time. We're not doing that here. The other thing that I'm going to be talking about in terms of speed is the search algorithms that we're using. Scott touched on that briefly earlier. I'll cover it in more depth very shortly. So first the concurrency. I'm using a library called G requests and I'm sure not many people have heard of that. It's a combination of Python's G event and the Python requests library. First I'm going to talk a little bit about what G event is. G event is a coroutine based Python networking library that uses screenlets to provide high level synchronous API on top of the lib event event loop. Alright can I move on? Alright so I'm going to talk a little bit about what that means. So what we have is coroutines and you can think about coroutines as being functions essentially.  So this seems familiar if you've done threading. But the thing here is that the event or the process scheduling is much more explicit and we have much more access to that. So you're spawning up all of these functions, all of these coroutines, only one of them is actually running at a time. And what happens is that it runs until it hits blocking IO. And what blocking is is when you're trying to read and whatever you're trying to read isn't ready to be read. So for example if you're trying to read off of a socket, that's blocking IO. So if you have one thread and you're not doing any sort of event driven stuff, when you hit blocking the program just hangs and waits until it can read. So with G event though when it hits blocking it jumps to that next coroutine and then execution picks up there. And then as soon as that coroutine or that function hits blocking IO it jumps to the next one and then to the next one as it hits this blocking. And what you wind up with is what's called an event loop where you have something that seems a lot like threading but you're not actually doing threads. And you don't have a lot of the overhead that you have with threading but it's functionally like threading. And this is different also than a lot of the other event driven stuff. This is not callback based. This is coroutine based which makes it a lot more accessible to those of you who've worked with threading before. And what you can do though is because you have this ability to jump to the next coroutine when you hit blocking, you can have hundreds of outstanding requests. So you can make an HTTP request and then when you're waiting for the response, you're not sitting there waiting, you're executing code in the next coroutine.  And we get a lot of performance out of that. So then the other thing that GRequest does is it combines G event with requests. Request is a really, really cool library. They call themselves HTTP for humans. This was designed by Kenneth Wright. He's a really awesome API designer. He's written a lot of cool stuff. He's a great developer. I've had fun trying to contribute to this library. It's really, really nice. For those of you who are Python people and who've worked with URLib2, I really, really, really hate URLib2.  I'm sorry if whoever wrote that is here. I really doubt that they are.  But I hate URLib2. This really is request, HTTP for humans. It makes your life way easier if you're ever doing anything like this tool. So yeah, when you combine G event and request library, you wind up with G requests. So you're able to do good evented HTTP in Python. Which is a pretty cool thing to be able to do without much work. The other main thing that we're doing for performance is we're using different search algorithms. So when we're talking about how we're grabbing that substring and we're grabbing the first character of the user name and we're getting the ASCII value of that, what you intuitively might want to do is you want to check that value against each possible ASCII value. So this is what's called the linear search. It takes a long time. Here's kind of an example, hopefully that makes sense if it doesn't, I'm sorry. You're going one at a time until you find the right answer. So you're saying is the first letter of the user name, is it an A, is it a B, is it a C? Until you find whatever it is. The average case with this is N over 2. Best case is 1. Worst case is N. For those of you, I guess people who know what that means probably already know that. So the typical thing that you'll see with the SQL injection tool is what's called the binary search. Here you're still looking for that value. You're trying to figure out what the first letter of the user name is in the example that we've been using. But instead of going one by one, you take the whole space of possible values, you chop it in half, you say is it in this half or is it in this half? That's why we're using this greater than, less than symbols in the blind SQL syntax. And then you keep going down and down and down, cutting it in half and half and half until you find the value. And the performance of this average case is O log N, which is a significant improvement over a linear search. And that's by default what barbecue SQL is using. The other thing that we were playing with and it can be beneficial in some instances is to do frequency based search. I know some other tools have done this before. I decided to try it myself. It's fun. So what I did is I analyzed thousands of open source books for the character frequency. And what I found, which isn't surprising for anyone who's done any cryptography, is that the most common character in all of these books was the space character followed by E, followed by T, followed by O, followed by A. So here, when I was talking about the linear search where we're checking against one character at a time saying is the first character A, is it B, is it C, is it D? Here, instead of going A, B, C, D, we're going based on the likelihood that we're going to encounter that character. So we're going to start with E, T, O, A. And that's what's, that should be pretty familiar for anyone who's done any sort of cryptography. The other thing that I did to kind of enhance that a little bit is doing a diagram frequency analysis where we're not only looking at what's the most common character, we look at the last character we found and we say what's the most common character that's going to follow that. So the most common characters that are going to follow an E are an R or an N or a space. So instead of, and we try to factor that into the decision of what order we're