I'm going to talk about a framework that I've been developing over the past couple of years. At least when I have the free time to develop it, I've been the sole developer on this project since it started. And it's kind of my contribution, the open source community. I'm very passionate about open source development and believe that it is the right to everybody to be able to have this knowledge and share that knowledge because knowledge is the freedom of man. And we want to get that out there. And if I can get something out there that inspires someone else younger or someone new coming into this field, that they can go from, or they can take it a new direction just by sparking a new idea, that's my goal. And that's why I love to produce some off-sex software in the open source community and what gives me my passion for continuing our involvement in InfoSec. You can find me in all of these channels listed. I run the hack all the things on FreeNode. It's a very basic IRC channel based for pen testers. There's a lot of really good guys there. And there's a lot of new people there. And our involvement is we didn't want a, or really didn't want to have an IRC channel that was based solely on a project because there's all the ones we see are project-based, set, menace, B, whatever. They have an IRC channel for hacking and it's based on that project. While we will support N4P and Pen2 as things are developed from Pen2 and I like to work within that community and help develop for Pen2, we just wanted to leave it open to help out but you can always get any information you have. Don't feel free like, oh, I don't know enough to be there. You do, we want everyone new and just to enjoy the experience of this community and be able to get with the right people in the community right away. The GitHub is where you can follow my live builds until they get pushed down, until I release a new copy, a stable or unstable and it gets pushed into the Pen2 repo. So you can watch live builds and anything that's going on and talking about is in my blog at WordPress. A lot of us talking about what we're doing with N4P and where it's going but now that N4P, the SDLC I feel in this project is really starting to come together at a sound position. So we're gonna actually start doing a lot more training and tutorials on that blog so you can catch some great attacks and new attack vectors that you can utilize not just with N4P but in pen testing. So my vision through my development cycle has been how do I feel void or things that I miss? They're almost solely based on while I'm on engagement, pen testing, what do I see is wrong? What's taken me too long? How can we create a scenario that we can perform our job more efficiently and effectively and produce a better product for our clients or whoever we work for at that time? The second portion is I like to be a functional developer by that way I make that software functional but how do I feel void? If I see a void in the industry we want to fill that void and I did not see anything within InfoSec right now that covered the layers and the attack vectors that we were going to do inside a framework structure. That's why N4P started to be created or evolved to what it was. So as far as that handles and thinking about it like there was nothing in the wireless space and there was nothing in the low level space. Like we have Metaspoly and that really covers everything on the ISO level from like five to seven. That doesn't get us down to our infrastructure level. When we have set covering our social engineering and we have grown to really rely independent like these tools because they hold everything together into a nice package framework for us to search, build from and it allows the community to contribute with new ideas and modules based on their research and proof of concepts. So that was actually a goal design that I had in this project. It's gone a lot further into becoming a full-blown framework and because of that the community can get involved now and create modules of their own design and use them through this framework. That's why my mouse wasn't working. So the original proof of concept was far beyond wireless. When I decided to come up with a proof of concept for this project it was based on sales exchange vulnerabilities POCs or sales exchange vulnerabilities. I wanted to see what I could do with a lot of point of sales services and circumvent the security that's in place by PCI because I don't really feel like that's an effective model. It's pretty broken and they're trying to secure things at each endpoint. So it was designed to make man and middle attacks by utilizing the infrastructure hardware on our systems creating, bringing up a switch and then just stealing lines at a POS terminal. And then we can control in the firewall settings what packets were allowed in and out. That way we can be completely incognito on the system gather packets forward by never changing any MAC addresses and then adjust ours on a different interface. Nate will clone their MAC addresses and then we can do packet injection through Scapey after we've modified what's in. The scenario for that might be if you went to a point of sales terminal and sniffed what was going on and you put enough packets together to figure out how tickets were printed the table numbers, the food, and to what printer you could just, you know, you could just push that. You can, sometimes you can flood the printer with Ncat and Ncat flood that or you can use Scapey and change that packet and send it over. And basically what would happen is a receipt would print in the kitchen with a table number and then go on the service on the line and someone would deliver to your table and there would be no track record to pay for. So you've exfiltrated free food. If you're ever hungry, you can do this or go further than that and think about, well, can we assign any information back to the database back in a lot of places you use like QuickBooks? Is that information secure coming across the wire? If it's not, it's gonna be using SSL more than likely we can run SSL strip right from where we're at because that tax vector is built in. The firewall controls for controlling the port forwarding are also built in. So now we can maybe even think about injecting us a paycheck through their QuickBooks. It goes through payroll properly. It would take a lot of investigation and get down to it. So these are some more exploit vectors and attack structures that aren't thought about within the PCI model and shows why the information's broken and the ways that we can have fun exploiting it that we couldn't exploit based on saying application processes to metasploit because we wouldn't have that. So I started this project and this is pretty much my theory how it went. I start writing this code. I automate process. Exfiltrate all kinds of great stuff and have a lot of extra free time at work to go snowboarding because it's all automated now. The bottom is what really actually happened during this project. A lot of bugs and then it became an ongoing development. I've yet to go snowboarding or find any free time. But it's okay because when I started this I saw that the potential would more likely make me feel like I could add some more leatness to my name in my handle and I could kind of look like Boris and think I was completely invincible and everything. I promise you guys there's no cat pictures in this slide. Don't worry.  Rick, did you put cat pictures in my slide? Hackers. So I don't have 99 little bugs in my code and I got rid of some. Then I had 127. So the past two days I've been in the con completely just writing code. And I think it really got at a great place down. We can have some real fun with it. The reason the bugs happened was, most likely I was watching Swordfish and you can understand why the bugs got interjected and the exiltration process. Now let's try to understand why this framework is so much different. What we're gonna be looking at is on our OSI model of how N4P controls our system state. We're gonna be operating mainly between layers one through five, but more often two through five. So we're not really concerned about the application, the presentation layers or layer seven and six, which is where most of the frameworks rely on for exploitation for web exploitations and general expectations through metasploit. That's its main concern. So we're creating a framework that is designed in an entire different OSI level that we're not seeing yet in the industry. So if we can get this to keep going and taking off, it opens up a whole new level of attack factors and thought processes that companies can use internally for internal penetration teams or for a lot of vulnerability research processes. This is great because why we're controlling network level adapters, the softwares can also dictating how the firewall configurations are based between the structures and attacks that we need for different OSI based attacks or OSI levels that we're gonna participate in that attack. It also allows you to control like SSL strip and Ettercap and you can adjust the options based on the configurations for whatever type of work and reconnaissance you're doing and then if it's gonna be very incognito or not. But because of what we had laid out because this is the main concept as I was creating the POC, I really found that this was very vulnerability research and niche, it was difficult and it's very hard to constantly manage your states, bridge in the adapters, which N4P does, it will bridge everything for you. It can call a VPN that you have predefined and pull things to the VPN and route it through the firewalls all automatically as well. So the process of us remembering all the commands of everything all the time and then typing it up, bringing it down, changing the interface, bringing it back up, setting the IPs and the routes is very daunting. So we wanted to cover that for us and get that done. Now I looked at it, what can we do from here? What is also really awesome that we can deliver and fund? And I can get people interested in using these products. And the answer was wireless. Wireless is based initially on these layers, one through five and controlling the access points, spoofing them in the MAC addresses and how we're gonna capture packets and crack them. So I was like, okay, let's start and implement it. And we slowly started implementing, it's first started with WPA2. Well, we got some extras. And why don't we take a look at what type of attack vectors you could expect that is built into this framework already from the start. Based on the lower level of the OSI models that we're gonna do, we have packet capturing injections, we can circumvent SSL. Now that we are ran in the middle lane, most of these situations, we can control our DNS servers locally. We can spoof DNS, we can redirect people. And through that, that means, hey, I can spin up a coffee shop AP and I can run in my own DNS server and forge Facebook or make when they go to Facebook, come to my 127 because I'm running a patchy local service. I can even get a cell sign cert like a third party CA cert so that you don't get as many error messages or people think that it's more secure. There's a whole lot there in that realm that we can control and have fun. We can set up applications for beef hooks and go after more application exploit levels. And then because we also have that wireless ability and we're bringing that wireless point, you can't bridge a wireless adapter, but if you put it in a monitor mode, we can bridge the AT0 interface with like our E0 interface or WLAN interface that we can bridge WLAN, sorry, our E0 interface that we have internet from and we can redirect it either through bridging and then run a VPN to that if we want or through packet forwarding. And N4P knows how to set all those things up automatically based on the configuration structures that you set. Now, if we're not gonna run that way, we can go a little bit further in our wireless attacks. We can crack WPS built in, we can crack WEP, WPA2, EAP Enterprise or the WPE, which is the TKIP Enterprise. Those are used in the host APD. We can crack WPA2 through Airbase and we can also choose to bring up that basic access point through using host APD if we rather prefer that or Airbase if we prefer that. We have all the attacks at our disposal between that we can possibly do with host APD and Airbase. A lot of those attacks are already built into modules that I've given you, but I like to encourage anyone if they have a different way of doing it, they have another module