In this video, I'm going to show you a super cool attack that leverages local file inclusion against a blacklist to achieve remote code execution by abusing PHP code injection in the HTTP user agent header. Keep watching to learn how to do this and more right now. What's up everybody? My name is John Hammond. We're looking at Natus level 25 and I think this level is awesome because it ties together a lot of cool techniques that we've seen in previous levels and things knowledge that we've built up so far and it bundles them together into one really cool attack. So I'm showing you this in the web browser first because for one thing the source code looks better in the web browser for these levels because it has the PHP highlight file like syntax highlighting and all that. But in this case, I want to show you the functionality of this before we jump into attacking it and writing our script. So it looks like it's just a static page with blank text, which is weird. We haven't seen that before in Natus, but we do have a little bit of functionality up at the top right. It looks like it'll let us change the language that we're viewing this text in. It looks like EN for English and DE for German and that's about all that we can do. So thankfully over the wire in Natus these wargames let us see the source code as to what the code is doing. So let's take a look at what that actually is here. HTML stuff is not important, but the PHP stuff that's highlighted is interesting to us. So a lot of functions being defined at the very, very bottom. It just gets the content of the web page. Looks like there's a PHP function or a set of the PHP code running this list files function that it defines up top. And then the main section of the content creates a new session uses the set language function that it defines up top. And then I think these variables that are being displayed come from something earlier in the code. So let's actually explore what those functions really are. List files, language as F, so a temporary variable for just displaying the options for what it's reading out. Looks like list files must be used to see the potential like English or German or other different languages that we want to read this message or this blog post in. And that looks like it's going to be used as an include because we see for each list files and list files it gets read all those things out just as file names. And that option that we give it looks to be a form. You can see just barely in the HTML here. It's not highlighted pretty, but on the form submit the option that gets sent to it up at the very top you can see a function set language that determines. Okay, if we have in the request a language being set, whether or not we chose English or German, it's being passed to the safe include function by default will just return English. So this safe include function looks like it takes an argument for the file name and it tries to check for directory traversal. Okay, interesting. If string string file name, okay, dot dot forward slash so trying to determine if the notion of the parent directory is present inside the string. Then it runs this thing log request that will say, okay, directory traversal attempt fixing request. And it looks like it just replaces and tries to remove that up directory notion or that that attempt to go into the parent directory. So that's trying to prevent local file inclusion, which we've seen before is a significant vulnerability. It looks like it does that log request, which is another function down here. Log request gets the current date adds it to a string that it keeps concatenating and adding things onto. It adds the HTTP user agent. So it would say like Firefox or Chrome or Internet Explorer, whatever browser you are using. And we've seen that before also we may be able to change. It's another HTTP header that we can manipulate. That's interesting thing to note. And it adds the message. So that must be the, okay, directory traversal attempt fixing request, the argument that's passed in. And it puts this in var www natus natus 25 logs session ID. Okay. And that session ID is that PHP session ID that we've seen before in our, in our cookies. So we know that value when we're working in our script because we can just get that out from our cookies. Interesting thing to keep in mind. Another interesting thing that we saw in the safe include function is it tests if the natus web pastoring is in the file name. It will log, okay, illegal file access detected aborting. It's not going to allow us to simply type natus web pass in whatever file we're trying to read out of the language keyword or the language variable that we're passing to it. And then it looks like it makes sure the file exists. It'll actually include it at the very, very end. So that looks like it's how it's getting that greeting message and footer variable that's displayed on the page. So okay, really the only thing we have to work with is this language variable. So let's try and hit that local file inclusion. Let's see if we can actually get it to trigger this directory traversal attempt and see if you can replace those dot dot forward slash dot slash as to see that up directory or the parent directory and what we're looking for. Okay. So over to sublime text. I've got it printing out these page results right here. And there is a long