doing when we're doing a linear search. So if you think about English, you know, if you see an L, you're probably going to see another L after that. That's the most common thing. So that's what we're talking about here. This is very, very effective against non-entropic data. So if you aren't looking at hashes, if you're looking at English, if you're looking at plain text, it's very good because there is that structure and that order and that well-defined frequency. So here with English, I was essentially dumping the books that I had previously used for generating the sample. About 10 requests per character. Python, which is a little bit more structured because it's a programming language, we see even better performance with eight requests per character. I think I was trying to dump the whole Django source code, which is kind of a lot, but I wound up getting eight requests per character, which is good. Credit card numbers, I got about 5.5, which is kind of funny because with a normal binary search, or excuse me, with a normal linear search, you'd expect to get five exactly, but somehow I managed to get 5.5. So not quite as good. Yeah, I kind of screwed that one up, I guess. Yeah, but when you compare it to a binary search with English, you get 12 requests per character, so you get a slight performance improvement. One other thing we kind of wanted to step through real quick was why don't you show the hooks that we're working on today? Oh, sorry, yeah. So yeah, before we were coming here, we were trying to think of, we added this functionality that we were kind of mentioned earlier that you can kind of hook into the request object to do really funky stuff when you're doing blind sequel injection. And one of the things that I came across on a recent assessment is that I needed to Hmax sign each request.  If you find blind sequel injection on that type of object, you can use the hook code that Ben will talk about here. Yeah, so like I was saying, we have these hooks so you can intercept each and every request right before it gets sent, or you can intercept the response right after it gets received.  So the way that you implement this, or the way that you use it with the tool, the way that you use it with the tool is that you create a file called BBQSQL underscore hooks dot PY in your current working directory. And if anyone can think of a better way of doing this, please let me know. It's hard to import in Python from arbitrary files like user defined files. If anyone knows a good solution for that, let me know. But so yeah, you have to make the BBQSQL underscore hooks dot PY. And then in here, you'll define your own functions. And for a request hook, you're going to have a function that accepts your request. And this object is from that requests library that I was talking about. And once again, if you haven't checked it out in your Python person, you should definitely check it out. So yeah, it's going to take the request object and then you can do whatever the hell you want to it. So if you want to grab the URL and you want to parse it, is what we're doing here. And then we're Hmax signing the query portion of the URL, grabbing the hex digest. Now I have an Hmax. You can put that back into the URL and then return the request. So now you just, you're Hmax signing every single request, which is pretty cool. Right, and we can do all sorts of things. Another hook file that we actually wrote was the quadruple URL encode. Now I've never come across that on an assessment, but sometimes you see double. Sometimes you see double if you're attacking an oracle database or something, right? So I don't think we have enough time to do the demo, so we'll just step back. Is that all for me? No. Okay. So I talked a little bit earlier, but the UI is basically built on the source for the social engineering toolkit. And I also mentioned that input validation is performed on each configuration option. This is really handy. At least we found it to be pretty handy because, you know, you're setting up these really complicated requests and things can get hairy pretty quickly, right? Especially if you're doing something weird. So by performing input validation on each of those objects within the UI, we can kind of help you or guide you along the way of you building out your complicated requests.  You can go ahead and export that to a configuration file. Reason to config parser library in Python. So it's really easy to work with. From there, you could kind of just go in, let's say you've built out this complicated request. You can kind of copy some of the configs and maybe all you're at this point just changing the query object, right? And as we also mentioned, you can also export the results as a CSV file. So in a nutshell, that's barbecue sequel. And you know, here's our credits and whatnot. We want to, once again, thanks Dave Kennedy for the social engineering toolkit stuff and being so kind, letting us use this awesome UI. And we thank you guys for coming and hearing about this new tool. And also, Neohapsis is hiring if you guys are in AppSec and want to talk to us. Come talk to us. We get a bonus if you come and work for us. And download the tool.


Hi, I'm the Navy football fan. I'll support and defend my coach in the plays run by my offense. I represent the fighting spirit of the Naval Academy and those who have gone before them to defend my side of the field in the end zone. I proudly serve my Academy's Navy football team with cheers, penance, and thumb fingers. From the USS Harry S. Truman. Go Navy! Beat Army! Go Navy! Beat Army! Hooray!


Hello from Norfolk and United States Fleet Forces Command. Congratulations and happy 70th birthday to the Steely Eye Warriors of the United States Sixth Fleet in Naples. As you synchronize your presence and posture from the high north, to the Baltics, to the Black Sea, to the Eastern Med, the sweet spot where you service three combatant commanders to the Gulf of Guinea. Take great pride in your leading role defending the nation far forward in this era of great power competition. I take great pride in leading ball tops, coordinated ASW in the Atlantic, Operation Obamagami Express in Western Africa, and when the nation called our DDG steaming for three days at 30 knots to deliver justice in the form of Tomahawk strikes into Syria. So again, congratulations and happy birthday. Remember, keep your cutlass sharp and power for peace.