structure that they find usable. There is an example module packed in the software that you can use, look at it and say, hey, I need to add a few variables. This is the code that structure I need and copy it into the modules folder of M4P. And now you have produced a new module for whatever engagement you found it useful. Then you can contribute that to the community and everyone else can start using that as well, which I think is what's really gonna set things off and make it fun. The great thing about the structure of how the modules work are they are not language dependent. M4P is written solely in bash at the current moment, but you could write your module in C, Python, Pearl, bash, whichever you choose. As long as you follow the configuration structures and parse that information the same way that we are doing it, it'll work. So let's take a look at what we're gonna see when we open up M4P initially. There's two modes. There's a basic mode and there's an advanced mode. And the basic mode is I have set up several options and abilities that you can just press one key and it goes ahead and completes the whole process without you having to do anything else. And then the main things there, like capturing or sorry, doing recon scans of the network, finding the MAC addresses of the stations and the SIDs of the network we're gonna attack. Then we can dump that in, we can use like air dump for that information for capturing the handshakes just by running option three in this case. And if we change our attack vectors, it could run wash and bully if we're trying to crack WPS. Those functions are right there and I'll show you how you set that and for differentiates between that. We can just go ahead and bring up a basic access point right here with hitting one button because the configuration file already knows where we have our host APD config or what we're gonna be setting up with Airbase.  When we go through the configuration structures, the firewall browse looks through your environment setups saying what type of attacks am I doing? What type of interfaces am I using and what am I gonna be doing with them? And then allows the rules to be used just for those. It initially drops everything and then allows just those rules. So while you're performing these attacks, you are also securing your box behind a fully staple firewall. You don't have to always hack naked now. We can de-auth everyone right from here. We can start like SSL strip if we want at any time. We can start at our cap at any time and we can arc the network at any time. And all these functions are built a part of or they utilize the adapters that we have predefined. And we'll move into that in just a little bit but I just wanna give you an overview of what the interface is gonna look like when you initially start N4P and what to expect. N4P also uses a temporary file called temp N4P. So any type of information while we're doing a wireless hacking capturing doing cap files or capturing the handshakes or catching IVs on WEP web encryptions. It's gonna save them in this log file based on the client's MAC address that you are attacking as we see the MAC address dot cap. There's also recovered passwords and logs. If anything's going wrong, there's logging available. And there's also verbose logging available that UAU can get more log information if you're debugging during the process that it will provide. All right, this is getting pretty complicated. As we can see the project has evolved and it covers a lot of attack surfaces and these attack surfaces, they really aren't simple. They do take a lot of experience and knowledge and fighting. So I tried to keep things real easy but I didn't wanna make it script kitty. I wanted you to still have to have an understanding of what you're doing. But because we've added so much functionality the configuration structure has gotten pretty intense and I don't have a way of fixing that yet. So it's gonna be hard to see from here but this is our configuration file. And I'll try to give you an overview of what you're gonna expect in this configuration file. I really need a laser pointer. All the way at the very top box that we have separated I try to separate things in boxes. This is to designate what type of operating system we're gonna be rerunning on OS is Pentu. Right now we're designed to work on Pentu because we utilize the open RC init system. Eventually, you know, there is some functionality that will work in Cali. So you need to change that option as it will say options available to Cali. And then it will know how to handle the interface structures through the init system. Network manager manages and network interfaces. You are a wonderful man. All right. Comfy mode. All right, if you're familiar network manager it can manage your adapters and interfaces in X environment. It's really good and it's really cool for the sense that it can manage keys. If you have VPNs, it can handle the key structures for you. You don't have to type your 90 character password in there. If you're as paranoid as me, 90 characters. In the interface that we're launching and for PN as we said, there's basic and advanced mode. You can switch these at any time just by typing basic and advanced in the software. But we initially started as a basic out of the box. If you're not using network manager you can just set that to false. It's not needed, but sometimes I found that it picks up on wires cards that I couldn't get to initiate. It just picks up the module. But there is also a lot of issues it's caused and there's a ton of redundancy checks and loop checks in N4P that does everything it can to try to recover the system states when network manager borks about 95% full-proof. Then we have our wireless options. This is considering if we're just gonna run an access point for ourselves, what type of options are we gonna use for it and what are the base configurations for that? And we can use host APD or airbase and we're defaulting to using airbase. And our main interface right now, iFace zero is ETH zero. This is our interface that we have like our internet connected to. That way if we spin up an AP and we do the port forwarding for people to connect to and do the DHB assigning, it will forward it through that interface. That's how the firewall tells us what interface to use. If you're using WLAN one, you would change that to WLAN one. All right, iFace one is the next one. That's the interface we're using for our attacks. That is the main one we're concerned about when performing an attack. Now, if we're gonna spoof anything, because we can control the ESID or the SSID, whichever you're more familiar with, the name of the access point that's coming up right there, we named it pen two, one. If you just bring the access point up, that's fine. But if we're doing an evil, evil twin attack, we want to make that the name of the SSD or the access point that we are trying to impersonate. This is the channel. That channel equals channel one, throw 11, add the channel that you want to be on. That's also important if we're impersonating. And then there's monitoring modes. Monitoring modes, because we can custom monitor or monitor who's connecting to us. So if we're just launching an access point to see who's coming on or what needs SSL strip, if we have monitor mode enabled, there's an interface that'll pop up and track the IP addresses of everyone who connects to your access point. This IP range is held in a DHCP file that's provided and when we call DHCP, it calls that particular confile and gets your DHCP lease range. If we want to cause bridging for our interfaces, if we're gonna do multiple ethernets, like we have a switch and some USB ethernets, we plug them all together like we talked about if we're doing some POC stuff on point of sales exchange, we can say that if we're gonna bridge true the name of the bridge and if we're gonna use a VPN in this process, all right? Likely that should be false in those scenarios. Before we do anything in type attack, we need to go through and familiarize yourself with what you're gonna type of your attack you're doing and how to understand the configuration file. We're not bridging, so we'll make sure that's false on your setup. Now let's get into like some really fun processes of hacking and attacking wireless networks. And this is where the fun comes in here. We can see our attack options are set for null, which will bring an access point, handshake attacks for WPA2, if we wanna use karma, if the attack's gonna be using SSL strip, if we're gonna do a WS attack, WPA attack, or EAP attack. So under attack, we just say what we're gonna use. And this, when we launch the situations, the environment or N4P knows what configurations need to be set and what flags can be called within Air Base or host APD as well as within the firewall based on what you choose. Now if we're doing a handshake, which is one thing where we will be doing the panel, our attack for that is handshake attack is Z for WPA2, right here is Z. And then the encryption type for that is for CCMP. So our encryption down here is gonna equal four. So when we do our recon, it's gonna tell you on the access point we choose what encryption is using. So we just need to adjust for the encryption we're using. And then we're gonna copy in that victims VSSID from our recon as well as their station. That's gonna allow us to do our WPA handshake. If we're on an enterprise network and we're gonna hack WPE or EAP, we have our configurations files down here for host APD. So we would just change our attack to WPE and would automatically use this location, which you need to adjust to whatever location you have your host APD file for WPE attacks. Any questions so far? That's a lot of information. Yes. There's no way to make that slide bigger is there. No, but when you follow along and you launch the application, you'll definitely see it and it will make sense. Yeah, it is. Like I've noticed that. My theme is pretty dark. This is, I wrote this theme. It's based on the movie Tron. It's on my GitHub. So if you like it outside of the slide, you can download and use that theme as we're on the installer. We have packet options. This is what we talked about on our lower level on the like OSI 2 model. And it's gonna be using Ettercap. The options that we use Ettercap are right here. The interface we're on and TKZ we're choosing and if we're gonna ARP this network and right now we're not ARPing the network. But if we were, we could add the IP address or the gateway of the target to get some ARP packets back. But if we had SSL strip running and we want to launch Ettercap, it will do that and then automatically view off of that interface that we told it and it will save it in the temp folder we talked about recovered passwords. So that way you can retrieve some sniffed passwords. Getting more complicated. What do we do after? Could we really get more complicated? I know, yes. What can we do with these capture files and how do we retrieve passwords out of them if it wasn't through SSL strip? Maybe it was hashed or maybe it's a capture packet and it's AES. Really there is no exploit vectors for wireless access once you're using WPA2. It's not a cracked or flawed method of security but it is vulnerable to guessing the password or brute force attacks. So I have two options built in. We can use Aircrack. Aircrack's what's originally set up and it can just run off a dictionary but there's no GPU support. It works really well for web if we captured IVs and if our attacks web, it knows this on what Aircrack runs and sets it up just to crack some IVs and get a web key. But if we're using WPA it's more complicated and it's just gonna use a word list. And that word list is based right here. Word list equal, share, dick, crack, libs, words. This is a dictionary that is predefined in Pentu so you're gonna be ready to go and our test lab is set with a key for that. But that's not cool enough. We're trying to add some more strange lead characters to my name. So I built in Hashcat. This was kind of hard. The syntaxing for this is daunting and anything wrong completely messes up and there's log files go, hey, it just messed up. Thanks. Detailed logs. So Hashcat has several options. Like OCL Hashcat 64, Hashcat 32 Klee depending on what type of hardware we have. I have it pre-set up for OCL Hashcat 64 for using GPU cracking.  