Hey everyone, so We have a lot to talk about here.   We've tossed out there There's nothing really official that calls it a pro It's just kind of a a way for us to quick reference what this system is You know that we agree on what we're referencing here that you know This is it an upgraded model of switch now What's interesting about the remarks they made and why people started taking them to heart is that digital foundry has actually Been correct about a lot of things with switch in the past from games to the light model to the original switch because Digital foundry is an arm of Euro gamers. So they have real sources That have proven to be correct in the past So when digital foundry says something people tend to take it as fact now What's interesting is that digital foundry didn't present what they said as a fact But people are taking it as such because sometimes in the past digital foundry will Basically create speculation around something that later ends up being true Probably because they don't want to be given information or they're not confident about the information they have yet So they'd rather speculate rather than say hey, we have sources that said x y and z So what did digital foundry say well they essentially said that while yes a 720p OLED screen probably true 4k output Well, I mean technically Tegra x1 can output a 4k signal So, I mean it can output 4k. You're just not getting 4k gaming But it is what it is right like technically they could argue, you know if you want YouTube and 4k You want Hulu and 4k x1 can already do it So maybe that's just what it is and maybe it's just literally Unlocking the Tegra x1 to enable that 4k output because here's what they believe they went off a leak of an operating system from a dev kit That happened last year and was broken down and factually inside the operating system was a reference to a Lula a ULA which is a currently unknown Switch SOC but in the breakdown of a Lula it looks like it is the exact same Tegra x1 With the same 16 nanometer process they have used on the version 2 switch the red box switch and that obviously it is You know similar specs now. What's interesting about that is That while they say they think this is the chip that is being used in a switch pro Basically making the switch pro the exact same system as the current one just with a new screen That kind of set the world a tizzy because none of the rumors line up with this given information and this information was technically Debunked a while ago in terms of it being what the switch pro is but because digital foundry brought it up And because they have some clout behind their name people are all in a tizzy about it Well, we have some debunking information along with actual new info real info not rumors We're gonna start with the rumors and then we're gonna end with the legit info that comes off what NVIDIA is actually doing and is publicly Verifiable it is crazy. What's coming you guys should be really excited because it looks like whether it's the pro or a next-gen switch There is some version of a switch coming at some point that is insanely powerful in comparison to the current switch I I didn't even believe it till I saw it myself, but before I get into that We are giving away a copy of my center rise and to $20 Nintendo switch PlayStation or Xbox gift cards so three total winners this month head on to the description or the pinned comment to enter Let's go. Let's get into this. All right. So first up brainchild is An insider over at recent era and well, you don't have to like recent era brainchild has been verified Not only by the recent era mods, but he's been correct on a lot of stuff in the past He is a VFX artist and consultant and he has had several direct contacts Which appear to be with NVIDIA about their inner workings with different SOC's and different chips He's talked about things beyond switch SOC's in the past But he's been right on everything he's talked about switch SOC's in the past as well But when they're being developed when they're releasing all this stuff so One he has directly refuted what direct digital foundry said saying that hey What they're talking about and what was in that speculated thing that is not the SOC that's in development or in these dev kits In fact logically you would not need new dev kits just for a new screen a New screen would not change anything for Development purposes so to be clear the fact that dev kits are out there and everyone agrees that dev kits is out there Including brainchild that hey look even digital foundry said something about dev kits being out there if dev kits exist Why would they need to exist for the same chipset? Because they might run at slightly higher clocks, maybe Mmm. Mmm. You could just unlock current dev kits for that They wouldn't need new dev kits So yeah, like they could literally just release a new profile that allows for higher class I think they wouldn't need brand new dev kits. So let's get into What brainchild has to say on this and then we're gonna get into some of the factual information We know now based on Nvidia themselves He has stated that the switch SOC specs are actually in flux and this dates back into last year But it is possible the chip has hit taped out mode already or will within the month and You know, you could say this given on the number of third parties that have dev units But he claims that at the time he got this information the chip wasn't taped out yet now to understand what he means by taped out I just want to give you an analogy like taped out isn't something that technically exists anymore deals with magnetic strips and stuff in the past But to give you an idea of what taped out means It's kind of like a video game going gold The video game isn't printed on a disc or cartridge or available in a digital download format for mass consumption I might not even be fully playable on a given system, but the final product is so-called complete So for a chip this would mean the design is finalized and ready for the tools to be made For to go into mass production So essentially the chip itself the design and the specs and everything are finalized and then they're just going to wrap up the tools at Manufacturing level and then begin mass production Bloomberg obviously has previously talked about this about the 720p rigid OLED panel seven inches Also, we know that Nate Drake has put out there that hey look He knows about some exclusive games coming at least one exclusive third-party game and the dev kits exist So these are just some other sources talking about switch pro Zombal or zombie I guess as he goes by who's also an insider has noted that he has heard all dev units currently are not final spec But rather hack together systems with various spec profiles brainchild agrees with this and his people in position Which appear to be at an Nvidia are telling them that dev kits are likely sent out, but aren't final specs So it's kind of like a hey look, you know, he's not 100% sure the dev kits are out there But what he's hearing it sounds like they're definitely out there And it says if that's the case however both Zombal and brainchild are correct and brainchild has nailed all of his SOC stuff in the past It's hard to believe that it's the same take or X1 chip as you wouldn't need to tape that out So digital foundries kind of expectations are irrelevant now to defend digital foundry and that Alula Listing in the OS one thing to remember is Multiple times throughout a given systems lifespan the original chip gets replaced They replaced it once already and the only reason we even know about that replacement and got a red box switch is because of the switch Light if the switch light didn't come out and all they did was just update the chip Which they did originally to stop hacking we went to even got what's called a version 2 switch It would have just happened under the radar and Nintendo would have never said a word about it But because they were advertising the switch light They were able to kind of sneak in and mention that hey we have a version 2 a switch So Alula can be coming real they could they could literally be putting new Tagra X1 chips in the current switch model at some point But it would just be you know updated securities and stuff like that It's not going to be like you know giving you better boost clocks or anything like that So a little I could still be right could still be true It could just be another revision of the same hardware right now made for security purposes again The Xbox 360 had like four or five different chips in it PlayStation 3 had seven different chips We'll see if it or not PlayStation 4 ended up with four different chips. So again, this is not uncommon We usually don't hear about these chip revisions We're only hearing about it because people are really interested in what the switch pro is so they're digging into things that might not have anything to Do with it? All right moving on brainchild does note that while the tape out could be soon It could be as late as early 2022 so it doesn't think it'll be any later than obviously Spring of next year. He just feels it will be sooner because his sources don't really tell him about switch SoC stuff until it's closer to being finalized For logistical reasons if the DLSS rumors are true, which have come from multiple sources a Tagra X1 is Technologically incapable of running DLSS in any form even if they attempted to run it with RT cores Maxwell such Pascal architecture is incapable at a hardware level to work with that technology So any thought that you know, they could use a Taker X1 and attack DLSS on it's just not possible So I think at this point we could just dismiss switch pro is not using a Taker X1 All right brainchild is confident the new SLC will go into mass production in July And this actually lines up with the same timetable that we know the 720p OLED panels are going to mass production So that would actually line up to potentially release this holiday or early 2022 because again It could release late this year Might be more realistic to expect another March 3rd kind of release That's kind of the timetable. We've been working with ever since that Bloomberg article came out Brainchild confirms the info he has flies in the face of any thought process of an X1 plus refresh Instedlings and the native hates claims of 4k in DLSS That's just kind of what we know from brainchild who is basically saying look there's a new SLC in the works All right, it's for switch It is not a Taker X1 dev units are out dev units I don't have finalized specs Nintendo's still playing around with the specs that were playing around with it last year They still might be playing around with it this year And let's get into why they're playing around with it and what this chip could actually be because this is this is crazy so This comes from doctor 81 if you don't know who doctor 81 or doc tray 81 And what however he prefers to be called goes by the dude is a YouTuber that has almost no following and it's kind of sad because he's really good at snooping hiring pages You guys should really check him out link to his channel. You should subscribe to him He's all over these hiring so almost every video. He makes is about a hiring post somewhere that gives info That you know people are just not paying attention to because most consumers and youtubers to be fair are not snooping linked in They're not snooping different websites to try to see what the hell is going on and his information that he finds almost always ends up being Accurate because guess what it's direct information from the actual companies It's not you could speculate from the information, but