My fellow Americans, April 15th is fast approaching, that dreaded deadline each year when we must turn our attention from jobs, finances, and families to the business of government and the taxes we pay to cover its bills. I'm sorry to tell you that many of those you elected to keep watch over government's expenditures and to keep your taxes down have been hard at work since we submitted our budget doing something else. They've been promising special interest groups not to save your tax dollars, but their spending programs. Let me give you some cold hard facts. If Congress doesn't enact a level of budget savings we've proposed, we'll add nearly three quarters of a trillion dollars in additional red ink over the next three years, a crushing mortgage on America's future. But that ocean of red ink will not result from a deficit of tax payments. Even after cutting your personal tax rates, the federal government still takes away about 19 cents of every dollar America earns and produces. The same as before we came into office. Moreover, reducing those rates has stimulated economic output and led to a bigger tax base and greater tax revenues than almost anyone anticipated. So if Congress wants to increase revenues further, it must put aside all talk of tax increases. Put tax reform on the front burner and reduce personal tax rates as low as possible so we can free America to challenge the limits of growth. With revenues rising faster than expected it's clear that the deficit problem is not a problem of taxes but of spending. But don't believe the drumbeat of propaganda that blames defense spending for government living beyond its means. Our bipartisan effort to rebuild America's defenses only began three years ago after more than a decade of neglect, while the Soviets surged ahead with the greatest military build-up in history, adding countries to their empire with the ease of a thief plucking apples off a tree. Fifteen years ago our combined domestic and defense spending amounted to only 20 cents on every dollar of gross national product, one-fifth less than today. At spending not then soared out of control, today we would have nearly a balanced budget, far less national debt and no threat to our current prosperity. But federal spending didn't get off the track because of defense. We're spending less on defense this year than my predecessor predicted he would spend in his last budget. We're spending less on defense as a percentage of the federal budget and our total economy than we did 15 years ago. And our budget calls for us to spend two cents less per dollar of the gross national product next year than we did in 1970. Spending is zooming for only one reason. The domestic budget is still bloated with waste and unnecessary programs. Even after adjustment for inflation, non-defense program spending has almost doubled since 1970. Maybe it's time you asked Congress some questions of your own. For example, why won't the Congress stop or cut back its $4.6 billion revenue-sharing program that disperses money to communities when the federal government has no revenues to share and local governments are in better fiscal shape? Why won't Congress stop subsidizing Amtrak, which costs taxpayers $35 per passenger every time a train leaves a station? Why won't the Congress stop subsidizing wealthy families earning up to $100,000 a year with thousands of dollars in annual student loan subsidies? Why won't the Congress stop subsidizing a few restaurants, bars, country clubs, and similar businesses with half a billion dollars in loans when every other small business has to pay the full market rate of interest? And why won't the Congress stop its export subsidies to a handful of corporations which account for less than 2 percent of U.S. exports? Yesterday, I invited the Senate leadership to the White House. We had a candid and constructive meeting, and I'm confident that we're coming closer to a meeting of the minds. We agreed that uncontrolled spending poses a threat to our expansion, and we agreed that we must face that threat together and face it now. For my part, I made clear that in further reduction in defense, vital weapons systems, either conventional or strategic, must not be touched, period. The deficit can and will be brought down, but not by raising taxes, which would just torpedo growth and make the deficit worse, or by gambling with America's security when the Soviet Union is every bit as aggressive, expansionist, and dangerous as before. Until next week, thanks for listening. God bless you.