quote, blah, blah, blah. Okay. So let's try and post to this something with the language parameter being set post with data. Lang can equal. Let's see D just by default that will give it to us in German right because that is okay. Yeah, that's the file name that it's getting. So let's try and change that to just forward slash or dot dot slash dot slash dot slash go up a couple many directories and let's try and read et cetera password because we know that file will be on the system. So if we were to get a result, we would be able to see it. And it looks like we don't have anything that that fires. But that makes sense because that log request function is just writing to the file as we know in the source code. It's not writing out to any output or anything that we can particularly see. But we know that it is replacing those forward slash is the dot dot forward slash is in the up directory because that would at least be removed. According to that string replace function. So let's try and actually not give it a file here and see what it does because I had an interesting hiccup that I saw earlier. We see a lot of PHP warnings and notices if we get it to fail without reading actual file. It says here fails to open stream. No such file directory in the current location of that script index dot PHP, et cetera, et cetera. So an interesting thing because it's not able to actually read these variables. It's not able to include anything. So we know we do have that local file inclusion potential. Now we have to actually get around that blacklist or trying to replace these dot dot forward slashes. So it's an interesting thing because it's simply doing a replacement operation. Because what's to stop us from trying to hide or kind of camouflage or whatever you'd like to think of it as or trying to sneak in some more or like an actual parent directory or up up dot forward dot dot forward slash notation inside another one. Right. Because if we're running a string to replace dot dot forward slash with nothing so it'll go away. Why don't we try and put a another dot dot forward slash inside what we have before. So it'll replace maybe the innermost one. This will go away. But then once it's left after it's completed that replace operation. You'll have just okay the skeleton or the makings of an original like up up like dot forward slash you'll be able to actually transverse that see because I was able to put in just another one here. That's all that it tried to find and replace. And then once that is gone, you're just simply left with the same string that you wanted to begin with. So that's going to be an interesting tactic. Let's see if we can actually get some local file inclusion by using that style. I'm going to include that a couple times many times because we don't exactly know how far up the directory we're going to going. But let's try and include a set of a password. Let's run the script. See if we get it and we do. Okay, cool. We just leaked out a set of a password on the box. So now we need to figure out how we can actually get the password for the next user. This is an interesting thing, right? Because the source code has this explicit other blacklist operation. If Natus web pass is in the original file name that we supply, it will log the request and exit it won't let us actually have the functionality anymore. So what can we do instead? This is a really cool attack. And I think this is an awesome thing because it takes a little bit of ingenuity thinking outside the box. But also keeping in mind the things that we've learned in previous levels and combining them for an awesome attack. So let's think what files do we have access to right now? Literally everything on the file system, right? Literally everything on the file system, including the logs that this application like saves and reports for us. Because we know the location of this log, we can potentially get it to be displayed for us. So we know we are going to have one entry in this log file because we're using this directory traversal. It'll say, okay, directory traversal attempt fixing request. Now let's see if we can actually read that file by trying to locate this file in the file system. So we need to know the session ID, but we can do that right because we've got a session that we can create. Let's write a get request to begin with. So we actually get a session set up and then let's determine what our cookies are when we try print session cookies PHP session ID. Let's not display the other things just so we know we have a session here. Cool. Yep. That works just fine for us. We can index it just like that. So let's go ahead and try to like read that file. We know in the source code it's var www, natus natus 25 natus 25, et cetera, session ID dot log. So changing the file that we're trying to read now to not et cetera password, but that string. Remember to concatenate on the dot log extension. And remember we do want to have our session dot cookies PHP session ID right there. And that should be concatenated on just fine. And now we should be able to read that. Remember to print out the output. I managed to drop that. Cool. Now we're seeing that log entry. We're seeing the time and date. This has occurred. We're seeing our user agent, which right now is Python requests because we're doing this in the script. And we see that message directory traversal