this is direct information. Okay, this isn't rumors Okay, you get the speculation is one thing, but the factual information is not a rumor So here's where we're getting to non-rumor information. This comes from hiring posts from Nvidia on LinkedIn Holy shit Let me tell you something This is one of the most exciting things I've read about switch pro to date And it is something that really has my heartstrings tingling. I I'm ready to just like learn how to play a violin right now For all the haters out there that are trying to say that this this switch revision isn't going to be anything major So here we go Nvidia is hiring a senior verification engineer SoC system on a chip What's interesting about this position is? It says that you know the position is going to verify the world's most powerful SoC's for use in self-driving cars Gaming consoles and other automated machines is notable It's notable Nvidia doesn't have any other gaming consoles that an Nvidia shield TV which someone might bring up is actually a competitor With the Apple TV that happens to be able to game. They don't consider it a gaming console They don't market it as a gaming console They just say gaming is part of an overall Multimedia faceted device it is directly trying to come give an alternative essentially to Apple TV Which also can game by the way, so Yes, that is that is the target anyways of that they don't call it a gaming console They don't call it a gaming console internally anymore They stopped using the Nvidia shield as a gaming console concept back before switch came out Switch is now factually the only gaming console that Nvidia is involved in production in so this post Naturally has to do with a switch of some type. All right now Okay, so they're hiring someone to to work on an SoC. What what is it? Okay, cool We already know a new so season the work. So what does this tell us? Well the post itself links to a blog post from Nvidia about Orin Orin is tech that is slated to release next year for smart cards already been announced already been announced I want to put this in perspective Orin Oh Orin's a beast. All right So you had the original, you know Parker also take her X1 kind of stuff going on Which the technically Parker's a slightly new model the Pascal model, but whatever then they had the Xavier model Okay, that that is using the Volta GPU something that people thought. Oh, maybe they're using the Xavier model It's been out for a little bit can hit about 1.3 teraflops. You know that that could make sense in some way Although DLSS 1.0 isn't very good DLSS really didn't start mattering until 2.0, which happened on the new ampere GPU line, but here's the thing Orin is a beast. Okay. It has 12 arm Hercules CPU cores. These are some of the best ARM Mobile chip cores available. Okay, 12 of them switch currently uses four cores on some really old arm processors So imagine newer arm processors the Hercules version 12 cores that is what Orin runs Orin also uses an ampere IGPU that's their latest 3000 series of graphics cards, although this is obviously a mobile version So it's gonna be cut back. We don't know the number of cores or any of that We do know Xavier was 512 CUDA cores Parker was 256 The one in switch was around the same before it was cut back. So yeah, it's it's gonna have a lot of CUDA cores We just don't know how many the NT8 DL tops is 200 tops on this Xavier was 30 Parker didn't really have any at all It's more of a newer technology the manufacturing process for Orin seems to be seven nanometer possibly eight If Samsung's making the chips could be eight because they have a eight nanometer process with seven nanometer process does exist So they're saying it's being made with that and as a TDP of anywhere from five watts to 65 watts now the chart you're seeing says 45. It's a bit out of date 65 watts is typically what's listed right now 65 watts is the top end So you're gonna get the full 12 cores at full clock speeds the full IPG IGPU at full clock speeds at 65 watts now It's notable the Nintendo switch itself doesn't use 65 watts. Okay, the Nintendo switch does 10 watts in portable 15 watts when docked All right, so that's where you get the cut back at 10 the more powerful switch at 15 And even that's cut back from what the Taker X1 is technically capable of so what's gonna happen here? Well, well, what's this saying this hiring post is essentially saying NVIDIA is working on an Orin IGPU and Orin Tegra chip for Nintendo switch and smart cars and all that as well and with a smart car version comes out next year Here's an interesting part to kind of make this all the more to because people are gonna say this isn't possible One because it's the latest and greatest tech and when does Nintendo ever use the latest and greatest tech? Technically at the time that they decided to go with the Taker X1 in 2015. That was the latest and greatest tech Yes, it wasn't the latest and greatest when it came out in 2017 But it was the latest and greatest from NVIDIA basically at that point There was there wasn't a point to upgrade at that point to the Parker chip. It wasn't that much better So in the end that was the latest and greatest from the partner that they had made at that time So here's the deal Well, Nintendo usually doesn't go for the cutting edge. Here's what we know Okay, they are factually hiring someone to work on Orin for a gaming console the only gaming console they have is switch They are not by the way switches and gonna get 12 CPU cores. Okay, that's not gonna happen It's gonna be cut back that member that that 12 CPU core maximum GPU stuff maximum CUDA cores That's a 65 watts. It's still gonna have a 10 watt profile in portable mode It's still gonna be a 10 watt profile, but at 7 nanometers I mean you could be talking as much as eight cores They could easily double the core count of the current of the current switch and run it at better clock speeds Because they're on a smaller nanometer process, which has better heat dissipation Okay, in addition to that, obviously, you're not going to get you know, the full GPU cores They're gonna cut that back at 10 watts Significantly, but are you gonna get double triple what's available currently on switch? Oh Easily, maybe even quadruple. Okay That's a 10 watts. Now in dot mode. Who knows that's up to the Nintendo and how well their cooling is if they go with a Vapor chamber cooler style, which by the way, you guys think it's only like Xbox it does it most phones these days are using vapor chamber cooling It's very efficient. So if they go with an updated cooling design, and we don't know if they're gonna do that But if they did, I mean they could push the chip in dot mode from 10 watts to 20 or 25 and That could lead to even bigger boost We don't know this for sure. Of course, that's just pure speculation We just know that Oren is a chip currently in the works for switch and Oren is Significantly better now. There's gonna be talks about how there's a chip shortage, right? There's a silicon shortage How the hell is Nintendo gonna get all these new chips made during a chip shortage during a silicon shortage? Well, I have news for you Factually silicon is being prioritized for chips that are going into cars Okay, that's such as the fact this Oren GPU is going into cars next year the Oren GPU or the Oren chip the Orategra chip is Factually being prioritized with silicone at manufacturing Switch doesn't need the top tier Oren chips Oren chips are going to have a a Creation rate that's going to have a bunch of chips that are bend their chips that are just not good enough to meet the spec For the smart cars they are going into okay. That happens across the board. This happens at 3,000 series 6,000 series from AMD CPUs there's always They have this target that they have to hit performance wise and they don't always get there those chips aren't just tossed in the Garbage often that's when you start to get lower tiers of the chips released Nintendo is on slate once they finalize what they want the targeted specs to be to get the runoff chips from the car Manufacturing so you can make oh we have this chip that's targeting certain specs and certain stuff At the top end for cars this chip doesn't hit it We bin it and it could go to switch as long as it could hit switches target That is what we're talking about here if switch is using an Oren chip that's being prioritized in manufacturing already That's a benefit to switch to not fall behind in manufacturing Now it doesn't mean they're going to be getting as many chips as the smart cars get They get the priority because the car manufacturers have bigger contracts with these chip makers But it is important to note that using the same chip that they are also putting in smart cars It's going to give Nintendo some priority in the manufacturing line for some of the runoff chips So that's that's very important here. Also Dr. Trey 81 did it again and discovered another hiring post at NVIDIA And this is for a next-gen consoles tool engineer So specifically hiring someone to make a next-gen Console tools for developers to use these are the tools that enable developers to take advantage of the hardware and This happens, of course, we know there's a new SOC We know there's new hardware always in development Of course, they need a tools engineer to make the tools usable for actual developers on these new chips But here's the thing the interesting part is it says it's a graphics profiler Featuring NVIDIA GPUs enabling developers to achieve higher and more consistent frame rates So one of the primary jobs is to take what this chip they're making and enable people to get better frame rates out of it DLSS anyone which increases frame rates Remember DLSS 2.0 isn't like a magic brush fix at the moment It needs to be patched in to different engines But NVIDIA said they are working on a way for DLSS to have an impact on games Even if the engines don't support it and one impact it could have is increasing frame rate Even if it doesn't give the resolution bump Without developers having to do anything but obviously have the frame rate unlocked Even locked it could help it like hit that locked frame rate This is exciting stuff guys. This is what I'm talking about where switch stuff is not stopping So what can we grand take away from all of this NVIDIA is factually working on an orange chip to be used in a switch They are making game development tools for that orange chip dev units do exist in the wild But are not final spec. They are still messing around with spec profiles on it These likely could be orange chips in these things just with different spec profiles Nintendo trying to lock down what specs make sense for the price point They want to hit with the chips and the power delivery in the battery life, right? There's a lot of factors in play here where Nintendo needs to narrow down what they want They likely don't want less battery life than the current switch Are they willing to put a bigger battery in there's a whole lot of considerations here and obviously target price points Is Nintendo willing to go up to 399 if they're willing to have this at 399 leave the current switch at 299 and the switch 200 that gives them three distinct price points with three distinct different types of markets They could be hitting where pro is going from the more premium market And all that jazz now a lot of you guys might be wondering why does this matter? Shantara for a kawa if you guys recall we talked about this He put out there that he wants to do something different that Nintendo Nintendo has a history of having these massively successful systems and then nose diving off a cliff And he