Becoming Mike Nichols premieres on HBO 9 p.m. This Monday joining us is the director of becoming Mike Nichols Doug McGrath Thank you for joining us Doug becoming Mike Nichols is the story of a man who Did everything in show business started out as a comedian Headline Broadway with Elaine May became a director did movies He did everything No, he did he and he did it He did everything wonderfully You know, he just I mean maybe he only went into what he knew he would do wonderfully But I don't think so he he was an absolutely brilliant performer He and Elaine when people see the clips now, which is almost almost 60 years later They're so fresh and so wonderful and so true and hilarious That you would think it would be enough for him to have just had that career But then he went on To direct for the theater the first two plays he directed were two giant smash hit plays by Neil Simon He directed Barefoot in the park and the odd couple and out of that success He got into the movies and he his first two films were who's created Virginia Woolf with the Burton's with Richard Burton and Elizabeth Taylor and the graduate Well, I thought that's pretty good, isn't it? Yes. Yes, and that would be enough That would be enough for anyone's career to have that on your resume those things on your resume and then he went on to do, you know the birdcage and postcards from the edge and working girl and angels in America and His genius musical Spam a lot and his You know so many a wit for HBO as well He just was a person of a of a wide-ranging intelligence and luckily he had a talent that could support Where that intelligence led him and somehow found time to Have Diane Sawyer as his wife Yes, he managed to fit that in as well So becoming Mike Nichols, he was born in Nazi Germany and the family escaped Came to America. He grew up bilingual The family spoke German. He had a learn English Came home and had a translate for his parents What is the movie about is it about? Becoming the genius Mike Nichols and yes coming from the background it's about You know when you have a career as long as Mike's and as full as Mike's You can't I mean, I don't think it's wise to Do a documentary that covers all that because when you have to cover everything you have no time to really be on anything You know you're it's one minute on the graduate. It's it's a one minute on working girl because there's so many things So early on Looking at the footage and I know Mike felt the same way even though we talked about he talks with Jack O'Brien Who is his pal and who's in the movie with him? They talked about everything meaning all the work But the work that Mike really wanted to discuss at length in detail and with great enthusiasm and affection Was the early work and I thought he's telling us without directly telling us He's telling us that that's what he wants the movie to be and so that's what I made the movie be so that we could spend 20 minutes on Nichols in May we could give 18 minutes just to who's afraid of Virginia Wolf we could give 21 minutes to the graduate whatever each I can't remember how it each times out But it's a lot of time on each thing and what I hope will happen for the audience is that Rather than racing through everything and getting no real feeling for anything by the end of this you will come away thinking Wow, that guy is amazing. You know for people who know him. There's It's a it's a reintroduction to the things they may have forgotten I really wanted the film to go ahead work for people who didn't know him You know who so you give them enough time and they think God the Nichols in May stuff is hilarious Or oh my god that scene from Virginia Wolf. That's incredible, right? But you couldn't do that if you had to race through and touch on everything, right? Everybody knows Mike Nichols. They just don't know that they know that they know them They don't know they might not know that they've seen all these movies. Did you know them personally? I had met him a few times through the years here in New York, but I didn't know him You know, we knew enough to say hello But then it was only on this that we spent any real time together. He passed away. I believe in 2015, right? You know, I'm terrible about years, but I think it was actually 2014. I think I Know I'm friendly. It was November of 2014. Okay, cuz what I could be wrong. You know what I'm I'm name-dropping here. I'm friendly with Nathan Lane. I went to see Is it only a play is that the name of the it's only a play it's only a play and Louis CK it's the I never go to Premier's but Louis CK is there and he waves me over at the Premier and I See a beautiful blonde Main of hair and I look over and I go. Oh my god. It's He's talking to Diane Sawyer and Louis goes, I'd like you to meet Diane Sawyer and Mike Nichols. I went. Oh my god It's Mike Nichols and I literally said well, it's nice to meet you and Louis gave the introduction I told them who I was and I said, I don't belong here. I'm gonna walk away now But I got to shake and I remember it got to shake Mike Nichols hand And I remember it was like October of 2014. I Don't remember his dying that year. I remember thinking God I when he died, I thought I did get to shake his hand was it but I guess he died like no I think it really was it was near the end of 2014. Yeah in November. Yeah, and they knew he had been sick, right? I don't I honestly don't know people keep asking me this. I don't blame them. I would do but I don't know the answer he He looked frail well, how did you come about making this documentary? Was he doing interviews? Is no no no no no we he was always a part of this We we all kind of figured it out together and by we all I mean myself Frank rich the writer and producer and Jack O'Brien the theater director who's a great pal Mike and Mike we all met The idea kind of Jack O'Brien Jack O'Brien has something to do with it. It's only a play right? He directed it yeah, okay, and he was an old pal of Mike's and When he heard from Mike that Mike had given up the his plan to do his autobiography Jack was understandably upset. He thought oh my god That's a lot of great stories that are about to not go recorded and somebody should record them. So he mentioned To Alex which older writer who is Frank? Rich's wife. He said oh, I just heard the worst thing from Mike This is so upsetting and Alex told Frank and Frank is very close with the fellas who run HBO Richard Plepler and Michael Bartle Frank rich for those for the people listening to the show Frank riches Nathaniel riches father he is and that's one thing he is and I once stopped him on the street. I won't stop