attempt fixing the request. So we know it's no replacing the dot dot forward slash. Okay. Now here is the next cool and awesome part. Because we can control what this HTTP user agent is. We actually that that is input for us. We can modify that HTTP header. So because we're including this file and because it's being spat out from the web server that is looking at PHP code normally, right? We've got notices and warnings and all these other issues that are coming through. What if we put PHP code as our user agent? Let's try this. That's going to be really cool, right? Let's get a headers dictionary here. Headers can equal user attack agent. So that's set up. And then let's use just the syntax to run a PHP file command right here. And now what do we want to do? Oh, how about determine the contents of, you know, the natus password that we want natus 26? So how can we do that? Well, it's PHP, right? We can just run shell commands. We've got system, pass through, et cetera, all those things. So let's just try system. And let's use our classic cat, et cetera, natus web pass natus 26. Settle display it on center out for us. And we'll be able to read it because we can specify we want our user agent to be this string, which will get injected into that log entry, which we'll be able to read because of local file inclusion. And then it'll evaluate that PHP and give us remote code execution with this super, super cool. Try headers equals headers to make sure we include that user agent. Let's run this. And what do we got here? Excellent. Our user agent is now the password for natus level 26. Sweet. Let's go ahead and save this as a new script. Natus 26. We can clear up the junk that we have here.  And let's see if we are greeted with the next level, make sure that's the right password. And it certainly is we are on natus level 26. So cool. Thank you guys so much for watching. I really do hope you enjoyed this. I love this level, honestly. This is I think one of the coolest levels that natus has so far and that you're combining all the other tactics and techniques that we've seen so far and making a really interesting attack. Take advantage of that HTTP user agent injecting that PHP code so you get remote code execution through the local file inclusion that you already ran through like some little like blacklist evasion and I thought that's awesome. So, hey, thank you guys for watching. I want to give a shout out to my supporters here. This list is getting pretty lengthy and long, so I'm super duper grateful. Thank you guys so much for all of your support. I love that you are willing to go on this adventure and journey with me. So, hey, if you did like this video, please do press that like button. Maybe leave me a comment. Let me know what you think, what you'd like, what you'd like to see, what we could have done better, how you solve this, etc. If you're willing to subscribe and if you really want to support me, check me out on Patreon. Cool. See you soon, guys.


Not an impossible comeback, but definitely not what I'm too comfortable in. Oh no, it's over. Oh, the range! Oh my goodness, I thought it was over, but it's not! How's it going, everybody? Dots and I here back with some more Dragon Ball fighters, rank matches. This time, playing a team of Bardock, Super Baby 2, and Goku GT. The real reason we're using this team in this order, though, is just so that I can use Super Baby 2's bee assist, because that's mainly what I wanted to focus on. This assist is really, really good, and I wouldn't even be surprised if it got nerfed. Not because it's, you know, super broken or anything, like, it's not. I wouldn't call it amazingly crazy. Like, it's not the best assist the game's ever seen, but the tracking on it is second to none. I can't believe how much tracking they gave us. Like, look at that! That was just an example, but my goodness, he was in the air, and baby was like, yeah, nah. I don't think I'm cool with that. It's like a, it's like a sea assist, basically. It is really, really good. But with all the timings, like, it recovers just as quick as a bee assist. All right, we gotta switch out. I know we said I wanted that assist, but nice to age! Nice! Now, now mid-screen. He got the bee assist as well! Extension-type stuff, I like it. I might spark. Nah, okay, I'm good with that. I see, I knew he was setting up for that, but I got so nervous. I got so scared. Bee assist back up, do we see it again? We might see the bee assist one more time. I'm actually more comfortable with GT staying in though. Oh, let's go! That was sick! All right, how do I get this to where I can do a drag rush? All right, I'll take that. Oh, if that would have res- Oh my, the backwards tracking on it too is also really good. Another great ex- You know what, we just got two examples! I wish I wasn't on the receiving end of this example, but I'm- I thought I got 2H for that reflect. No, all right, we'll just go ahead and take a low then. Goku GT gets us a slight character lead. Obviously, our health bars are a little more messed up, but now, super bee assist bee assist isn't available. Look at the- Dude, it's cra- You know what? Like, I was gonna say- I was gonna say they have to nerf, but I don't know if I want that, because I think I'm gonna main super ma- He's just really well on my main team, but- Man, what a powerful assist. It's