So it doesn't make as much sense for us to use this feature right now. So we're just gonna be basing off the air crack. But anyways, as we set the Hashcat system we're gonna use we set the Hashcat location because it's a time bomb binary and I can't rely on you just having it on your system. So you're gonna know where you install it and you're gonna need to know where that link location is. So here it's in the home, your user directory, OCL Hashcat and then you just call the binary. So just change the location to wherever you have dumped the binary install. Because we're focusing on WPA2 authentication here, our modes are gonna be dash M2500.  So I'm gonna use rules rock you dash 3000 and also use the rules best 64. You can change it to whatever you want. The cool thing about the way it's designed is you might not wanna use that and maybe you're hacking like a AT&T two-wider network which an older one, which you knew was 10 digit numerical only. You can just change the rule set based on what it tells you in here to use, hey, use this string here word list or word list equals A3, question D, question D based on the wild card values increment of up to 10 and start at sector choice. So that option is still in here. I'm not restricting you from Hashcat. I'm just trying to keep the functionality you need and can utilize in a concise manner that could benefit you the best I can. Further down is just information about how you need to utilize this config file because you can't just comment a line but maybe I wanna have three different rule sets I use a lot. I can just as it says here add a backfash or something right before the equal sign that I can have Hashcat rules back just equals A rule again with a different rule again with a different rule and then just uncomment it with that backslash that way I know what it's using the next time I run it to make it the best I could. So all of these little blurbs should help walk you through the configuration file and the bottom one just tells you how N for P is gonna handle custom modules for their variables. The module that is provided for you has a little feature and if you read it saying create my custom module equals here and it will check if those variables are in this configuration file already. If they aren't it'll go ahead and put them in for you the first run and tell you hey you need to go back and adjust the configuration files before this module works. That's mostly it from the config it'll make a little more sense as you guys boot and you can see it. If you don't have a laptop and you wanna see it we'll do it over here as well on my system and help walk you through it. So now let's talk about the advanced features. It works a lot like Metasploit. So now that I want it in advanced I can actually run shell commands directly from here. Any shell command I want IP adder or whatever it can start coming up and you don't ever have to leave the interface. But I can run list modules. This tells me the list of modules that are pre-established or packaged right now with N for P which is air base for bridging utilities for cracking if I wanna bully if I need to assign my DHCP. This allows you to handle individual processes. The key features up top are just saying I know what you need to have happen. So I'm just gonna call these modules as they need it because it goes with this module then this module then this module and it makes the attack happen that you need. But if you're really cool when you're trying to do something more unique you might need to have the ability to manually control this. So we're just gonna be concerned with the recon module. So I'm just gonna say use recon and then it confirms that we're using the recon module at this point. If you typo it would tell you that you're confused. When I wanna run that module I just type run and that module will run. And at any time I can also type show options. And if you type after you've called use recon to use this module you can show the options that module and it will show you a list of all the variables that that module is gonna rely on for the config file. So you can go back to the config and know that you need to be concerned about these exact variables. We can exit at any time with zero. As in this interface we can see that we were using network manager during this time. So it knew that I needed to kill network manager to free my interfaces to run.  And any interfaces that I changed broke had crazy configurations in the process. It remembers and it'll go ahead and try to bring your system back to an original state unbroken just like it was before you even opened N4P. So where is N4P taking us? And how has this project changed the entire script landscape of wireless hacking? The reason I think this has continued to change this landscape is we are now offering a module-based design. We are packaging all these attacks in and you can rely on the community and say a cafe latte attack, anything random that someone's figured out. They can just publish for you. Now we're not just continually reading this help file and these band files and figure out why things are broken. We're doing a really good job of putting together. And I think providing a framework that we have now going forward it covers all of information security as we have it. We have MSF covering the application layer infrastructures and exploit vectors. We have set covering our social engineering projects. Where were we lacking? Now we have N4P continuing to close that gap and bring us in an environment where we can have wireless and lower level infrastructure exploitations available to us. And it's also worked really well for the reverse engineering process. So we're touching quite a few bases. And Rick has proposed and it is an option for this year that we want to evolve it even better. So we're probably gonna like add some different languages maybe the interface on Python to make it stronger understanding list and dices more instead of clumber summon and bash as it's getting a little hard to write and bash at this point. And we're also gonna start pulling code that pony's written some of the pony express code revamping it and easy creds code. So the work that easy cred has done that is previously deprecated. We're gonna start bringing in as modules and building an even bigger platform for you guys to move on for. So I think this will really help improve wireless and new framework for everybody. As it starts coming to Cali it's gonna bring more recognition, catch more traction. But the main focus is to hope to really enlighten and bring people to see Pentu. Cause not many people know of Pentu or they think it's so much complicated because it's based on Gen2. But Rick really has done a fabulous job of making Gen2 work out of a box and give you penetration software. So we're gonna utilize that and make sure it works as best as I can right now out of the ISO for you. Yes. Unbiased or biased? I started on Gen2. And I was actually scared when I started when I moved from a Debian based system like man, this is gonna be really hard. You know what, it was pretty hard but it had such a good community. Like everyone in the community was so brilliant that they would help and the documentation was excellent. And about six months later, as we started getting the hang of it and understanding and another year goes by, the amount of control and aspects I have over my system now, it does what I want and only what I want. There's nothing interfering. If every, cause everything's compiled. If I don't want functionality, I don't have to compile it in. It reduces attack vectors on my system based from that. Plus I get a hardened kernel out of the box. So my system is much more manageable. It's more secure in my opinion. And all of the code is, that is very rigorously gone through by Rick and BLSK VR that nothing comes in our package list. That is not sane. If we reviewed an application, even if it's in Cali, something I think I want to share with Reaver of another one, the code just was not very sane. Like this isn't done right. We're not putting in the project till it's sane. So we really make sure that what you're getting for a code based structure and attack works the best it can. The other really cool feature is that all the developers, the main developers for Pentu are live in the IRC channel. So when you have issues you want to talk, they are right there directly helping say, hey, I found an eBuild issue. It's not building Python use flags change. We need to set targets to use Python 2.7 cause our system's on 3.4. They will go ahead and fix it and move it off for you. So I think the community, the more we get involved, will really help out in that aspect. So that's my opinion on using it. I'm trying to get this to Cali user just because I want them to have the ability. I think this is great for everyone to use, but because I realized so much on infrastructure layer, it was hard to use system D. When they went to system D and we're on open RC, it made it pretty difficult for me, but Rick says he's got some magic in his hat that he hasn't told anybody about that we can really make this work. So that is the future of why I think it's gonna be even great cause we can make it cross-platform and independent. That'll really help out. So that's it for slides. And I think it's time to play some games and hack some stuff. Is everyone ready to hack? Still downloading.   And we're gonna go ahead and I'm gonna keep this AP up. So if you can't actually get things hacking while we're going at it right now, I'll be here and I'll go and help you answer as it needs. Thank you, brilliant person. All right, I'm actually running network management at the moment, as we can see, our wireless information. So let's go ahead and take care of that and we'll go ahead and look at my interfaces, what I have going on. I'm using WAN2, 1, and 0 as my main interfaces. As we can see, nothing has IPs, nothing's going anywhere. The interfaces are all down. So let's ask them for P what to do. All right, it knows I'm using network manager so it killed everything that it needed that would interfere with our application. And we can go ahead and, as foremost, understand the configuration file. All right, network manager is true, we're good. Our interface is still on basic, our operating system's correct because I'm using Gen2. We're gonna use host APD, our attack interface is going to be WAN2, that is correct. We're gonna spin up the AP and for P. Let's make it alive. Here's a random BSID, we do channel one, it's all good for both locks. Now, because we're just gonna do an AP, our attack does need to be empty. So our attack is null at this point and that pretty much means nothing else matters for this. So we can control X, Y, get out and save. All right, let's go ahead and bring up that AP. Oh no, yeah, yeah, bring up that AP. Yeah, my phone is already set to connect. So we brought up that AP and if you guys can see, I cannot make that font bigger. Hopefully highlighting helps. There's a victim pull that comes up because we have moderate enabled. So as it came up, we can see already that this victim has it logged onto our service after creating that access point. But we can go ahead and close, close the access point. All right, so the access point's shut down now at this point. I'm gonna do a little bit more. Oh yeah, that's why, because this was host APD. Let's do, so now let's do this with Airbase because Airbase is a little bit different because we have to bring up monitoring interfaces and we don't just have to launch host APD like we did. Host APD is very quick and easy, I think. So let's keep Airbase there and we'll keep our attack still at nothing and see the difference what happens with Airbase. Airbase needs to initiate a monitoring interface, that's what it's just doing on the top left. And now we've just launched our Airbase with verbose logging and we just got our victim associations over here. So anyone that wants to connect to this interface and for Plive, you won't get anything. Why won't you get anything? Because I have not called DHCP yet. So how can I call DHCP from here? I can just go advance, advance. Okay, I'm gonna list our modules here. All right, good, so use DHCP. All right, all right, let's also do, is there any options in this one? Oh, see, those are show options. So we can set our AP and our interface. Are the options required for this? We're on it. Now our DHCP is ran, the wireless in this room is highly congested. It is so congested. 