Frank Frank riches Unfortunately, he doesn't write for the New York Times. He's with the new he's with New York Magazine And he runs I believe V bright for a month. I'm on well He was he was for the longest time the theater critic at the times Then he was a an invaluable political past the times the best it was the best I couldn't agree more and he's not only the father of Nathaniel rich. He's the father of Simon rich and Simon rich and he Is a is a producer of VP. Yes. Yes, and our and Everybody should buy Frank riches book on George W. Bush, which I can't remember the greatest something ever sold. I can't oh, yeah Just go ahead anyway Frank You know new Richard Plepler and Mike Lombardo who run HBO and he said hey What do you think about a documentary about Mike and this is the great thing about HBO? They just are if they see it they're like well, they're now they're not like who are you gonna get to be in it? They're like Mike Nichols. That's enough. Yes, and I had done a documentary for them About Jerry Weintraub and oh wow, that was great Thank you, and we'd had a very happy experience with that So I think Richard or Mike suggested it me and Frank and I knew each other the tiniest bit And he loved the idea so he called me and that's how it happened But I'm saying all that by way of saying When the idea was brought to me I heard how it had come about so I always saw the film as a kind of Film diversion of Mike's autobiography. It was a way for him on film to tell the stories that for whatever reason he wasn't gonna write And so that's why it has the sort of intimate personal quality it has I didn't want and Frank agreed with me right from the beginning We didn't want other talking heads in the movie. We didn't want Celebrities and other people telling their Mike Nichols stories I thought we have the real item the real hot item is garrison keeler likes to say on the very home companion We have it. That's Mike Nichols. Let's listen to Mike talk about what he wants to talk about Where did his wisdom come from he went to the University of Chicago, I believe right? He did You know he came from a very smart family, too You know his father was a celebrated very successful doctor German they were German as you mentioned he came from a cultured family Either I think on his mother's side, but it could have been on the father's side But I think on the mother's side his grandmother was the librettist For operas including I think salami I forget which opera it was it's the best known But so he came from intelligent people to begin with and they knew to get out of Germany Yes, they knew to get out of Germany and here's a funny thing about how they got out of Germany in those years I think he came over in 38, but it might have been 39 In those years you couldn't To get into the United States, you know to be admitted legally to the United States in those years because of the depression You had to have an American sponsor who would agree in writing to support you for the rest of your life Should you not find work? Frank's father who I mean Mike's father who was a doctor and a successful person Came first he had someone signed for him. He came first and then he found work and Could then vouch for the family Mike's mother remained behind in Germany for a while She was an invalid but the two boys Mike and his brother were sent over by themselves when they were seven and four on an ocean liner and And it provoked one of the great stories of Mike's life of Mike's life of Mike's life Which was he spoke no English until he got here But he had to learn a sentence of English on the boat because he was so cute people kept coming up to him women on the boat Kept coming up to him and kissing him. So he learned this I speak. I don't speak any English. Please don't kiss me So he got here and you know I think the essential thing in his life happened when he got here, which was that he's seven years old He wants to fit in you know kids want to fit in they don't want to be like Outcasts or anything they want to be just like the other kids but to do that you have to figure out what Ian is what are the other kids like and That's where I think he developed his acute sense of personal observation about people He studied them to figure out why are you funny and why are what makes you smart and what makes you not that funny And you not that smart and I think he carried that skill into his his work as a performer because his work as a performer is very specific and and Certainly into his work as a director and being a director was what he always was meant to be It's what he was always meant to be but I'll tell you this I know many people including my friend Woody Allen who was a very precise and sophisticated sense of what a good actor is and If you talk to Woody about Mike one of the first things he always says is That guy is a great actor and he does not just mean a Sketch comedian though Mike was a brilliant sketch comedian. He means he was a great actor and yet what Mike says in the film Was he had that he certainly had that talent, but he felt that his stronger impulse Was to direct and he was not Elaine may straight man. In other words, he wasn't directing Nichols and may well Yes, no, but part of the reason they broke up is because that impulse was growing in him And he started he tells this in the movie. He started giving her notes and he said that really wasn't Doesn't make for a very happy partnership, you know, they come up together. They're they're great partners. They They're doing everything kind of as a team and then suddenly in the middle of their Broadway run He's passing her backstage and he's like, I thought you were a little slow tonight, right? And I think yeah And didn't she get bored with it was he did well talk about a person, you know, it's hard to be Smarter than Mike Nichols But I think if I was gonna pick anyone who might be able to be able to be counted as smarter than Mike It's Elaine she has a brain of such uncommon quickness, you know, you look at their sketches You're right. He is not the straight man. He is as funny as she is throughout But the level of her comic invention is just breathtaking and she became a director and a writer Yes, indeed and she directed. I think two of the all-time best comedies in the history of Hollywood comedies or American comedies a new leaf and The heartbreak kid, right? Oh, the heartbreak kid. Oh, I could talk about that for six hours. We better move on. Okay, and There was a great article In the New Yorker that I read it must have been 1999 I used to keep it in my desk. I don't know where it is. It's a profile of Mike Nichols