wants to avoid the nose dive He doesn't want to sit here at the peak of the switch and just rest And not just rest with game development Just rest in general and let the momentum go away switch has all the momentum right now But that momentum isn't gonna last forever and he knows it He knows there's always been a cliff And then the the nintendo falls right off it and then has to somehow come up with a new platform That tries to rebuild them back up. He doesn't want to have to do that He wants to keep nintendo relatively stable at the top in a similar fashion that sony has done with playstation Where playstation always seems to end strong with their sales heading into next gen now I am of mine that when people talk about this ornate chip It could be for a next gen switch. It might not even be for the switch pro. I don't know But here's what I do know It's possible that nintendo Isn't looking at switch as a finite next gen switch a switch to a switch three It's possible that what should in turn for a kawa means by not letting switch fall off a cliff Not letting nintendo sales fall off a cliff is that they're just going to have a continuous ever-evolving situation like cell phones switch pro Switch two they're never going to call it A new switch like they might call a new nintendo switch But you know they're not going to call it like a new generation of switch, you know, this is the next generation switch You're not going to hear them use the terms next generation You're going to hear them use terms like premium or You know for people with 4k TVs 4k switch you're going to hear them use marketing terms that say we're not replacing the older switches But we are giving you something new and keep doing this iterative process every four years That could keep switch relevant for 10 15 years and lead to 200 300 million sales in the entire switch family and lead to the most successful gaming console or handheld Whatever you want to consider maybe both Definitely the most successful hybrid, but there isn't really that many hybrids out there of all time That's what nintendo is looking at right now And that is a very exciting prospect for the future So shinter for akawa is going to have a different strategy than awada had a different strategy than kimashima had He's going to have his own business strategy where he says look I've seen this. I've been at nintendo 20 plus years. I've seen the cliff too many times Let's stop the cliff And the best way to do that is During the peak years of a platform get something new out there Get something new out there. That's what sony does with the slim Again, they did it with the light.  Don't cut them off slow transitions Keep it going keep the momentum Make it so og switch owners. Maybe they don't want a pro or maybe they want the new system that comes out in two or three years for now You see what i'm saying nintendo's positioning themselves and all of these new socs the dlss the 4k the Orange chip that's factually now in the works for switch This is all a movement Towards nintendo creating a more iterative system not a yearly system not even in every two years But every three four five years something new coming out Which feels like a traditional console cycle actually more like every three years because you look at switch lights So probably every three years Having some sort of new system come out that just keeps the switch family going until a point that people are no longer interested in switch And will that point ever ever come to realization? I have no idea for now 720p OLED possible orange chip in the future 1080p OLED whatever's next after orange Or maybe an orange chip that's not as cut back I'm just saying The future's bright Now this is a lot of information Really long video i'm gonna let you guys sit there and digest it I'm still digesting it myself I didn't realize i was gonna have this much switched off to talk about today until i woke up So you guys have a good day, and i'll catch you in the next video


Alright folks, we've reached the end of the last class of the semester, right now it's sad and happy. So if you didn't get the email please, if you have a laptop, put your laptop out, download Docker and get that running on your computer because I'm going to go over probably 15 minutes of talking about web and web vulnerabilities and then we'll start playing with a realistic web application that has known vulnerabilities and we will try hacking as a group, it should be fun. So one key aspect we haven't discussed yet about HTTP, the protocol. So what were the elements of an HTTP request header? What were some of the things that were required there? The version, what else? Version, the type of request, the method, the host, and the host, so you have a host name? What else? The URL? The URL, like slash index.php, whatever you want to hit. The version number and then the header that we saw that was required is the host header. The question is, when you visit, let's say facebook.com or google.com, how does it actually know who you are? How does it know that you're the same person that made a request a week ago? So what information does the server have to identify you in what we just said based on the method, the URL, the host that you're accessing, and the version? A little bit more, they also have the IP and TCP information, so they know your IP address, the source IP, and the source port, but in a big network like ASU's network, we're all actually going behind a single NAT device. So our IP address would be the same, so if a website was using that to identify you, that would be very bad. They probably know what OS you're using and what you're using. Possibly depending on the user agent field, but that's an optional header, it doesn't have to be sent. The key problem is how can you make a complex, really cool web application if the web server acts like somebody with amnesia, or every time they see an HTTP request they go oh, new HTTP request, great, here's the page you're looking for, and then you click on a link and they go oh, a new person I've never seen before, here's that page you want, right, continually over and over again, and so this is actually a nice thing about HTTP because it is stateless, it's nice in the fact that it's simple. The downside here though is that well, if you want to actually, most applications you interact with, you want to create a session with them to interact multiple times, so you can log into the application and then they can give you access to different things based on who you are in that application, right, all the things we talked about about authorization and authentication and access control. But with HTTP there's actually no built-in mechanism to do that. So we need something that allows us to do authentication and there's three main ways this is done, you can kind of fake it by basically when you access my site I'll put some hidden information in every URL on that page I generate just for you, so that way when you click any of those links that will get sent back to me. The main way though is this is done using cookies, so what are cookies besides delicious? Yeah, so just like a little tip and go to the store like with the browser and everything. Yeah, so the idea is basically the website needs to have some way to ask the web browser, hey, store this little bit of information and next time you talk to me use that information so that I can identify you. So cookies are basically date value pairs, the server will add a set cookie header in order to ask the browser to save this information in the HTTP response so you can set a cookie of user equals foo and then the browser will on each further request add a cookie header that will have this cookie so that way I can say hey you're user right well like maybe like this I can say your user foo and that way every request that you make I can look at this cookie value to see what user you are. Servers can do multiple cookies, if you do something like curlgoogle.com you'll see that they actually ask you to set these really complicated cookies here and these are actually much actually pretty complicated there's all types of things you can do in here about setting how long the cookies are valid for what path of the web application they're valid for so on and so forth we're not going to go into all of these details. So the user agent is supposed to follow all these directives to expire cookies when they're expired restrict cookies but the browser can delete them anytime as anybody cleared out their cookies from the browser before never you've never done that you clearly never call the support line because that's like the first thing they tell you to do and you're like this is dumb this is no way this is gonna actually do anything this happened to me like last night. So but what's the key so when the web server gets an HTTP request with a cookie header what security guarantees does it have about that data so think about it this way I'm a web server you're a browser you send me an HTTP request and in my response I say hey set cookie user equals to food and then the next time you make a request you set a cookie you send this header cookie colon user equals food what security guarantees do I have about that data was that none what does that mean so break down with it so fundamentally I have absolutely no trust in this data right this cookie data you as a user could change it from food to admin still the same as it comes to me all I see is user equals admin and so I go cool you're an admin that's nice you could give this cookie to somebody else somebody else could inject these a malware into your computer to steal this cookie and so they can then log into the website as you so using cookies in real life is actually quite difficult and you need to use either encrypt encrypting some value here or using an h-mark or one of the other things that we talked about at least so that that way users can't forge their own cookies and create their own cookie values so now that we have this now we can actually build web applications so previously when we talked about we have this client in the browser we have some web server and then the client makes an HTTP request to the web server but now instead of the web server just sending back static HTML content we have some backend web application that the web server talks to and says hey here's this request and the web application's job is to generate html which the web server will then send back in an HTTP response so how do you rob a bank I don't need guns and use guns then you're looking to help your sentence when you get caught how do you rob a bank does anybody watch the movie ever stick up the teller stick up the teller that's the first thing you do yeah so you've performed some kind of reconnaissance right you say who works at the bank you try to identify every single person who works in that bank what's their role who's the bank manager who has keys at the bank to the fault if you just stick up the teller the teller gonna be like I have a hundred dollars in what do you care take this money and then go to jail like they don't care what you want is that money that's in the fall they need to know who has keys to that ball and even more so when are they working because if you rob the bank when the manager's not there doesn't have the keys you're not gonna have a well you're not gonna at least your reward is gonna be much smaller what's the guard schedule like when do they take a break when do the guards change why is this important is useful information in your bank robbery well you try to find a time when you're gonna have the least amount of resistance to what you're doing so if it's during