2.4 does not like congested areas, just saying. You're right, it will. It's still trying to get an IP from this environment. We'll probably at least see the client association coming up from over here. Cause I'm getting probes from everybody. There was the N4P live client authentication there of where it's tried to authenticate. It's just not authenticating at the moment. It's okay, that's just a basic air base infrastructure. Really hard to see off of this structure. Anyway, so I just killed it, and we say we just killed the interface. And at any time, if I check my IP, you can see it's already brought the interfaces back down and it controlled them. It does it fine, and it's hard to do that. So I wanna go back through a little bit more and I really wanted to try to do a handshake attack. So we do have air base. We're gonna go into, that's fine for now. So we need to understand the reconnaissance. All right, so now we're already reconning the environment. This is gonna be really difficult with how busy this is. And so if anyone's familiar, you're gonna watch for the BSID and the SSID of who we want and try to match their station down here. And the one we're looking for is N4P hackable. Okay, there it is, but I don't have a station yet. So I can't read it over here real quick. I can read it on my screen perfectly. I just hit control C and paused it. That way I can go over here and read it and modify what I need, make it figure out configuration file for what we're doing here. We're not gonna do an evil AP because you can because during this attack, you can just bring up air down and try to capture it or you can also run a evil twin AP where you can copy the BSID and that would be done here as well. So you make sure all of these features match, but in this case, we don't. So since it's just the attack, we have handshake for that attack that we wanna do. Both of these are right, but we aren't gonna be concerned about this. So this is our BSID, who we're attacking. The name of who we're attacking is, hopefully it works without the station because I couldn't let that run long enough to capture the station itself. So we're gonna go with it like that. So now I'm prepared to do the attack. We can just run air dump right here by three, but if you were in advanced, you could just use dump like that. I'm confused. I can run it right from there. I wanna go back. So we're gonna try to stay in the easy mode and just run a dump. Our monitor interface has been brought up and we're scanning and waiting for a handshake. Now let's try to be a little more expeditious on capturing a handshake. How can we do that? We can just kick everyone off the network. I hope I have the channel right. I don't remember if I have the channel right, but we can continue to keep kicking them. Oops, that was a fireball. Not needed, seven kicks. Not capturing the handshake. I'm dumped down and bring our recon down. Let's just try to recon one more time. Normally this would be a lot of work bringing up air monitor and air base each time back and forth. So this is a lot of we were not time value to this situation. No, I had the channel right. Ooh, ooh, ooh, I got the station. Yeah, that made me excited. Time it loved me more. Unlike Rick's 7A. Demo guys, please love me. Please. All right, we've already done our reconning. So we don't need a recon anymore. We set up the station, the channel, and the SSID to spoof before the dump. And we can go ahead and try and do it now. All right. We'll be, oh, we already got the handshake right there. How about that? See, that was sexy, huh? Fastest handshake anyone's ever gotten. So now let's just go ahead and force a temp for us, and for P. And in our log file here, you can see we've already captured the handshake with this handshake, which is the MAC address that we just attacked based on this router here that we set up to be attacked. So great, we're here to go, we're ready to go. So we don't need to be hanging out here anymore. We got it. We don't be hanging out here anymore either because we got what we came for. So let's think about cracking this wireless network. Option four, crack it. See what that says? It says it wasn't a valid handshake. So you might just have to go back and do it again to get that handshake. Oh, okay, never mind. I got it. There we go. And actually already says key found. So we basically just hacked the wireless access point in less than five minutes, and that's probably a new world record. Hacking wireless access point. What happened? I had previously had the MAC address, a file in the temp folder with that existing MAC address. So when you do that, it enumerates it to the next number up, zero one, zero two, zero three as you capture more. And when I call it, it's only looking for zero one. And that was was invalid. So I had to go back and remove zero one, rename it, and then it worked right away. That was our key feature. So that was WPA hacking. Do we have any questions on how to perform that or go through the config file a little bit? Everyone's WPA to hacking experts now. Yeah, the way it's, the way air base names that is pretty confusing. The ESS ID would be, which we normally see as the SID, but it's actually ESID. So that's just the name of it. Then the go back through. Okay, right. So yeah, our ESS ID is just the name of the access point we are attacking or utilizing. The BSS ID would be the MAC address to that device. And then the station is the address of what that particular access point is operating under. So if you were an enterprise network and they were spanned, you would see the same type of MAC addresses, but you'd see a different station between different rooms. So if we wanted the access point that was just in this room and not the next one down, we'd adjust our station to go through there. And there might not be clients on that. So when you're on a pen test in a bigger environment, you can walk around like a spectrum analyzer and start seeing how much traffic is there. Or when you're just running Airmon and viewing what's coming through there, you'll see how much traffic's on which one. And then you want to just wait to use find that station. When you see the one with the highest traffic kind of station that's the one you want to go to and utilize attack that particular AP. Be much more likely to get a handshake right away. And we did all that without a clientless handshake. We did that with a client handshake that wasn't clientless. The other option is at this same time after we brought the air dump up, if we weren't catching anything, we can just also launch our access point at the same time. So that brings us up an evil twin which people can also connect to. So not only were we likely to catch a handshake that way, we can now infiltrate their traffic structure that's coming through the network. So that can even be useful for many reasons, they know, corporate environments. I didn't really want, I'm not really gonna get into the enterprise because I don't have anything set up or we don't have a radius server set up for that structure. Thank you. Use recon. All right, the other thing we just want to understand and I'll probably show you some of the rule structures here on enumerating the firewall. If I brought that access point up just as a basic access point, our firewall is gonna need to understand how we're gonna utilize that and I'll show you how it uses that. If you're waiting and waiting on it, there might not be anyone on the network. If you're not getting it and then you can't kick them. One thing you can try is a lot stronger antenna because maybe someone's further in the building that does have authentication and if you appear stronger, they'll want to connect to you. You can use IW config and adjust the tux power, excuse me, if you change the region to like a bump the power up to like 30, that way it's exponentially stronger than what the standard wireless controller is gonna give out, making your clients more susceptible to connecting to you. So it's just about making yourself feel more appealing to the environment that we're working on here. Recall launch, let's do this. All right, let me just go ahead and try and show you the firewall. I purposely used a white background. The initiation process is it starts to understand everything that we're using, what interfaces we're using, the access points, the bridges. If we're using VPNs, it starts by dumping the tables and flushing the system. We just allow our forwarding and we set our default policies for the chains that we're gonna utilize. If we have a VPN enabled, it's gonna change the rules. If there's no VPN set, it's not going to, just some basic traffic dates for the DHCP server, for the DNS servers. If you're running all of that locally, if you're running Samba, maybe someone connects to the network and you want to run an NTLMNR listener to get their information. Like if you know someone travels a corporate network, you can get them to connect and run NTLMNR listener. You're gonna want these ports open. So those are there. If you bridge the interface or if you don't bridge the interface and you need port forwarding, it controls the rules differently. So if we're using an access point like Airbase, it knows that and it's gonna allow the post routing masquerading and accept the package through. But what's allowed down here where it's commented, if you go in here, if you're doing a lot of reverse engineering on applications, say you have a Windows box, you reverse that engineering web, web authentication of the software to crack, you can go here and uncomment these lines and then comment these lines up and then you can control only the ports that you want to have access through your AP. That way it really reduces the noise in your traffic while you're running Wireshark to capture how the web authentication is working for cracking that piece of software. So that's some more control that you're getting inside when we're talking about the infrastructure layer. And this is just if you're using host APD, allows the rules differently. And then we have a lot of incognito things. If we're gonna allow ICMP or not or port scans, that way if we're doing vulnerability research on a network, we wanna stay incognito. These situations will keep us invisible to the network and not allow any traffic to leave until you designate it based on an interface that can only go out and can't receive. So those are some of the strengths that we're receiving with inside the firewall controls. That would really just be if an application itself is vulnerable to it, to a buffer overflow on a hardening kernel because Gen2 is compiled, if you're compiling it with checks in different canaries in the memory structure where a buffer overflow wouldn't happen to the system if it was vulnerable. So that's just why hardening's a little bit more secure. I don't know if anyone's gotten it downloaded yet or not.  And then if you didn't get a handshake, wait a second, you can do it again. Just keep going ahead and doing it as you want. Who will?  That would be pretty weird because you're just flooding the beacons of that and they're not really able to walk, you're still flooding it. If it just theoretically, if that happened, I mean, I'm not the end all be all and everything wireless, try changing your Mac address of your device and do it again, because obviously we can set it here.  