He did suffer from Some Worries he worried about money. I remember this. Yes. Yes. I remember this. I haven't read this article in 16 years. He Was convinced all his money was gone and he would well temporarily. He was this wasn't always true That no and then he would go visit his accountant and the accountant say you have X amount of money But then he'd walk out the door and be convinced was down to zero the other thing that I remember from that article And I circled it and I always come back to it. It's a great quote and it's true Never tell anybody in show business what you really Want to do because then they know what to take away from you Well, that's very smart. Do you remember a project green light? Uh-huh. I Only watched the first episode of the first season the first incarnation and there's the poor guy Who's been selected as the project green light director? at a meeting at Miramax and He is talking to the studio executives about the film and he says listen There are a lot of things that can change But I'm telling you the one thing that can't change in this movie is that it has to take place in that period He wanted to make it I forget if it was the 60s or the 50s But he thought it was essential that it happened in that period and I got a sick feeling in my stomach as soon as he Said it because I thought okay. Well if we know anything, it's not going to take place in that period now They are gonna devote themselves to making sure the one thing you want goes away. Why is that? I don't know you can never I don't it's a perverse. It's a perverse business But he's right. And you know, Mike was very shrewd about how he played his cards like Jack Warner Wanted to be his friend when he was making when check Michael was directing who's afraid of Virginia Woolf Jack Warner kept inviting him to the house and Mike wouldn't go And I think Jack Warner wanted it to be in color and Mike Nichols insisted that it be in black and white and threatened That's right Well, the color issue was a defining issue for Mike Warners, I mean Jack Warner was insisting that the movie be in color because at that point in the 60s everything was moving toward color and I think he probably thought you know They used to resist color because it was so expensive But when TV kind of came into prominence and once TV start having color They really couldn't have movies coming out black and white. They felt they were gonna get left behind. So He tells them Warner says, you know, I'm sorry New York wants it to be in color and Mike is very funny on this subject in the movie But he said well, it can't be in color.  I'm sorry. That's what it has to be and Mike said the great discovery one of the great discoveries of his career was right then He said well, all right, if you want it to be in color you make it. I like it at home I'll go home and all of a sudden Jack Warner who was nobody's pushover said all right black and white and Mike said he realized right then A what his power was, you know that he had a certain amount of power by Threatening to to leave and he said you kind of that's the way the old guard was you just kind of went ahead and did it The way you needed to do it That's not to say people didn't try to change his mind his DP try to change his mind. I'm sorry the old guard respected somebody who Well, they allowed it. They per they grudgingly Respected it because they felt well. He's willing to stand up for for what he believes Did they take away? They were always willing to pounce if it if it if it didn't work Did he lose final cut on who's afraid of Virginia Woolf? Did he get fired at the very end? I don't think so. I mean, he doesn't talk about it. I'm you know, I'm I Don't think so. I think on who's afraid of Virginia Woolf. He finished principal photography He did like the first edit and then when it came time for the final mix Warner Let him go and then he discovered well, that's the way it works. You get fired and I think he came back I don't but to be honest, I don't remember. I think that's it. Yeah, I think I read somewhere I can't remember. I think what happened was He got fired and then was told. Oh, that's the way the old guard works You get fired from your own movie. You still get to be called the director But now Jack Warner is going to do the final cut and then either the sound editor or the editor would call him on the phone and run the the mix for him I And then I think Mike Nichols said I can't work this way and he called Jack Warner and said I'll Give up something. I'll give you all the money I'll give you all the money if it's not. Oh, I know what happened He was friendly with Jackie on asses Yeah, and they were worried that The oh, yeah that the Catholic League of D's at sea or something. Yes that they weren't going to approve of who's afraid of Virginia Wolf, he said I promise you when you screen it for the rabbis and the priests and the Cardinals and the popes Jackie on asses will sit there and give it her blessing if you give me the final cut and Jackie on asses came and Gave the film her blessing Right that that sounds familiar. Yeah, that that you know that sounds Not only familiar, but correct Very good story. We don't have it in the movie. I wish it was in the movie Very quickly you've been very generous with your time. I can't wait to see this movie I mean Mike there. I mean angels in America If you don't know who Mike Nichols is and believe it or not Well, you know, it's understandable people wouldn't know who Mike Nichols is you've just seen every one of his films Yeah, I mean people don't read credits. So there's right Jerry wine trout passed away. I believe around the same time. Yes There is somebody who Got exactly what he wanted in life is one of the things he got was Two women two wives or two women who love my two wives, but a but a wife and a girlfriend At the same time. Is that For a middle-aged man Working in show. Is that possible or is that what they just saying that for the movie? No, no, no, it's possible. I'll tell you what Jerry said because Once was talking to a teamster who had seen my documentary and said got the most amazing thing about him He has a wife and a girlfriend So I called Jerry and I told him that and he said give me the guy's number. I'll call him So he called the teamster and he said I understand you want to know how you get a wife and a girlfriend Is that right? Do you want to know that and the guy said, well, yeah, he says, all right Here's how you do it. The first thing you need is several hundred million So That's your first step Wow, that's a credit It was such a great guy. I really miss him He who was Jerry? What was he to explain because people haven't seen the movies I didn't know he was until I saw your documentary always rolling over in his grave if he could hear you say this he believed everyone knew him and He Jerry Wendrum was an absolutely sensational music promoter Who became an absolutely sensational? Movie producer But really his greatest product and he made many wonderful movies and promoted a lot of great music But his his greatest product was himself. He just sold Jerry wine trough above everything. I Knew no one I have never known anyone like him He was really a joy to know and to be friends with and Boy was that a blow.  