the guard changes it could be a time you're kissing up yeah or maybe one maybe you have some of the guards in your payroll and so you know that one the other one always takes a break in a certain time of day so you can target that time what is the layout of the bank look like I guess seeing the ocean's 11 they like build a replica vault that's exactly what they're doing here is building the layout of the bank so they know it like the back of my hands don't know where everything is right what does the vault look like what kind of lock does the bank use what kind of security mechanisms are in place how does the banks alarm system alert the alert the police when they're being robbed how does that work can you cut off that communication all kinds of stuff and this is actually even the movies you know they show it as like a montage sequence but they're like sitting across the street at a coffee shop with like sunglasses and a newspaper seeing who works there but it's a very critical part because if you don't understand the bank you won't actually be able to successfully infiltrate it right and the other steps kind of vary off you build some kind of crazy library plan everything goes wrong and you probably end up in jail as most of the movies or somebody turns you in or something like usually you don't get the step forward so don't cut things but the question is can we use that mentality to rob a web application so when we think about that we're thinking about penetration testing and how can I find vulnerabilities in a remote website and the steps are actually almost identical where you first perform reconnaissance you want to understand as much as you can about what that application does and how it functions how does the application work are their user accounts do those user accounts have different privileges how are the privileges enforced maybe you can get around the privilege enforcement what is the layout of the web application look like in terms of URLs does the URL structure have something does it have like a slash users or slash home and maybe think like oh what if there's a slash admin that happens to be world open what URLs should only be accessible by a certain privilege so this is actually a pen testing I did a while back was on a website that handle credit card transactions and so you could see your history of all the credit card transactions that happen for your business and what they use is it was a PDF and there was just an integer number in the URL for whatever 1000.pdf so we're like hey what happens if we put in 1001 and it showed us somebody else's bank statements and credit card transactions and so we were able to enumerate that to get all the transactions from the last like six months to a year for that that company had ever processed yeah they're not I mean they're happy that we found that but they were a little bit sad that that happened but if you don't know understand the application you won't understand what happens when you mess with mess with things this is why I think in the one of the first time I did like a a challenge type thing where you have access to the server and I say you get a room you get a bunch of extra credit points I had some students that didn't quite understand what that meant and so they did like LS slash LA slash and showed me like look I can see the roof of the file system that's where you need more reconnaissance to understand the application like should you be able to see the root of the file system yes otherwise you won't be able to do it what's the input what's the output and actually a thing that you're trying to do is understand how is this web application probably written so this is why oftentimes some of the best pen testers are former web application developers they develop applications they understand what are the things that I would be lazy about doing when I wrote this web application so you can kind of think of like oh did they check this thing because I know that's always a problem then your next step is to develop some kind of vulnerability hypothesis so you want to think like a scientist right not like a robber you're trying to think oh what so for instance going back to the example huh what would happen if I change this ID number would it show me somebody else's credit card statement or not and so then you want to test that hypothesis and so actually the first time we did this so we have like a URL like an ID of a thousand and you tried a thousand and one and it gave you a 404 error message and so you know the hypothesis was oh that would give us somebody else's credit card statement but it gave us a 404 and now the question is okay what do we actually derive from that hypothesis well it could be either that it's not vulnerable or it could be that there exists no report with the ID 1001 so we tried up to I think like 10010 it took like five or ten and then we hit some PDFs that were not ours and so we're like yes this is awesome this definitely works so you develop some exploit and then you profit because you need to not only be able to say hey I you know there's a big difference saying I think there's a vulnerability here versus saying there is a vulnerability here and here's an exploit like what we showed them was hey here's all your credit card processing reports of all these different companies for the last six months they're like okay that's a good thing my advisor tells the story they were doing pen testing for a bank a web application for a bank in Brazil and they were hired by kind of like a middle manager like not a super hire up because the company didn't really care about computer security but this person who hired them did and so what they did is they went into this meeting and basically knew who was going to be at the meeting and told each of them their bank account information like how much money they had in their account to the bank and that definitely woke them up to the fact like oh not like oh you have a sequel injection in your application blah blah blah technical jargon blah blah blah they were like no these are your bank accounts and by the way if we wanted to we could transfer that money to our accounts and so that's why developing an exploit is incredibly important part and then the profit is mostly in terms of if you're doing this for as a profession that's part of your job if you're doing it on the side you should only be testing websites that have about mounting programs so you can do so successfully without actually going to jail well I suppose I'm missing a slide there should be a slide about how to do this without going to jail so you don't want to end up like these people and go to jail you want to actually make the world a better place by fixing security or abilities and getting rewarded for that so the short version is don't hack anything that you don't have permission to hack so you can hack into my server because I gave you access and I gave you all the okay to do so if you're pen testing you need a letter from the company with a sign with like which called your get out of jail free card that says that you that they hired you for this in case anything happens that's kind of your ticket out the bug bounty programs now are awesome there's hacker one there's bug crowd many popular websites have bug bounty programs and say hey if you abide by these rules will pay you if you find something as long as you tell us about it and don't violate these rules so Facebook has that Facebook will even give you an entire fake Facebook network to work on like a fake test network so you can create accounts and try different kinds of attacks out to do that so we're thinking about reconnaissance we need to think about in terms of injection vectors thinking about what are all the ways that attack or controlled input can make its way into the web application and so any place where user input goes in the application so from what we've looked at what are some examples what was that login so form data so any data coming from a form what else the URL itself we can attacker can make this actually one of the key things that's different from a web application versus a traditional binary is you can access any URL at any time right it's up to the web application to stop you whether whereas with let's say like an Android app you can't just force it to go to some page that's not currently up in the GUI right it doesn't make sense to think about but a web application you could try to request any possible URL so query parameters the path post parameters anything else cookies yeah we just saw cookies literally any header data so all the header data that we send we didn't talk about the refer her header which if you look very closely as misspelled but this is a header that tells you what site you came from so that a web application knows and websites now kind of where you came from sometimes this data goes into logs that are viewed by admins which could have secret action or cross-excripting vulnerabilities with them so this is another place any files you can upload maybe even other websites so this is part of that reconnaissance phase is understanding what does the web application touch and where where to get data from right so you see oh this web application is using some tweets and wow it's not using like an eye frame looks like it's pulling those tweets in from a back-end somewhere what happens I might try getting tweets into there that are malicious somehow and I couldn't change the data emails all this kind of stuff so we're gonna start playing with Waco Pico so Waco Pico is an intentionally vulnerable web application that I run for my master's project at Santa Barbara and the idea is it has got actually I don't know I think it's 16 different vulnerabilities inside of it spread throughout in different types of vulnerabilities and also behind different types of crawling challenges the idea was to test well how good our automated vulnerability analysis tools so there exists a whole category of tools that you point them to our URL you click go and they'll try to find all vulnerabilities in that URL so once you have now this test site with this with known data you have ground truth and so you can we can test and see how well the scanners did so the scanners did horribly they not let's see total they didn't find more than 50% of the vulnerabilities and that's group so like all scanners union together and a single scanner didn't find more than 40% of the vulnerabilities so it was very interesting results so we're gonna play with this so if you've got Docker you can run this Docker command and then access it here how many people successfully are able to install and run Docker on their system and then you can run this command and then can access the URL to just look at those cool alright just like is anybody been able to do it on Windows there's like weird steps on Windows where the forwarding so I think it's probably enough of you that it's nice so the problem is I stood up one instance that's publicly available but basically you'll all have access to that one instance and so when one of you messes it up it's gonna be messed up for everyone and I have to reset it so it's super annoying to do that so this is great because when you can get this to run you can just run it locally and test to your heart's content on this nice yeah so it's the website so if you get up and running and you can access it here you should play with the application because we're gonna take about 10-15 minutes play with the application then come back together and talk about what does it do right so think about that reconnaissance step we want to do that for everyone else you can use this URL I stood up