Anything else that anyone would like to cover? I know it's a really in-depth application to kind of understand, I've only kind of touched the surface of actual attacking. Yes, I will absolutely go ahead and keep this AP running for you. That way you can have practice. I'm gonna be around. So when everything does get things set up, I was trying to do it while we're in the panel that when people can fall along and actually get some handshakes together, I'll be happy to help anyone there and push you through the software, understand how to get it and crack some WPA if you haven't done it before. You're gonna need to use the Pentuvium right now because it's the only way you can get the software. When you update it, as I said, in the initial slides, I should probably bring this back up. There we go. So how this timer, how do you do that? Weird. That's fine. I can just leave it up like this. I'll just leave it like that. I don't know what the heck it's doing at this point. Yes, all of that will be available all day while you're here for the rest of the con. You can download it off of where the red instructions are and try it. And I will leave this AP up and it's N4P hackable is in as a name. The password to the dictionary is in the Pentu already in our dictionary folder. So that's part of the reason that I just made sure that the dictionary file that I'm gonna be tackling would have a valid crackable key. But we're almost out of time. Who's ever a lovely person that gave me this pen. Thank you. All right. Well, we have a few minutes and I thank you guys so very much for coming to the panel and I hope you learned something, want to be involved in the community or follow the project from here on out. Because I'm kind of tired of being the only developer. I'm gonna rephrase the only developer. We're done. We're done. Yeah. Not everyone's gotten to download it in time. So I kind of had to breeze through it on my own. Yeah. Here's what it is. It's Rick's fault. Yes. I had IP6 running. Well, I have to say it doesn't really affect it too much. What happens is I had IP6 running on one of my routers and I was having a really hard time with things just being flaky. So I think it's just gonna have me take some research and understand how to handle IP version six within this attack factor. Yeah. But I mean, it will come. It will come. All right, now I gotta finish implementing the EAP technology. You can do it now if you know how to configure the host APD profile. Just make the couple adjustments and then start a radius server on the back end. But to make it more usable, I'll add the radius server as a dependency in the eBuild package. When we install packages on Gen2, we use eBuilds and because it's compiled by source, we can associate dependencies with applications and configuration files. So in the next update when that's available, I can require that if you choose to use Telet, use EAP technology for hacking, then go ahead and associate radius. So that way the radius server will install and then I can package a cont file for that already with you.  Constantly, it makes it difficult. So if you kill your, I knew I'd need it like that. So what you can do around that is you can run a wired interface. Just launch your DHCP server in Oven or ETH0 or ETH1, then you'll have an interconnection on your base. And for P's only at that point, gonna kill your wireless structure and utilize it. So if you wanna have a module that says upload hashes that parses this site, it can take it from the temp folder, set it up and automatically parse and pull it down. So that could be a module that could very easily be implemented. App in the hash in. Yeah, one of the good things that happens while we're using a hash cat in here, as we saw the cap file, that doesn't work with hash cat, it has to be converted. So it does that conversion already for you and removes all the jump behind you and starts the hash cat going. So there's a lot of work to do that on your own. If you've ever used all that stuff, it's hard. If you can use one button in me to get things done, I'm like, in, out, you're hacked, see ya. Like who else gets hacked that quick? Nobody. I actually just hacked AC. This is my end, I have an AC over here and I was using the AC interface to do that. Now, I know this is the car to go to. I found it, since I used the AC one, this is much flakier. I've had a lot more, I've had a lot more issues with the modules. You know, the car dropping the driver interface just disappears and bringing it up, or it would get hung, it would get hung in PIDs. So I had to add a lot of extra redundancy checks in N4P right now as when it rebuilds a network or it tries to launch a new monitor interface, if it's not doing it, it throws it in a loop and then if it resets network manager, if the monitor doesn't come back on, it restricts for the PID, if there's a PID there, it kills the PID and loops back through. Basically, if you just call PS-A and you get a list of all the PIDs, you can grep that for the applications I'm using, like AirBase.   Yeah, that's what I did. I immediately started using to finish this coding after I got it and ended up finding that it was, it's been the best car that I've used so far, so I recommend it. Yup, very welcome. It's about our 10 minutes that we had to goof off. But thank you very much, people, guys for coming panel. Yeah.


Through the mystic eye, eminent personalities, from various walks of life, in conversation with Sadguru. This week's episode features Justice Jasti Chalameshwar in conversation with Sadguru, as they explore the pressing issue of corruption and reviving the national spirit in India. Mr. Chalameshwar served as the additional judge of the High Court of Andhra Pradesh. In 2007, he became the Chief Justice of Guwahati High Court and was later transferred as the Chief Justice of Kerala High Court. In October 2011, he was elevated as a judge of the Supreme Court of India. I suppose so long as human beings being what they are and the society is what it is, there are suddenly bound to be certain things which are right and certain conduct which is right, certain conduct which is not right. I don't think anybody would contribute to the proposition that corruption is right from any point of view. Somebody who is sitting in a public office making money using his office. Let me tell you, see you are calling it corruption. I have had the unfortunate privilege of sometimes moving closely with the people whom you consider corrupt. And you will be amazed. You will be amazed and initially it was shocking to me but when I really looked through them, I see the reasoning, they don't think they are corrupt.  They just say everybody would do the same thing, I got the opportunity, they don't have the opportunity. So they are only complaining that they don't have the opportunity. So what is corruption, what is not corruption itself is not defined. I am not trying to give a escape route for all these people who are doing horrible things to the nation. So the only thing that can fix this country in terms of corruption is, we need people who have a huge passion for this nation, okay? So right now we need somebody who is capable and who has great passion for this nation. That is the only way it is not all problems will be fixed. That is the only way we start moving towards a solution. Right now we are heading for a big problem because what holds a nation together, everybody must understand, if you want to run a nation, whatever the nation, you must understand what is it that binds the people. There is some passion because nation is just an idea. It is not a reality, let's understand this. Nation is just an idea. What is it that binds all the people as one nation? That idea and that passion has to be constantly strengthened. If you constantly keep weakening it and then try to hold the nation together, you will not succeed. This is the time, this generation of people have this responsibility that if we do not change the trajectory of this nation, the way it's going right now, there will be no one India in another fifty years time. It may not take fifty years. How does this generation do it? See, how is not one aspect alone, there are many aspects to it. See, it's all right people wear imported watches, imported clothes, but they shouldn't import their brains and hearts from somewhere else. It's very important. And that is happening in the form of our education, in the way we are culturing ourselves. There is nothing wrong with anything that comes from outside the country. We must take the best that comes from everywhere from the world. That is the nature of any evolving, growing society. But at the same time, what holds us together as a nation should not be sacrificed. If you sacrifice that, you won't be able to hold it together. People will not stay together. You know, you can't hold three, four brothers together. Unless you bind them emotionally and create a passion towards something, you can't bind them together. If the parents did not take care of that, you can't hold them together. They'll go away somewhere. If they live far away, they won't fight. If they come close, they will be in your court. You must understand what holds the nation together. The basic thing that held this nation together was always that in this nation, we did not believe this nor that. Only thing is we knew we have to become free. Liberation was the highest goal. If you keep it that way, if you manage to activate this back in the society, you will see people will stay together. Otherwise, every group will form its own belief systems and they will all go separate. You can't keep them together. At the very birth of this nation, we broke into three pieces. Every hundred years we may come to it or less if we do not take care of us, few fundamentals. And what measures are to be taken to create that atmosphere where people walk towards that goal? It's best that what you're strong on, you build on that. You don't try to build an America and United States of America and India, it's never going to work. You build an India in India, a strong powerful India you can build. The North American people are there the way they are because they came there for a different reason and they came together for that reason and that reason is working for them. Here it's not like that. This is a completely different reality. You're trying to superimpose another reality upon yourself, that will not work. This is not against anything. This is not for anything. I'm speaking English language, I'm entire. So I'm not against anything for that matter. But I'm for that which works, I'm against all those things which do not work. Why do you want to invest time and life and people's lives in things that do not work? We clearly know. From my experience of working with the village, being in the villages, I clearly know at least fifty to fifty-five percent of the people, their existence is like cattle, not like human beings, the quality of life. Okay? They're somehow managing so we think they're okay. So they're somehow managing, that is not life. After sixty-seventy years, two generations of people, their lives are gone and if still we can't find basic solutions, that means we're doing something wrong, isn't it? And why do you think it didn't work for sixty-seven years? Because your analysis and understanding of it is essentially because of this. We are trying to transform people from being Indian to being English.  English language is the only thing we should have picked up because that's a passport to the world. I'm saying what we pick up, if you go shopping, what you pick up from a shop is by choice.  So the idea of Madhma Gandhi and the rest of the clan fighting for freedom and getting the British out was so that we could choose what we want to do with our lives. We did not choose because we were lethargic or we were just overwhelmed or we were just... our idea of superiority was, you know, misplaced. We somewhere thought anybody who conquers must be superior. We just try to implement that system as it is, including the judiciary, everything as it is. See, I'm not talking about traditional values. I'm not talking about India being an isolated nation doing its own thing. No. As I said earlier, if you go shopping, you must choose what you want. You must not take whatever the salesman is pushing on you. Something is 50% discount, so you don't buy it. You buy something that you need, isn't it? So even from the rest of the world, the same thing. You pick up what is going to be good for us. You don't pick up something that they're peddling to us. So what they don't need, they would like to peddle to you. You should have the sense not to take it in. You must take in what we need and what will work for us. English language works for us or we picked it up. Maybe we didn't pick it up. It was thrust upon us. It doesn't matter. But somehow it worked out for us. Everything else you must see from a simple thing to anything. I will say, you know, there's a classic example. The tribal school close to the ashram where we've been working. First, I went there about fifteen years ago. Do see, we thought we will, you know, participate in the school in some way and I wanted to see how the children are. I went there and all these kids, there's just about eleven, twelve kids in the school and they're all wearing ties. The ties are worn here, like a necklace, okay? Long string and tie here.  Why are these children hanging these ties here just in walking around? It's not a necklace. But the kids don't know what's the difference. Something you have to wear like this, they know only. This one they're wearing. In Tamil Nadu, if you wear tie in the summer, it's as good as a nose, you know. I'm saying from something so simple, what food to eat, what is comfortable in tropical weather, what is the best thing to eat, what is the best thing to wear is something that we have to look at, isn't it? You just don't have to imitate somebody simply because they managed to conquer you. They did not conquer you because they were superior people. They had gunpowder and you didn't. That's all.