I Miss I miss him because you know, we didn't speak every day, but we spoke a lot and Now when my phone rings, I have that thing of looking at it and thinking, huh It won't be Jerry These guys get do they get everything they want somebody like Mike Nichols. I mean Mike Nichols. I Don't think of him as for example a screenwriter Right, right. He wasn't so he wasn't getting up every morning compelled to put something down on paper even though He was a brilliant comedian No one gets everything they want.   I'm not saying people aren't happy You you and I'm not saying Mary and Davis. Wait, wait, Mary and Davis is clitoris. What does that have to do with? That's land. Oh, yeah, you know, there's Jesus the sled, you know, there's always That Mary and Davies clitoris though Well, that is a rumor I can't speak to it personally thankfully, but that's the rumor Well, but when he Alan I'm not talking about personal life, but I'm talking about just in terms of a career Woody Allen gets everything he wants Larry David gets everything he wants. Oh, well, maybe I'm misunderstanding what you're saying In your career, I mean they get they get they can do the work they want if that's what you mean Yeah, but then having been friends with Woody for years. I know that he's plagued by Even though he works all the time. He's always plagued by feeling he didn't get it right But it could have been better that it, you know Maybe next time it it might be better, but very likely it won't meaning this is him not me He feels there of all the films he's made I forget what the numbers up to but you know He thinks out of the 40 some films. He's made only six five six seven Came out the way he wanted He's not saying that the others are necessarily bad. What he's saying is that they whatever They turned into they weren't what he wanted at the beginning that wonderful moment where you think I know I have a great idea this would be a great movie and And then like any hall famously which obviously people love is not what he's favorite because he doesn't dislike it But he just thought originally he had such an idea that it was going to be this thing And for all kinds of reasons it turned into this thing and in his head when everybody thinks about it He just thinks yeah, but it's not that thing, you know the thing I first tried to get and You're friendly with Woody Allen. Are you able to? Talk to him without constantly thinking oh my god. I'm Talking to Woody Allen. No, I'm not I've been friends with him for 20 years 20 years easily and how did you meet him? I met him through My I mean I met him a few times in other circumstances But I really met him through my wife Jane who had worked for him for many years Although when we started dating she'd stopped or she wasn't still working for him But she had remained a very close friend of his and so I started being included when they would go to dinner so becoming Mike Nichols Monday night on HBO and the Jerry Wontraub documentary what other films have you made? Well, I've I would he and I wrote bullets over Broadway together. Oh my god Though he really wrote it, but I was very pleasantly encouraging throughout I wrote and directed Emma Nicholas Nicolby infamous And his way that Jerry directed Nicholas Nicolby. I did on Broadway No film. Oh, okay, because the Broadway play is still going the Wasn't that like the three-day? Marathon it was well, you could see it over two days or you could see it all in one day and uh-huh There is never I'm telling you it was one of most thrilling theatrical experiences I've ever had seeing that play.  Let me hear the other sore listeners. No, that's it. That's all That's it and what are you working on next? I'm working on a new screenplay Slowly slowly making my way through the fog. Okay, and did you work on the Broadway play bullets over Broadway? I didn't I was just what he did it himself. I was just a friend of the courts so to speak I came and saw how wonderfully he and Stro Susan Strowman had had done it. What what is I you've been very generous with your time But what what is it? What is it like to write with Woody Allen? We always think of Marshall Brickman Right sitting with him What what what is the process the thing that was so great about working with Woody is that he did not at any point though, he could have at every point Lord over me his Vast artistic and intellectual superiority. I was so impressed by how He really you know the only point of a collaborators to get us another point of view so he was always genuinely curious that I Share my point of view that I'd be honest with him if I thought an idea wasn't good. I learned so much from him to about How much he respected the audience in terms of you know, studio executives tend to be afraid of the audience They're always like oh you can't mention you Gino Neal the audience won't know that Woody doesn't care about that But he what he does care about is that the audience is engaged and he's always talking about well if we do this scene It's kind of repeating what we did earlier The audience will get bored. They're not we don't want that he's very alert to Making sure that at all times, you know, the story was moving forward And I was so impressed with his kind of ruthlessness in cutting, you know and making sure that it wasn't Repetitive or or too long because he talked a lot about how he felt each idea had a certain amount of time an audience would sit for that idea You know Rick Santorum the senator who just went to Hollywood and became a motion picture executive for some Christian organization and I never Understood why he thought he could make movies because the key to success in movies is killing your babies and What did you learn From making this documentary about Mike Nichols, how did you become a better director? Listening to Mike Nichols. I'll tell you the story. He told that really impressed me Unless I've already told you this I hope I'm already told you this about the country girl. No he directed a Broadway production of the country girl in The early 2000s so late in his life and late in his career. He had one. I forgot nine Tonys or four Emmys the Oscar, you know, what? a Giant in the business and for whatever reason that production didn't work. It was pretty widely panned and Mike said that when he you know the reviews came out. They were pretty devastating The business wasn't good and when the show closed That day he came home and he took out a yellow pad and he wrote like eight pages of notes About what he felt he'd done wrong.  