I didn't I didn't give it a domain name but make sure you can go here to get to this page and start playing around. Do you need the Docker stuff too? These are the Docker commands. The top one is the Docker command and the bottom one is where you go. I'll show you here it's basically there and you can see the whale and like quick question if I've got the Docker run then I would be using my the LL right look back a little that would be the local host yes yes yes if you want to see the traffic yeah the Docker thing won't like tell you that it's ready but it does something like this it's like hey I've started this actually a supervisor it doesn't matter but it's running that I I I I I All right, this means the reactors been breached Okay, so Let's discuss, okay, so what do we know about black out pico it's a php application How'd you find that out? Could be a php application we actually didn't talk about it, but you can Basically move URLs around so it's not actually php, but yes, that would be a definitely a good indication That's executing anybody else application Let's wait on that we'll separate functionalities from vulnerabilities, but we know as part of functionality that there's an admin Console right the different part of the application Yes Interesting okay, so we definitely know it's php on which page If you go Okay, so we have this admin link here, so we see there's an admin area what else do we know about this application? What did it do? Images what about images? You have to log in so how do you create an account? Register I can say foo bar password foo Create an account So upload pictures. I can look at pictures. I can what else can I do? What was that? You can buy pictures you can add them to your cart and then you can remove them You can continue to confirmation You can purchase them Look at all this. I'm so rich What else anything else? We're in which oh, you're uploaded here. Yeah, interesting Let's so yeah, it's more. Yeah, the reconnaissance. Yeah, you're trying to think about like URL structure So we'd want to verify somehow that this is our user ID, right? But well who's our user ID that we just created? Purchase does not have that which is kind of interesting. That's something that's a guestbook cart Has a log out functionality. Thanks. You can log out log back log in foo a search All right the Definitely So there's two main web vulnerabilities. We're going to learn about today one is sequel injection the other one's cross-site scripting SQL injection is More serious in terms of when you have a sequel injection as we'll see the capabilities and allows the attacker to do are Pretty significant, but they're not necessarily as prevalent cross-site scripting is much more prevalent The idea is actually sequel injection comes back to what we talked about about altering parsing So it's all about so web applications store usually state instead of in the file system in some kind of database It can sequel injection can allow somebody to steal all the data in your database alter your database and and Change the contents of your database or bypass the log in so you can see here really I mean confidentiality Integrity with altering the database there's actually a third one where sometimes they can delete your data So that would be availability really really bad vulnerability and The problem is fundamentally that web application So we saw that component in our diagram this php code is Generating sequel queries to send to a sequel server using some code that looks like this So we didn't go through all the syntax of php, but everything in double quotes is a constant string So it's This is your php Combination is with a dot operator, which is super annoying But you have select start from users where IV equals and then a single quote and then concatenate that with whatever is in an ID parameter and Concatenate that with a single quote and then a semi-colon. So what's this used for let's say for instance like in our nice The example we found of our purchase pictures, right? Maybe trying to figure out what are all the pictures that this user has purchased So if the ID is let's say 10 Right the php application is just concatenating strength, right? This is what you've been doing since learning Java and see and everything. It's literally just putting bytes together, right? So the result from this from php side is going to be select star from users where IV is equal to 10 Now when the sequel server sees these bytes it has to interpret this and say What sequel query did the Developer want me to execute? Well, and so it parses it right it parses it according to the syntax of a sequel query and it interprets it based on the semantics So that's what this coloring is. It's it's gonna basically say oh, it's the select keyword So select all columns from the users table where the ID column is equal to 10 And so the sequel sort of be like great I know how to do this. This is a valid sequel query I'll query the users table and return everything and that's IV is equal to 10 and what did the Developer based on this first line. What did the developer? What's the intention here of this query? Yeah, or to I mean if you look at it at a high level what it's looking for is give me everything in the users table Where the ID column matches the specific value and if we assume that IDs are unique This should always ever return one value or one row right Now what happens if we put something else in here what happens if let's say we put in the ID is negative one or one equals one So what's gonna happen in the php code this fake php code do anything different than it did in the previous case No, it's just concatenating bites The idea is it's concatenating this constant string with whatever this ID is with this final constant string So we'll get the we'll get this value which is going to be select everything from users where ID is equal to negative one or one equals one So what then a sequel server it looks at this parses it is the valid sequel query for people who Don't sequel. Yeah, it's a valid sequel query. It's a hundred percent valid. What is this probably going to return? Nothing. Those are two very different answers So we want to go in the middle like half of the things every hot thing So why which one's correct? Where I need was true How do people know our sys so select is a keyword the star is the columns From is a key word users is a table name where is the key word Equal sign is part of the wear clause. And then what's this? Yeah, so just like in your programming language if you have a Characters enclosed by single quotes It's going to treat all the fights in between those single quotes as a string So would you expect let's say if you had a single quote in like a Java code that if you had negative one or one equals one that would somehow value true. No, right? These are just bites Right, it's tricky because it looks like it should evaluate to something the problem is that syntactically sequel will treat everything that's inside of single quotes as one string value So it's going to say are there any eye are there any rows in this user's table where the ID column is equal to the string negative one space for space one equals one that will probably return what Nothing it'll probably return no no results But now what if we put in IV equals negative one single quote or one equals one So again, right the key thing keep in mind is the php side is just concatenating strings together So it's going to be cabinet strings together and go select star from users where IV is equal to this or one equals one And so how is it going to parse this? Yes, I would Your intuition is correct because it's going to be just like a programming language if you on a line have three single quotes It's things the first two capture, right? So you have negative one or One equals one and then a tick, but we can see here before that point The color of this war has changed. Why is that? It's a keyword and it's outside of single quotes, right? so now The sequel server is interpreting that differently and where did this final single quote and semicolon come from? It came from the php code exactly this last part. So can we influence that? magically get rid of it Yes, we can deal with it, but the question is can we just eliminate it somehow No, because we can't magically get php to execute some different code Then can kind of make these three things together, right? So no matter what we put in for ID The first part will always be select star from users where ID is equal to this with a single quote And the final thing appended will always be a single quote and a semicolon But yes, we can do all types of all kinds of fun things one fun thing is we can use the comment character in sequel so sequel has a comment character either dash dash or a hash mark and so now when the string is then passed to the sequel engine Strings concatenated together Interpreted now everything after the hash is interpreted as a comment which means we don't care about it for parsing purposes So now how many rows is this one return this IV equals negative one will probably fail But we have or one equals one so that will return true that clause will value true for everything in the database and we can even do super fun stuff so we can put something like drop table users after here and Depending on the settings of the sequel server the primary language Both of these sequel statements can be executed so we can do a select and then delete your entire users table So I really hope you have backups because otherwise you are gonna have a bad time We can even insert so we can inject new queries to insert into the admin table a new username and password and so the way to look for this is and The key concept here is that our input in a sequel query should never influence the structure of the query right the problem is our Inputs going inside of single quotes, which means it should never be possible for the sequel server to interpret our data We could be Smarter in some sense and include that We have to deal with it somehow. Alright, so how do you look for these things? Well, you can either Try to do it passively if you put in actually one plus two The sequel server will interpret that as three if it's interpreting that as code The main way to do it is to look for errors. So this actually one of my very first jobs as a programmer was doing this like Social network startup thing The funny thing was we deployed and we had a bug report that came in because somebody whose name I don't think it's O'Malley, but it was a name like this that had a semi a single book in it completely broke the site and this person who couldn't log in could be their pages reading error messages and I fixed it eventually, but looking back on it was a horrible horrible sequel injection vulnerability So you can use names like these to actually try to trigger errors because and what well coded web application should never Change I mean never error depending on your input, right? It could tell you your input is not acceptable But it shouldn't trigger an error So Where could it be possible? Where could a sequel injection be possible? What has to be involved? Database the database is literally in the name sequel injection, right? If so You just explored this whole application you see all these pages you see all these parameters all these form fields Which ones do you test first? Well, you test which ones are likely touching the database or which ones? Do you know have to be touching the database? so Let's look for sequel injection vulnerability. So we want to cause this this crash. So we'll do like We'll do three minutes So guys expiration make it crash randomly