Hi, I'm Denshi and this is my Arch Linux troubleshooting guide. In this video, I'm essentially gonna be running through a few basic mistakes and things that people tend to do when installing or using Arch Linux.  So you plug in your Arch USB stick into your laptop and you don't have an ethernet cable and you're trying to connect to Wi-Fi from the command line. Here's a short little video I made that explains how to actually do that with the IWCTL utility. All right, so let's say we have this laptop over here which it's got the Arch Linux ISO littered up into it. So after booting in, we won't have any internet connectivity because, well, it's not plugged into any ethernet or anything like that. So we're gonna have to use Wi-Fi through the IWCTL utility. But basically, once you're in the actual ISO, you wanna run IWCTL just like that. And there you go, we're now in the IWD prompt. Now, once we're in here, you can type help and you'll get a bunch of useful commands you can use to connect to the internet. The big one we wanna look at over here is the station section. So we wanna, first of all, run station list. And that's gonna give us information on all the devices which are in our computer. Now, as you can see, we have WLAN zero and it's scanning for networks. Now, I didn't set it to do that, but if your one isn't scanning, then you wanna run station, then remove list. You wanna run WLAN zero scan. Just gonna turn on its scanning. Now, once you've done all of that and it's scanning, you wanna run station WLAN zero get dash networks. And that's gonna list the networks that I found. Now, there's my phone. That's what I'm trying to connect to. It's my phone's hotspot and it has a password because the security says it's got a password key. So in that case, I'm gonna run station WLAN zero connect and then the name of the network, which in my case is Alex phone, just like that. It's gonna ask for a passphrase. I'm gonna put it in and there you go. Now it should be connected, but just to make sure you wanna run station WLAN zero show and there you go. It's showing that it's connected. It says over here, state connected. So if you wanna exit to leave the prompt, now we're connected to the internet. You can run ping google.com or any other website or whatever and boom, you're gonna get a connection. So that's how you connect to WiFi on the command line on Arch Linux using the IWCTL utility. Okay, now that we've run through that, let's take a look at a few other basic things which people often get wrong when installing Arch Linux. The first big one is setting the time and date. Now, if you go to the Arch Wiki, there's actually a little note that says to do this when installing Arch Linux, but some people tend to skip this, but essentially what you wanna do is you wanna run time date CTL set dash NTP true and then boom. Now your system will be checking with an NTP server, which is a time server, to make sure that its own time is correct. The reason you wanna do this is because SSL connections, they need the time on your computer to be set relatively correctly, otherwise they won't work. Now let's take a look at another thing which people sometimes get wrong, which is using the Pacman package manager. They get an error that says something like, oh, the keys couldn't be verified, it couldn't verify the integrity of packages. This is because the Arch Linux key ring isn't updated. So I just wanna make sure that people are updating it when they're booting up into their Arch ISO. So you would have to run Pacman dash SY to update the database as well and then Arch Linux dash key ring, just like that. And if you wanna run this faster, you can do dash dash no confirm to skip the enter. And as you can see, it'll start downloading that package right over there. And if there are any new keys, it will add those. Now in this case there weren't any, so it's fine and that should be pretty much it. Okay, so that's all the basic stuff out of the way. Now for the more complex things people tend to mess up. The first big thing is partitioning.  Now if you already have a disk that's already partitioned, which is likely because you're installing Linux and it's not pre-installed, then you just gotta pick either DOS or GPT depending on your system. If you have a BIOS machine, which in Arch Linux terms means that when you boot it up into the ISO, you got a colored prompt with a colored Arch Linux logo and all that kind of stuff. That's the Arch Linux BIOS prompt. Then in that case, you wanna select DOS.  Okay, so I'm gonna select GPT because that's what I'm using. And the first thing I wanna make sure here is that you're making a boot partition. People often forget to do this because lots of Arch Linux install guides skip this step, but you have to create a boot partition if you're on a UEFI system. So most modern laptops and modern computers, you have to do this. And this partition should be around 200 megs in size, so you can type 200M. Now for the type, you have many options here. You can pick from any of these things. You can select EFI system if you want it to be an EFI boot partition, but it doesn't really matter as long as you format this partition to FAT32, which we'll take a look at later. Now besides that, you only really need a root partition to get Arch Linux working, which is where all your files are actually stored. If you want, you can make a swap partition to make something like, I don't know, two gigs and that can be a swap. And this over here, this can be the root to the rest of the space. But essentially what I want to clarify is that when you're on UEFI, you have to have this 200 megabyte EFI partition. And if you do not have it, then you're gonna struggle. You're not gonna be able to boot in your system. Anyways, now I'm gonna write these changes. And one thing you want to make sure is that you're formatting all your partitions right as well because people tend to forget to do this or mess it up as well. So if you run LSBLK, you'll see the status of all your partitions in SDA1, as you can see, that's the 200 meg one.  So you want to run mkfs.fat-f32dev-sda1 just to make sure. And for SDA2, if you want that to be swap, you can run mkswapdev-sda2 and then for SDA3, mkfs.exd4dev-sda3. But remember, you want to make SDA1 or whatever partition you're using for boot, which should be the first one really, FAT32, you always want to format it to FAT32. But anyways, that's the partitioning stuff people tend to mess up. Now, here's another thing which I see people get wrong all the time. So first of all, let's mount all our systems. Let's mount dev SDA3 to slash mnt. Let's make a directory in slash mnt called bootefi, mount dev SDA1 to bootefi and then turn on the swap for dev SDA2. Now, if you look at the guide, it tells you to run packstrap. Okay, we're gonna run packstrap slash mnt. We're gonna run base linux, maybe sudo. You definitely want that, network manager, all that kind of stuff, right? You want all these packages, vim, grub, efi, boot, mgr, which you need for efi. Okay, here's a step which people often forget after they've ran that packstrap command. They forget to change route. You have to run arch-chrute slash mnt, just like that. And now that we have this white non-colored prompt, we're actually in our route. So if you run lspok, SDA3 right there, that disk we formatted to ext4, that's mounted on the slash. That is our system where we're at right now. And if we type exit, we're back in the USB. And just like that, the SDA3 partition that's mounted to mnt on the USB. So I want to clarify that when you're installing archlinux, a lot of the steps, in fact, most of the steps are done from inside your system. Once you've already installed all the bases and you're inside of it after running that chrute command. And here's another thing which people often mess up at this step, they forget to generate the fstab. Now thanks to people who've pointed this out in the comments, it is best practice to run genfstab with the dash capital U option to generate UUIDs. So if you run genfstab dash U then slash mnt, you get an output of all the things mounted to slash mnt. And we're gonna take that and send it over to slash mnt at C fstab. And people often forget to do this step. And that's why then they boot up into their system and no drives are mounted, nothing is mounted. And they get stuck because only the kernel is loaded. They don't have anything mounted. So just make sure you generate the fstab and send it over to at C fstab relative to your mount point, which is slash mnt in my case. Okay, so now that's covered. Let's actually go into the system and do a few other things that people often mess up. Now setting your locale, time zone and stuff. Yes, it's important and you should do it, but it is not necessarily gonna break a system if you don't set it. It will break certain programs and certain programs will just refuse to run if you haven't done it. So you have to set locale and time zone. However, it's not gonna like break the system. It's not like you're not gonna boot because the time isn't set correctly. However, you are genuinely gonna have problems or not boot if you don't do the following things. The first big thing is setting up grub, which is the boot manager. I installed grub to this system and grub comes with all these helpful commands to help you install it. The first one is grub dash install. You give it a device, so in my case, dev sda, which is the device where everything's mounted to. So the virtual hard disk over here and it will automatically detect whether you're EFI or you're EFI or BIOS or whatever and it will install everything accordingly. And there you go, it did it. The other big thing is configuring grub which you have to do otherwise, it'll just boot up into grub and it won't know where your kernel is. Now if you list your boot directory, you'll notice there's a kernel right there. It's VM linus-linux right over there. Grub has to know where that is so it can boot up into your kernel. So if you run grub-mkconfig, it will automatically do that, find your kernel and spit out configuration. Now this output over here is pretty useless for us because we want this to be in a file. So you can give it the dash O option and send it to the boot grub-grub.cfg file which grub reads every time it boots up. So if you run this command, it will show you the log of the config and there you go, it has successfully generated the config.  Now in my case, I have network manager installed here but this applies for any other network daemon you want to use or whatever network config you do. A lot of people boot up into Arch Linux and then they're stuck because they don't have networking working. I recommend using network manager, not only because pretty much every desktop environment uses it but because it automatically sets up networking and all that kind of stuff as soon as you boot up into your system. If your system's plugged into LAN, it will connect to LAN instantly and do all of that for you. You won't have to do any configuration or run any commands. Now it'll also help you set up wifi with its utility called NMCLI over here but obviously I'm not gonna run it now because we're in the USB and network manager isn't running. So running system CTL enable network manager is very important because if you don't run that, you won't have networking. But anyways, I hope you enjoyed and found this actually useful and actually gained some knowledge here especially with that wifi on the terminal guide. I hope that helps people I might make that into a short just to help more people. I've been Denshi, goodbye.