He could have blamed somebody else He could have put it on the cast whatever it was he could have found a way not to face it and If you have a career that lasts as long as his and you have the success He has you have to face it whatever it is good or bad. You have to face it so you don't keep making Mm-hmm that mistake and I was particularly impressed with it because of his age at the time It's one thing to do that when you're 22. It's another thing to do it when you've had every award in the world and you're In your 70s, right? What is the what is the secret to longevity because I know that Mike Nichols Are you there? Yeah, I'm here He was not a fascist. He didn't believe in the auteur theory He didn't like the this Andrew Saras the film critic for the village voice had this idea that every movie you see is Has to be filtered through the zeitgeist of the director You don't understand a movie unless you understand the director and he maintained that wasn't true that it was a purely Collaborative effort is that the secret to longevity does somebody even like Woody Allen who is I think is the ultimate Autour if such a thing exists it does even Woody Allen think that it's all collaborative Well, I can't speak for Woody, but I Think there it's an interest the Saras theory is a very interesting theory and I think like many things sometimes It's true and sometimes it isn't and Woody is definitely an auteur and you're when you see a Woody Allen film. It is entirely filtered through his sensibility, but that's because Not only did he direct it he wrote it and he is a very Active director in terms of every aspect of the film. So what you're seeing is the full expression of his taste and intelligence, but you know when you're directing somebody else's script and if you're Often directing different people scripts all the time I'm not sure that person is an auteur in the in the way Saras means me meaning Then what Mike says is right Because the director is taking that it is passing that script is passing through the director's Filter so to speak But it was still the author some other person authored that script and wrote those lines. So To me the author theory gets a little wobbly there One could even suggest that the producer in some situations could be the author because it because it becomes a reflection of your taste Less than your Your actual work, right? So what well, okay, go ahead. Go ahead. No, I was just gonna say they're very very very few producers Really, I can think of David Osel's Nick, but almost no one else who in any positive way could be considered The auteur of the Harvey Weinstein. Oh, no, no, no No, because he recuts things if he But then he when you're recutting someone else's work or when you're making another person recut his or her own work That's not auteurism. That's sort of a kind of tyranny, but it's not there's nothing artistic about it right, what is this so in terms of log just in terms of all your friends and What do you think is the secrets of longevity? Do these good? Do these guys worry about their next job or Do they when I think the secret to longevity I think is They're always looking forward. They're always going forward they All of them everybody has flops and hits well not everybody has hits But everybody has you know, the most successful director in the world Steven Spielberg There are there are flops on his resume. There are movies that didn't make their money back Or there are movies that didn't get well reviewed. He never stops working all of them the people that really last just keep working and I remember a wonderful thing. I read that Nora Efron said she said, you know I get so tired of my friends who are screenwriters who complain that they they're not getting their screenplay made They're not getting their screenplay made She said so I always think so write another screenplay You know, you you have to be so careful not to get caught up in something if it didn't work Because sometimes something doesn't work at the time and then it's later judged to be wonderful The key is keep writing keep directing keep keep turning out Whatever it is you want to say you have to keep going last question nor Efron Woody Allen Mike Nichols did they fight with people these are these are people who have a storied career These are people who just kept working. Do they fight with people? What do you mean on the scepter in yeah? Yeah, well in business Are the do they are these the kind of people who held grudges and said I'm not gonna work with this person Or you say they move forward and they don't look back Well, I didn't know Nora well enough. I knew Nora just the tiniest bit You know Mike in my film talks about how sometimes He didn't get along with the crew or sometimes he and his DP would squabble But you know say you have to if you're a filmmaker your only job really is to make sure you get the film you see in your head on the screen and Sometimes you have a crew and a cast That are united in their support of that goal and sometimes for whatever reason you get a DP who has a different idea or an actress who thinks she has a better idea, you know, you just get people who have their own ideas and Then you're confronted with how you deal with that and sometimes You have to fight sometimes you have to fire that person, you know, they're all different ways around it but the ultimate thing you have to do is make sure that Your vision of what the material is gets on that screen and sometimes that means Fighting with someone and sometimes it means Letting someone go that's tough, but in the end as Woody always says What's the point that you know all that lasts all that remains is the film itself the arguments on the set That all goes away all people have at the end of it is the film So you have to do everything you can to make that Great fantastic Doug McGrath is the director of becoming Mike Nichols and premieres Monday night on HBO. Thank you so much for doing this. I know you've got a lot of interviews to do Thank you. It was a pleasure talking with you. Thank you, too. Okay. Thank you, Doug. All right. Bye. Bye