typing on a keyboard. We should be able to find some vulnerabilities, right? Or even not you're much better than random monkeys Oh Everybody find anything Hmm, so what so how did you do it? So what do we think this is doing then so let's log out let's go to the login page Food tick bar Password so everyone gets that see the error message Right on the log in so it's saying you have an error in your sequel syntax check the manual that corresponds for the right syntax to use near bar tick and Back tick password equals Shaw one can cat password with salt limit one and line one So this would be the smoking gun that tells us man. There's probably a sequel injection vulnerability here The question is what so what can you do? So when we did one tick or one equals one hash So everyone tried you want to try that so should this log you in right we think about our Authentication there's no user with the username one tick space or one equals one. Maybe there is but that's a separate issue Okay, but we log in and we get to sample users so what so don't don't remember this site And we go to uploaded pictures, what's our user ID one so likely what happened is we Let's go back to the login page Well first we did one which means it'll show us the user No, it'll return all users What we just did this do we think this would work, but so Previously we just log in as as the first user, right? Presumably because what we're doing is essentially returning every user in the database and the code is just choosing one the first user But if we wanted to try to let's say log in as user three No, it works for two Well, I should have used that there we go. We got in this pop I didn't know that that was gonna work. Ah, there is no user three There we go Cool, yeah, so we found one sequel injection. Everybody find anything else. There definitely is one somewhere else I just don't know what's on my head where it is That's why we're on all of you. I don't know. I have to look at the code. All right. Cool. All right So now we can play with sequel injection We can do other type of stuff we can try to steal data. Let me see. I'll try to get this demo of sequel maps going to be installing So the up is cross-site scripting Fers when malicious JavaScript that somebody else controls Executes in the context of your browser your window. So we're not going to go into the details, but there exists a Access control policy in your browser called the same origin policy, which basically means you can have Facebook.com open in a tab and you can have attacker.com open in a tab And that JavaScript code can't talk to each other because you don't want the malicious comm JavaScript code to try to Alter or change your Facebook page or add users or interact with Facebook on your behalf But if the attacker can trick your browser To execute JavaScript that they choose inside your Facebook.com page Then they can do whatever they want so they can actually steal cookies perform actions as you which include On the website, which would mean like friending people Sending your money away. This is a website or my favorite is they can actually do a super sophisticated phishing attack and present present you with the fake login form.  So it goes back to the HTML parsing we were talking about So this is some samples This is php like code or basically the way to interpret this is everything that's in between this This bracket question mark Everything else is static. So you can think about it again. It's string concatenation So this code is equivalent to first output this constant string and then at this point Substitute so the equal sign means place in the output whatever the value is of name variable and then append this constant string So if the name was just Adam, we would get hello Adam That would be parsed by the browser and it would just say hello Adam And it would look something like this But if we can include JavaScript tags in our input We can then trigger arbitrary JavaScript code to execute on this page And so we can do something like script alert cross-excripting which pops up that alert box that you've probably seen before and Again remember the key thing is that the website is very stupid the code It is simply concatenating strings together Sends these bytes to your browser which then parses it and interprets it as HTML So the attacker can actually trick you so if you remember if we go back is there any JavaScript code on this page Is there anything in between script tags? No, it's just pure basic HTML It's very clear the developer did not want any JavaScript code to be executed here But if an attacker can alter this name parameter to get the name parameter to be script alert cross-excripting Now the browser will parse that and say oh The developer wants me to execute this JavaScript code to pop up this cross-excripting Alert box, and if we go on this next page we can actually see that if it's part of this name parameter We'll see this here So the idea is basically when I'm doing this. I'm trying to So the defense against this would be the HTML encoding that we saw the ampersand LT semi colon if the web application Transforms less than symbols to that then we know we're safe So they're actually several different places of cross-excripting in wacko minutes to find them So give me one of these I want to see a box All our box I'll try inputting things like this and don't look at the other stuff. I'm going to make this smaller Is it the right something Yeah Yeah It's just script and then close script and then whatever His exact It looks like I Like I All right All right Somebody want to be my I'll be your hands. Tell me what to hack the guestbook Would which parameter is vulnerable? Yeah, it still works. Okay good Yeah, so actually the browsers since I made this have gotten much better in detecting. So basically they detect hate You sent a script tag and that is exactly what was sent back to us. That looks like a cross-excripting attack We're gonna block it but because but this still works We can see by this name here because all this is stored in the database. So it's a Stored cross-excripting vulnerability anybody find anything else Just this page. Yeah Yes, good good one So yes, there's a flash. I'm not gonna enable flash on this but there is flat Well, let's try it does Yeah, the technical reason is that The scanners are very good at identifying basic cross-excripting and so something like this test. Can they actually execute yet? So this thing is not gonna let me because this XSS auditor But We wanted to test can they actually execute flash for me answer was no cool That was good You need to sanitize things one thing before we All right, so this is about the So the sequel injection vulnerability that we found seems pretty bad, right? Anybody could bypass the login and login as any other user But it's actually much worse as we saw so there's actually a tool called sequel map Which will you can fire at a sequel injection and it will do things like? Let's see what's gonna do Yes, get test so it detects that the back end is my sequel it looks like it found Username as opposed parameters vulnerable to sequel injection Would say for the main test you want to include all tests for yes do everything Do you want to follow? No. Oh No, is this gonna work? So it's detecting a bunch of vulnerabilities here. You know, I don't want to do all that No Just do random stuff No, don't test the others. Okay, so This will all there we go. That's a long so this is downloading the entire database Based on that one subject so it's getting all the values You see it doesn't take very long, I mean it's making a lot of requests, but It's actually going so fast. I can't show you the things that it's figuring out, but it's actually querying Okay, you can query my sequel stores all its meta data in fixed tables So you can query that table to figure out what are all the different databases in your database Then you can query use database to figure out one of the different tables They can quickly figure out query each table for all the data inside of it and so sequel map Install sequel map and you have get install sequel map and you can So again, do not do this on a system that you do not control Okay, this is too much actually All right, so it's too much data in there we could do Look at these options We can do dash dash. Oh, we can do dash dash dumb D. I know it's wacko Wow, this is asking me if I want to save the password to try to crack them with the dictionary attack So, okay, so let's see. Oh, so now we have wacko Sequel map output local hose dump wacko pico So this is every single database or every single table that's in the database So we have all of the the users table We can see this is every single user. So we know he has an id salt login last name trade bucks value password first name created on Literally anything we want comments So we just got everything from this database Stuff is dangerous. Be safe out there Yeah, I guess that's it. Have a good semester.  It's gonna be everything we've covered up until that point I don't ask me anything else. There'll be anywhere from one to a hundred questions Just to tell you that that question is meaningless. All right, we'll be on Tuesday


Welcome folks, we have the down industrial trading down $5.53, NASDAQ is off $346, S&Ps off $83, Gold contract up $30.50, trade in 1902, Gold folks, confirmed ABC structure on the way up, it's taking out a B point today, taking out with volume, $19.45, A to B equals C to D, as the juice behind it, you get 245,000 contracts out here today. Oil, oil down $2, trade in $91.50, a barrel, notes and bonds, the 10-year note, up 18 ticks right now to $126.13, 30-year up a full point, plus 4 ticks at $150, $131, a King dollar, King dollars up $100 ticks, $9,500, Euro $113, Yen at $114.90, and the British pound at $136 to one U.S. dollar. We get up and we take a look at the price by, what we have out here folks, bottom line is that you get destroyed on price, no doubt about that. What we've done here is you're going into the last swing point, last swing point at $123 million shares, bottom line you're never going to get close to that. So I suspect once again, you know, if we come down again tomorrow, bottom line we're going to be up next week because there's not enough selling going on here, well there's enough selling. I'm talking about volume-wise, not holding price, but if we were going to go lower, you're going to see an expansion of volume, not a contraction, and the contraction of volume is also in the Q's, you're down $8.96, you're coming into $80 million, we're only going to get $41 million. So it looks to me like we're setting up a very large consolidation, that's how this is set up. Gold, gold contract caught the bid, it was pushing there, bottom line yesterday didn't have the juice. Today you're over the highs, you have the juice, you've got an ABC structure on the way up, your B point is the Tuesday. At $18.81, let me put this up there, there we go, you needed $215,000 contract, you get $245,000. Let me go into the silver market and see what we're doing with silver out here, so silver right now is up $0.24, silver's at $56,000 contract, it's going to, it's clawing its way higher, let's put it that way, that's the bottom line. Notes and bonds, we take a look at the note and bond market, what do you have out here? This is a dead cat bounce, notes and bonds want lower price, you're going up today with 101.8 million contracts after we went down with 3 million, bottom line lower prices, high yields are coming at us. Stay right there folks, come right back, Dow Industrial's down $5.40, Nasdaq got $3.40, S&P's off $81, come right back.