It's not true of the Apostle Paul as he's writing these words. These words have weight. Paul, a slave of Jesus Christ, a called apostle, separated to the Gospel of God.  You are not your own. You've been called to a vocation.  And now you are separated to the Gospel. You're not your own. You're not your own. Praise God.


What is Habitat, right? If you look around on the web, you're gonna find descriptions like this one. Application automation that enables modern application teams to build, deploy, and manage any application in any environment. And when I started looking at Habitat and looking at those things, I had no idea what that meant. So I started digging deeper. You know, that's kind of what we do. You know, we find something that looks kind of cool. We dig into it. The first thing I did was I built out a small little cluster, right? Get some hands-on experimenting with it. Try to figure out, you know, how am I gonna actually use this thing in production? But it didn't make any sense until I realized one thing. The infrastructure is not the point. So Habitat is not replacing Docker. It's not replacing Mesosphere. It's not replacing Chef. It's not going to try to replace things in your environment. So for me, this is kind of the way I am thinking about Habitat now. So Habitat is a framework for creating modern portable applications. It's not necessarily like a new infrastructure like where you go and set up a cluster of something. So just like Rails gave Ruby developers an easy framework for web development, Habitat is giving developers a framework to build, you know, modern, run anywhere type applications. So if you buy into that mental model for how I am describing Habitat, you know, what do you actually get for trying this product out? What are the benefits that you're going to get from it? So Habitat, every application that you deploy with it comes with a supervisor. And what this allows you to do is basically have your application and do things like configuration changes on the fly, right? So it's basically a listener that comes with every application that you deploy. You also automatically get service discovery built in, right? So your services can be grouped into, you know, like groups and they can self-manage and reorganize based off changes in the topology. You get clustering strategies. So built-in cluster strategies such as leader follower so I think, you know, like MySQL replication. So you can start your things that match how your topology should actually look. You get some secrets management. You get basically, you know, strong encryption, right? They're using Libsodium so it's a Rust implementation of the Knackle library. So you get, like, some advanced Cypher stuff.  And so a whole bunch of endpoints. I'm going to talk about one of them next, the health one, which I think is really important. Maybe? So health checks. When your developers are creating their applications, they can actually bundle the health checks with the application. And if you think about that, that's really cool because a lot of times you'll have apps that are deployed and then an entirely different team makes up the health check that checks to see whether it's alive. You also get a clean build environment. So a way to build these packages without your operating system interfering with, like, system libraries and things like that. Cool package format. So you get, you know, isolated packages that are immutable and they're completely auditable. So you can track, you know, changes that happen to the packages. And they are portable. So, you know, you write your application and it runs on bare metal. But you can do a have export command and suddenly you have a Docker image or you have an image that's built to run on a Messosphere. And that's just going to get, the list is going to get bigger and bigger. And it's take what you want. So you don't have to, you know, go all in and say, I'm going to use clustering and all these different features. You can just start with running an application. And then if you need a feature, it'll be there for you when you need it. And so try it. They have a really cool interactive, you know, web-based demo where you can type in interactive sessions and things like that. So there's like no risk. And thanks. So some resources for you. The Slack for Habitat is very helpful. Website, all those things.


There's one final procedure I want to talk about in terms of data sourcing and making new data. It's a form of experimentation. It's simply called AB testing, and it's extremely common in the web world. So for instance, I just barely grabbed a screenshot of Amazon.com's homepage. And you've got these various elements on the homepage. And I just noticed, by the way, when I did this, that this woman is actually a animated gift. So she moves right on. That was kind of weird. Never seen that before. But the thing about this is this entire layout, how things are organized and how they're on there will have been determined by variations on a B testing by Amazon. Here's how it works. For your web page, you pick one element like what's the headline or what are the colors or what's the organization or how do you word something? And you create multiple versions, maybe just to version A and version B, which is why he called AB testing. And then when people visit your web page, you randomly assign those visitors to one version or another, you have software that does that for you automatically. And then you compare the response rates on some response, I'll show you those in a second. And then once you have enough data, you implement the best version, you sort of set that one solid, and then you go on to something else. Now in terms of response rates, there's a lot of different outcomes you can look at. You can look at how long a person's on a page, you can actually do mouse tracking if you want to. You can look at click throughs. You can also look at shopping cart value and or abandonment, a lot of possible outcomes. All of these contribute through AB testing to the general concept of website optimization, to make your website as effective as it can possibly be. Now the idea also is that this is something you're going to do a lot. You can perform AB tests continually. In fact, I've seen one person say that what AB testing really stands for is always be testing, kind of cute, but it does give you the idea that improvement is a constant process. Now if you want some software to do AB testing, two of the most common choices are optimizly and VWO, which stands for visual web optimizer. Now many others are available, but these are especially common. And when you get the data, you're going to use statistical hypothesis testing to compare the differences or really the software does it for you automatically, but you may want to adjust the parameters because most software packages cut off testing a little too soon and the information is not quite as reliable as it should be. But in some, here's what we can say about AB testing is a version of website experimentation done online, which makes it really easy to get a lot of data very quickly. It allows you to optimize the design of your website for whatever outcome is important to you. And it can be done as a series of continual assessments, testing and development to make sure that you're accomplishing what you want to as effectively as possible for as many people as possible.


Well, Cal Ripken Baseball League is at the forefront in our area once again. The 12 U team from Baxter is heading down to the World Series in Branson, Missouri next week. Clayton Castle has more on their journey. While most kids are gearing up to go back to school, there's a special group of ball players in Baxter gearing up for the 12 U Cal Ripken League World Series in Branson, Missouri. After winning state, the Baxter 12 U team will head down to Missouri to take on the best teams in the country and hopefully the best teams in the world. For now though, the kids are just enjoying the journey. It's been really fun. First win in state now, get to go to Branson, Missouri for the World Series. It's pretty cool. It's been really fun. I mean, we've been working really hard and now to be at the World Series is really cool. Head coach Steve Hansen says this is a special group of kids both on and off the field. What's really special about this team is they're so gritty. They have no problem getting their uniforms dirty. They execute plays, pretty complex plays with ease. So if we have a bun situation or a hit and run situation, you can really count on them to get it done. So they're very intelligent about the game and it's been really a fun experience to coach them. And they've earned this. It's going to be a lot of fun for them. It's certainly going to be fun for us. The kids can hit the long ball, relay to home, and pitch lights out baseball as evidence by their performance in the state tournament. But coach Hansen says that in order for the team to be successful in Missouri, it needs to work on the mental facets of the game. But what they really need to work on most is the mental part of the game. We've talked a lot about that. They know how to hit. They know how to field. What we've talked about all year is approach and how to keep themselves calm when situations might get a little bit tough. Or if we get down in a ball game, how to come back and they've figured out a way to do that. And they've done that a lot better with age as they've grown up. With their last practice behind them before heading down, the team is excited for the trip ahead. Just having fun, playing against different countries and just playing on ballparks from America, it'll be pretty cool. It's really cool being in the dugout with all the boys and just going to Branson, Missouri will be really cool with them. No matter what happens at the tournament, the team can relive its season with the new banner, hanging on the outfield wall at Oscar Christopherson Park in Baxter, celebrating the state champs. Reporting in Baxter, Clayton Castle, Lakeland News. Thanks, Clayton. The team departs Minnesota August 1st. The first game is scheduled two days later and they look like they're having fun, man. Looks like they're having fun and we wish them the best of luck. No, to be 12 years old again, which is so, man, I'm jealous. If you've enjoyed this segment of Lakeland News, please consider making a tax-deductible contribution to Lakeland Public Television.


Eric, I've got 8A. I'm not getting any contracts.  For the majority of people out there, 8A is no good. You might as well not even have it, because if you're not prepared to grow your business, to grow your organization, to be fiscally responsible, to put together a team of people to go after these opportunities, then you might as well not even get 8A.


So, where's the economy going to be five to ten years from now? Because on one side, you've got technical businesses like ours and we find people working at home are more productive than ever before. And certain restaurants are moving out of the city where they pay a percentage of receipts as rent into the suburbs and they're delivering their food in and doing very well for themselves with less employees and better profits. On the other side, I mean, what 25% of the people are unemployed and the government, I mean, forget about protecting individual rights. We're violating the government is violating rights at a rate that we've never seen before in America. Where are we going to be five to ten years on? So, I mean, I think that we're going to be very bifurcated. I think that this whole discussion of inequality, which I always say is relevant and not important. But there's a sense in which it's irrelevant in the sense that the government creates it. The government explicitly creates it. And the government is creating a more and more bifurcated world in which we live. The technology world has a sort of momentum to it and it is still relatively likely regulated. And but even there, we're going to see more regulation of tech. Certainly the big tech companies are going to be more regulated. If this administration and next administration, whoever continues to restrict immigration, then you're going to see fewer, less and less talent coming to the United States. And we know how much of Silicon Valley and the technology business is immigrants and the best from all over the world. If capital continues to be misallocated, then at some point there's going to be real shortages of capital going to the best ideas. And there'll be less entrepreneurship.  It's less dynamic, it's less innovative, and it's just not the same spirit that they used to be. And some of that is from the capital side and some of that's from the kids coming in and some of it is from just the fact that there's more regulation now, even in Silicon Valley. So my view is five, 10 years from now, certainly there'll be some businesses that are still making good money. There'll be new innovations. We'll have iPhone version, what are we now, 12, 22. Apple will still probably be a very successful company. Who knows, Facebook, Twitter, I'm not going to make projections like that, but there will be new innovations in technology. Some people will have made a lot of money. Some people, their productivity will be increasing dramatically. We'll have more robots, we'll have more AI that facilitates increased productivity in certain sectors in certain areas. And indeed, that's what's saving us. I think what is saving the United States right now, what's saving the world right now, is that at this interesting intersection, where technology has the potential now to dramatically boost productivity through robotics and through AI, at the same time as government is destroying other forms of increased productivity. So that's going to be the battle. Are the destruction forces greater than the productive forces? And it's hard to be optimistic, but I don't see a collapse. And the reason I don't see a collapse is because I think those productive forces are so strong that it's hard to destroy them. It's hard to really knock them out for a loop so that they don't have any impact. But some restaurants are moving to the suburbs and they can do fine. A lot of restaurants are never going to open and never going to find a place for themselves. I was just reading an article about New York. All the cultural institutions in New York are shut down. What is going to happen to all the actors, musicians, singers, comedians, who used to make a living? And who knows if they'll ever be able to make a living again doing what they used to do, right? So what happens to our cultural institutions, which are a real value to us and one of the reasons we love cities, particularly if everybody leaves the cities, can those resurrect themselves elsewhere? Is there, because they require economies of scales, they require a certain mass of people, they cannot be phenomenons just to the suburbs, will we get them more online? Is there a way to monetize that? You know, who knows? I think we're going to be in 10 years, we're going to be in some ways poorer, in some ways richer. Technologically, I think we'll be richer. Overall, flat. And I think the poorer, the old, the less educated, I'm going to disproportionately suffer from the next 10 years, just like I think they did over the last 10 years. I think that everything that happens right now is disproportionately hoarding the poor, or the less productive, the less educated, the less able to pack up and move to wherever the jobs are, less able to pack up and move to the suburbs.  Those are the people who hurt the most. So, you know, the people who are doing well right now will continue to do well. I suspect. So, people who can work from home, tech people, lawyers, accountants are going to do fine. The other good one is maybe we'll see more privatization of education as people seek out schools for their kids. Yeah, I mean that, you know, if there's a backlash against, and if there's a disruption of institutions that just assume the government runs, that'll be the most positive thing that could happen out of all of us. What we need today, what I call the new intellectual, would be any man or woman who is willing to think. Meaning any man or woman who knows that man's life must be guided by reason, by the intellect, not by feelings, wishes, wins, or mystic revelations. Any man or woman who values his life and who does not want to give in to today's cult of despair, cynicism, and impotence, and does not intend to give up the world to the dark ages and to the role of the collectivist roads. All right, before we go on, reminder, please like the show. We've got 163 live listeners right now, 30 likes. That should be at least 100. I figure at least 100 of you actually like the show.  But at least the people who are liking it, I want to see a thumbs up. There you go. Start liking it. I want to see that go to 100. All it takes is a click of a thing, whether you're looking at this. And the likes matter. It's not an issue of my ego. It's an issue of the algorithm. The more you like something, the more the algorithm likes it. So if you don't like the show, give it a thumbs down. Let's see your actual views being reflected in the likes. But if you like it, don't just sit there. Help get the show promoted. Of course, you should also share. And you can support the show at urunbrookshow.com slash support on Patreon or subscribe star or locals. And show your support for the work, for the value. Hopefully you're receiving from this.  You'll know what shows are on, when they're on. You're good notified. So yes, like, share, subscribe, support. Like, share, subscribe, support. There you go. Easy. Do one or all of those, please.


Kentucky Derby horse or ad agency? Here we go. Practical move. Derby horse. That's correct. Calamari. Whatever it is, I love it. I can't believe it. Agency. That's correct. Big Bang Electrical. Horse. That's incorrect. Courage. Horse. That's incorrect. Ecstasy. Horse. That's incorrect. Derma Sotogake. Horse. That is correct. We got a horse. Two fills. Agency. Incorrect. That's actually a horse. Hey, let's go. That's what the heart says. Agency. That's correct. Hero Octane. Horse. That's an agency. White Tiger. Horse. No, that is an ad agency. Sun Thunder. Horse. That's correct. Wanna run at the end?  Congratulations. It's been a while since I've won anything. Thank you so much for having me. That was fun. Weird, but fun.


Anthony, you said your heart was beating pretty fast when you got called into Aaron Boone's office. Has it slowed down yet? Yeah, by now it's slowed down, but it was just an amazing day and one I'll never forget. We saw you got to have that special moment in the dugout with your family. What was the takeaway from that? How did you guys celebrate? Yeah, it was a moment that I'm so glad I got to spend with them. I was gonna, they're gonna be obviously the first ones I was gonna call, but then I got word that they were waiting on me. I don't even know what they thought they were waiting on, but they're definitely surprised and something that we'll share together for the rest of our lives. So how did you guys celebrate last night? Well, I think that they were in the dugout because they had to catch a flight, so they were gonna say goodbye to me either way. And I think that's what they thought they were doing.  We saw there was a cool exchange with you and Willie Randolph in the clubhouse.  What has it meant to you to have Willie as a mentor? It's meant everything.  He was a role model, but for him to become sort of like a mentor, kind of like a big brother to me and someone I know always have in my corner, someone I'm gonna rely on for the rest of my career, the rest of my life and he said it and I appreciate it so much that he's always just one phone call away and I'm definitely gonna lean on him as a resource. Coming up as a Yankee fan, you know how passionate this fan base can be. They are pumped up and excited. What has it been like to have that kind of support behind you? No, I definitely appreciate it and I'm just so excited to go out there on Thursday and play and give them my all and kind of really introduce myself to the fans. All right. The question every Yankee fan is wondering, maybe they want to go buy your jersey. What number is Anthony Volpe gonna wear? Are we staying with 77? I'm still thinking about it, but I don't really know how the number situation works, but 77 is special to me because obviously the connection to number seven, but we're gonna think about it the next couple of days. Anthony, congrats. We'll see you in the Bronx. Thank you.