Epic offers a game and recently two games for free each week. How do they get away with it? Well, first of all, they don't they have to pay the game developers to make them sell their games for free So the devs do have a say in this. Epic is losing 330 million dollars on this investment as well as other exclusive games But it's actually benefiting them. You see before Fortnite most players had a huge library on Steam Now epic is catching up with free games like among us and GTA Players are using epic more and more plus Exclusive games like rocket League and for name make it so that you're forced to play on epic They even lowered their profit margins of in-game purchases to 12% compared to steam's 30 Even though most players will continue to be free to play around 95% The 5% of players who do spend money in the store are the reason why they give out freebies Over time the ones who do spend money will keep on doing so So this means that you get free games epic as new customers and the ones who pay is only changing the platform In which they are on epic has an impressive 56 million monthly uses as of December 2020 And it's much closer compared to steam's 120 million through September 2019 They're linked 5 million new accounts meaning it's spent two dollars and 37 cents per new account That's crazy because those new accounts to spend money here instead of their steam store Look at the numbers on this chart 108 million epic game store customers 700 million dollars spent that's just big money just from free cheaper and exclusive games We know that steam is actually seeing competition Steam even said that don't take down games if they are cheaper on other launchers Especially epic because steam has more than double the users as epic Game developers are forced to make a hard choice, but at least there's more competition Which is always better than just steam this improves you and I at the end of the day And that's not what matters to me at least unless steams does something like epic adding epic will eventually catch up Most players don't care where the game is launched from unless they have other friends and games in that launcher But for new players, they will most likely stick with epic because of the cheaper games Why would epic invest so much is clearly working and they will keep on doing it until they don't see any more improvements Which I'm really happy about


One of the things that's coming out of this outbreak is seeing all the Democrats and people in the media who are apparently aligned with China. And I'm not really surprised, especially over at MSNBC, where they had almost nothing but glowing things to say about Fidel Castro when he died. Everyone over at MSNBC is a communist or socialist to a varying degree. They just go, oh my gosh, socialist. I can't have that. That's going to take all my money. So the first clip I have here today is from MSNBC, of course, and it's Stephanie Ruhl, who has a long history of being a left-wing hack. In this case, she puts on this theatrical performance to deflect legitimate criticism that's come from Mark Rubio about the media's cozy relationship with China. With all due respect, sir, you're not immune to finger pointing yourself. Earlier this week, you called out people that share my job, and I do have to share your tweet in its entirety. Beyond being grotesque, it's bad journalism. I need to ask you this because I'm a journalist. We're not just some personalities. You called out journalism. And I need to understand why on earth you did this. Yeah, because how dare you criticize journalists? As we all know, journalists are above criticism. And just take notice of the attitude on this hack. When have you ever seen her talk to a Democrat like this? It's never happened. Because there are some journalists that were doing exactly what I said. And I posted some of their tweets. This is an ongoing deal here, what we're dealing with right now. And that is a Chinese propaganda effort to put out that they have handled this perfectly and we have not. Honestly, I'm not a huge fan of Mark Rubio, but he absolutely nailed it here. There's definitely something going on between the Democrats and the media, as if China has some sort of control over them. But I also think it's a case of the enemy of my enemy is my friend. Rubio gave some good examples, but there's many, many more. We'll get right back to exposing this latest media con job. But first, I have an important message for all my viewers. The world we live in today is in flux, filled with a flood of information that's often as much gossip as fact, making it hard to know what the real situation is, making it easy for people to panic and make bad decisions. The only way not to get caught up in that chaos is to have a plan allowing you to avoid dealing with empty store shows, long lines, and in the worst case, desperate people. Use today to prepare. A great place to start is storing food in your home. I'm prepared and I ordered even more recently. With this unprecedented emergency, orders are being delayed, sometimes eight weeks or more. I urge you to agile order to mine today. Take action so you're ready for what's coming and save $70 on a two-week emergency food king. When you go to my special website, preparewithdrotech.com. Those that know what's coming are preparing today. Go to preparewithdrotech.com. That's preparewithdrotech.com. How about the publicly funded PBS, where during a segment called Race Matters, they brought on a representative of the group Chinese for Affirmative Action. She proceeded to attack Trump as a racist and claimed that he was putting people in harm's way by pinning the virus on China. How odd that our media is carrying water for China, even despite our intelligence agencies, who they normally worship, reporting that China vastly underreported coronavirus deaths. Causing the virus to spread even more. Why are our tax dollars going to pay for what is essentially Chinese propaganda? I gotta ask you about some of the rhetoric coming from the highest office in the land. President Trump himself has publicly referred to the virus, linking it to China, despite the fact that health experts here and across the world have said that that kind of rhetoric is dangerous. Well, we think that his insistence in the past of using or referencing the Chinese virus or other administration officials, referring to it as the Wuhan virus, certainly exacerbates the situation. How about New York Times columnist Paul Krugman, who literally parroted the Chinese government and was attacking his own country? Likely in a drunken haze, he tweeted out, quote, America's response to the coronavirus is the worst in the world, which is shocking and has a lot to do with a leader who is completely unfit, temperamentally and intellectually for the job. This graph that Paul Krugman presents is essentially Chinese propaganda and shows the virus trajectory as less severe than in America, which is dubious for many reasons, not least of which the fact that China decided that they would no longer count confirmed cases, those patients who test positive, but don't show symptoms. Another thing Krugman doesn't mention is that America's jump in cases is due in large part to increase testing. These people are a broken record when it comes to throwing their own country under the bus so they can attack their political opponents. And they're sounding more and more like the Communist Chinese Party. Or how about back over at MSNBC, where one of their hosts is clearly relieved that a Democrat pulled out of a House resolution condemning China's authoritarian regime for its mishandling of the coronavirus pandemic. That's almost too much for the mind to comprehend. These are the exact same people that for the last four years have been fearmongering about Russia and who are now carrying the water of an authoritarian communist regime. The Democrat pulling his support from a resolution condemning China and the media hack advancing China's narrative that calling it the Chinese virus is racist. Or that China has somehow handled this all better than the United States. Is it just me or does it seem like China already invaded and won? Does China own these people or have dirt on them? That's been a popular media charge that Trump and the Republicans are compromised by Russia somehow.  This host on MSNBC is the same Chinese stooge that brought on a woman to accuse the religious right of being the blame for spreading this virus. In fact, you're arguing there's more to the responses that we're seeing which is religious nationalism. You have a New York Times op-ed titled, the religious rights hostility to science is crippling our coronavirus response. There are a number of ways in which the religious right bears some responsibility for the current incompetence in our national response. First and foremost, the movement promotes an anti-science culture that rejects the evidence of science, rejects expertise and critical thinking. And that has obviously contributed to our ability to address this issue. That's funny. Lazio certainly isn't right-wing. The left-wing mayor of New Orleans clearly isn't right-wing. The Spanish and the Italians aren't right-wing. I'm sure the Chinese Communist government that puts its religious minorities into re-education camps is quite happy with its lab dogs deflecting focus for them. And putting it on to religious people in the US. Not to mention the political opposition to the Democrat Party. That's all for this episode. If you feel like hitting that like button, please do. It really helps the videos. And if you subscribe, make sure you hit that bell icon so that you receive notifications. I don't think you'll see my new content otherwise. If you enjoy my content and you agree with my mission, please consider supporting me on one of these platforms. You can find all the links in the description and pinned comment. Thanks for watching. Keep coming back.


Hello, Monet family. Welcome to our reunion. We hope you are doing well. Actually, we hope you're doing great. I mean, under these strange circumstances, I feel we have so much still to be grateful for. Our customers still have a high desire for our products and we're praying for you. As you've seen, we're expressing our gratitude to our customers, but including a free hand sanitizer in every single order for 15 days. So that includes supporting our customers, also our market partners, but also we're supporting many of our gratitude ambassadors, many of our gratitude partners. And we are even supporting the state government here in Florida. Natural hand sanitizer and we are showing and sharing our gratitude towards the people of the world. What better company to work for? And it's Madison Harnish back in my blue kitchen for another crazy video. Today I had to talk about the beloved MLM company Monat, Monet, Monet. I've heard people pronounce it a ton of different ways. Today I'm going to talk about Monat and how they are currently handling this pandemic. So if you enjoy deep dives into anti MLM content and unethical business practices, definitely subscribe down below and give this video a thumbs up. And well, let's get into the video. So if you don't know what Monat is, Monet, I'm probably going to pronounce it like 12 different times throughout this video. Sorry about that. Monet is an infamous MLM company most known for the lawsuits filed against it for the hair loss that its hair products caused. But what does Monet have to say about themselves? Let's go on to their lovely website and read it. The length of this page. Meet the Urdeneta family. It's probably as hard to pronounce as Monet. In October 2014, we officially opened our doors for business. In a short time, we have accomplished incredible things. Thanks to the dedication of our market partners, the enthusiastic support of our VIP customers, and one-of-a-kind home office staff. Monat, Monet, whatever, starts with changing your hair and eventually changing your life. Yeah, it starts with changing your hair by making it fall out. So if you want to just like start fresh, just, you know, scrap what you have going on right now and just start with a clean slate. Monet might be your deal and eventually changes your life by emptying your wallets, leaving you with nothing but damaged hair and broken dreams. Then if you go to culture, you scroll down a little bit and it says culture. We care about more than your hair. I would argue you don't care about hair at all considering you cause it to fall out. But okay, we pride ourselves on the naturally based products we create. Naturally based. Role ingredient list. No, no, no, no. Right here. Yeah, our true pride is in the lives we change through our incredible opportunity because changing lives is seriously fun business. If you have fun by causing people to lose money, there are some serious issues with you and your mentality. So a lot of us have been really curious about how MLM companies are handling this pandemic. A lot of them have been encouraging their sales reps to continue selling their product and pushing out their product. And it's a little bit disheartening when a lot of people are out of jobs, struggling with money, just kind of overall not in a position to start a new business. I mean, I think that there's a study that most Monat purchases are about $85.  So what does the company say about the pandemic that's currently going wild? Let's see what they have to say. We understand we're all navigating through a lot of uncertainty right now. The fact that you understand that a lot of people feel uncertain about their future, their career, their financial stability. And you're still encouraging people to reach out to those same people. Now is the time to be a light and share positivity. Some of you have extra time on your very clean hands. Tap through for a few recommendations on what you can do to stay busy and productive while you're at home. Let's see what the lovely and caring company Monat has to say about what we can do to stay busy and productive while at home. Because you know, they're just giving us tips and advice. Read a book, disconnect from the world and enjoy a good book. Awesome. I love a good book. I think we all do. Rejuvenate scalp oil treatment. I mean, that's not really an activity to keep me busy and productive. It's just a product that you guys sell. Okay, what's the next one? Let's see. Do a face mask. I like face masks. They want you to use a Monat face mask. Okay, what's the next one? Let's see. Enjoy some snacks. Nice. Yeah, I too like to snack.  Remember to snack wisely. It's easy to get off track at home. But up your fruits and veggies to boost your immune system. Love that word boost that your immune system. You guys know that's my favorite word. I also just love the subtle jab. It's like it's easy to get off track at home. Okay, so so far Monat has told us to read a book because we're stupid, use two of their products because we're ugly, and eat healthy snacks so that we don't get off track because apparently we're fat and ugly. The majority of those tips were their own products. Gotta love that wholesome unbiased advice from Monat. Then recently it came out that Monat will be donating 240,000 bottles of hand sanitizer for their charity. And I just had to talk about that because looking into the numbers, it's not as charitable as they make it seem. I made the shortages of medical supplies and disinfectants due to COVID-19. One South Florida-based company is doing what it can to give back. Today Monat, a company known for its hair products, is shifting gears and will now be manufacturing hand sanitizer at their Miami-Dade production facilities. So I'm going to read all of Monat's posts from their Facebook about this charity. Let's see what they have to say. We're pivoting to produce hand sanitizer gel. For 15 days, beginning at 12 p.m. ET, on Tuesday, April 7th, we will include a complimentary two-ounce bottle of Monat hand sanitizer gel in every order placed. In addition, our Monat gratitude team is donating 40,000 two-ounce bottles of Monat hand sanitizer gel to children's services organizations, homeless shelters, and community centers on the front lines. So the majority of their charity is giving away a two-ounce, which you guys know, two ounces like this big bottle of hand sanitizer with every purchase. That's the majority of it. Just think about that. With a purchase for two weeks. Just think about that. Second post. We're grateful for our customers and the opportunity to give back. Producing hand sanitizer gel just fell right. Each order placed for the next two weeks will receive one free two-ounce hand sanitizer. We're also donating 40,000 to communities in need. To our customers, thank you. In case you didn't realize it, with every purchase of our award-winning hair care and skincare products, you're helping to change the lives of our amazing market partners. The thing that bugged me the most about this entire thing is a lot of the news coverage, the press articles, and the MLM distributors are talking about the hand sanitizers as if it's this giant charity that the company's doing. When in reality, it's like a giveaway. It's like a two-week giveaway on all orders of Monat with a small, tiny amount given away to different organizations as well. It's not really a giant charity, and it pales in comparison to the charities that other companies are doing right now. Okay, so you get it. They're selling the hair products they always sell, which are very overpriced, by the way, and then giving you a tiny two-ounce hand sanitizer to go along with it. So what do the distributors have to say about this? We are showing and sharing our gratitude towards the people of the world. What better company to work for? I really do. So, to all my current VIP customers, if you have a natural hand sanitizer, you're in need of a hand sanitizer. That's naturally based. It's not going to dry out your hands. No alcohol is in it. You just have to go in an order. Just place an order and you'll get it for free. How amazing, right? So off of that, I wanted to mention one of my favorite anti-MLM Instagram accounts. It's anti-shampoo dealer. Definitely check them out guys. The owner of this account is amazing. I love them. And they post some really informational stuff, a lot of stuff on the ingredients behind MONAT, the business structure, just everything if you really want to learn all about this company. They had a lovely comment to what this distributor had to say. They said, MONAT is donating 40,000 MONAT branded hand sanitizers and giving away 200,000 of them to anyone that places an order for the next 15 days.  Just another MLM taking advantage of this global pandemic to make a buck. Oh, and don't forget Miss Mandy Sue with her lies once again. Alcohol free and naturally based. Check those ingredients again. Literally like the first ingredient is alcohol, so it's not natural. Nice marketing ploy MONAT. You should be ashamed in taking and donating all of those 240,000 sanitizers to the essential workers, homeless people in need and hospitals. Here's another post by anti-shampoo dealer. 240,000 bottles made in two weeks that we will make zero dollars on. And anti-shampoo dealer says an average price on a VIP order is $84. So you mean MONAT will be making over 16 million on those free hand sanitizers. Yes, they're only donating 40,000.  They really hit exactly why this charity is such a scam. The only thing that this charity is doing is encouraging product sales for the MONAT company. It's genius but like evil genius if you think about it. It's at a time when I'm sure they've seen their sales decline because of the coronavirus. So they decide to come out with this good press and this charity, but the majority of the charity is all about customers purchasing more products for these donated hand sanitizers. So all it's doing is boosting their sales at a time right now when it's just it's not about company sales. Since press is a free form of advertising, it made me wonder the only real thing that they're spending real money on is the 40,000 hand sanitizer. And I had to wonder is that less expensive to produce and give away than if they were to do a big advertising campaign right now. Cause most companies when they do an advertising campaign and it's a big one and they're a larger company, they spend at least $20,000 on that advertising campaign because they garnish a lot of free press and a lot of their distributors talking about their company with this whole charity going on. I have to wonder if the cost of producing 40,000 bottles of hand sanitizer is less than $20,000 which is how much companies usually spend on an advertising campaign. They usually spend a lot more by the way but that's just like a low baseline number. I ended up doing a lot of research on hand sanitizer and if you do any research on hand sanitizer right now you know that the cost of hand sanitizer is rising dramatically. It's becoming more and more difficult to get your hands on hand sanitizer and I honestly wouldn't be surprised if a lot of people from Oneit bought extra hair products just so they could get their hands on some extra hand sanitizer in this time when it's very difficult to find hand sanitizer. Currently New York has the worst of all states in terms of like their corona cases and the outbreak. So New York Governor Kumo has organized and rolled out a program where New York the state itself will be producing its own hand sanitizer to give out to government agencies and organizations so they released information on this as well as the cost of producing this hand sanitizer. According to Kumo, it costs $6.10 to produce one gallon of hand sanitizer for New York State. So let's just say that generally applies to most hand sanitizers since most hand sanitizers main ingredient is alcohol. The MONAT hand sanitizer is only 2 ounces. So if it costs New York $6.10 to produce a gallon, which is equal to 128 fluid ounces, that means it would cost MONAT 0.095 cents or around 10 cents to produce one of their MONAT hand sanitizer bottles. 10 cents. That means bear with me on this one, I'm gonna keep going on the whole math tangent but it's gonna have a conclusion. That means that MONAT's $40,000 hand sanitizer bottle donation will cost them $3,812.50 to make. That's a big, big difference from the $20,000 ad campaign. $3,000. If you think about the charities that other big companies do, this is just pennies. For example, last year MONAT made $314 million. So this $3,800 donation is literally pennies to them. Now let's take this a little bit further. Remember the free bottles they're giving away with every product purchase? Since an average price of a VIP order is $84, if MONAT is giving away free hand sanitizers on 200,000 purchases, that would mean if the average price was $84 that they would be in total making $16.8 million on those 200,000 purchases. The revenue of what they're making from those sales is $16.8 million, where for each order it only costs them 10 cents more to give away these hand sanitizers. So what's the approximate amount of money lost on this hand sanitizer order giveaway? $20,000. Yeah, so they're making $16.8 million, and they're only losing $20,000 of that profit. So from this charity, they're only losing about $23,000 in total. Pennies for a company that made $314 million in total last year. For a company that doesn't even need to pay or compensate its sales force properly. This looks like a ridiculous charity scam, to me at least. This is just one example of a company pretending to be charitable for good press and a marketing ploy. And it's really sad to see so many people falling for this. If a company's charitable acts look sketchy, always look into the numbers. And definitely be wary if a company's donations, charitable donations are reliant on people purchasing products. Like that's red flag number one here. Because that isn't really that selfless now, is it? And that's really all I have to say. I wanted to share some of the crazy things that I've been seeing with Monat lately. There's so much to cover on this hair company. There's a lot of great YouTubers who have done great videos on Monat. I'll include links down below to their videos if you'd like to check those out. They don't know I'm doing it because I'm nobody, but I just thought if you want to look more into it, you can through their videos. But yeah, I just wanted to talk about this. It's interesting to me. It's weird. It's crazy, but I'm not surprised. And I'm sure you guys aren't either. And if you like this video, give a thumbs up and subscribe once again. Gotta say that twice in the video. I don't know why. It's just what most people do. And I hope you guys have a good rest of your day. And until next time, have a good one.