crazy. Bee assist are really getting all the love these days. Like, that could have been- That could have been an A assist, and I don't think anybody would have cared. I don't think anybody would have batted an ID. They would have been like, wow. Like, if- Like, back in the day before season 3, when we could only have one assist, if that was baby's only assist, people would be like, yo, that's so sick. He got a good assist. I went low. Oh, we are just vanishing out here. I went under. I'm backing up on that. I'm so afraid. I don't want to lose my assist. I don't want to lose it. I don't want to lose it. I'm out. I'm out. I'll just bar dock so I can live another day. Reset. Oh, nice reflect. He was playing on the ball fighters. My man had his eyes on the road. I like it. I like that a lot. Yo, Jida's going to start doing some stuff here. Ah, this is a lot of damage, actually. I got hit with a 2M, so it makes sense. B assist just to set up dragon rush. And I am dead. I am long gone. You know I'm catching a death ball. It's on its way. I can feel it. Oh, the revenge death ball. I'm gone. Yep. That was a chunk of damage. What was the health, though? I didn't- I actually can't remember what the state of the game was. Okay, so, yeah, we're kind of leaking a little bit here. Oh, I had a combo. I just gave it up. All right, get him off me. Oh, I knew he thought I was going to drag a rush, partly because I really wanted to drag a rush and something was just like, ah, not that. Don't do that. I did that all wrong. I'm 2H'd. Wow, I can't believe I didn't get 2H for that one. With the track record of the UI Goku stuff, I definitely thought I was catching one to the face. Okay, this is really not great. I would have loved if we could have killed Super Baby. One mash on that. Okay, good. I'm glad you respected that. I should have gone into something way sooner. A beam. I should have gone into the beam, I think. Okay, not an impossible comeback, but definitely not one I'm too comfortable in. Oh, no, it's over. Change. Oh, my goodness, I thought it was over, but it's not. Gallant gun. It's only just now starting. Big damage. Oh, safe jump setups. Okay, we're in a much better position now. It's a one-touch game. It's a one-touch game. He has three bars, though, so we have to be very careful. He's got his feet set way before I did. Oh, no way. Oh, what a vanish, though. I'll give myself credit for that. Oh, my goodness.  I'm actually crying just thinking about it. I really wanted to vanish, but I mean, you could probably tell by the way I was playing, but I was really scared to let my feet leave the ground. But oh, my God, I should have just done it for the combo. That would have killed. That would have been so... He's probably pissed right now. I'd be pissed. The B assist, by the way, still busted. Oh, my God. That was so funny. I can't wait to watch that. That was so funny. I can't wait to watch that back in editing.  I couldn't believe my eyes. I just kept mashing Key Blast. Not like I wasn't intending to combo. I was just throwing Key Blast to like, you know, hold the game back in place so I wouldn't lose footing. That was so funny, though. Oh, my goodness. That was the stupidest combo I've ever hit. Oh, my God. That was so funny. I got a guard cancel. I mashed there. I'm glad I did. And I got to stop doing that third hit. Oh, medium drop would have been the perfect move if I was a bit more accurate. All right, we got to switch out. Guard cancel out. Gojita struggles with that much like my boy Yamcha. I'm thinking he's going to... I really thought he was going to command grab. Oh, I should have kept blocking. I should have kept blocking. I tried to make a heavy read. Real dangerous read. I don't recommend doing that. And now I'm going to pay the ultimate price for what I thought would get me out of there. Oh, so we flexing. We're flexing. Not really. I mean, he's not going to level five here. Even if he wanted to, he couldn't... I'm dead. But that was... That level three is sick. See, maybe two is back out. I do want to get him out of here. I'm too H for that. Yep. Again, I... I guess players like this, you can really tell. He set the pe... He set the record. When I do stuff like that, I'm getting too H for it. I wanted to call the assist. All right, we spark. Super Dash was good. I don't know why I thought that would be the answer to Super Dash. Down, B assist, already tracking. Woo, that assist is good. That B assist, not so much. I actually don't like Goku's B assist. The beam, I don't know. It's a little too slow for me. Like, I'd much prefer like a cell A compared to that. Even though the angle's a bit better on Goku.  All right, well, if we win this one, it's gonna have to be even more of a comeback than before. And last time we got pretty lucky. I'm actually still laughing, dude. Like, I still, I... See, I don't like Goku B assist. That was... I didn't even think that should have worked. And I'm the guy that, if I didn't work, I would have died for that. Reflect here. All right. No reflect. I'm glad he didn't. I'm so bad at the game, dude. I'm literally like, I'm so bad at the game. It's hard to describe how bad at the game I am right now. Okay, at least that kind of hit. I'm just terrible at the game. Oh my goodness. Oh, I didn't even make it safe. Oh my goodness. Okay, I deserve this loss, but I'm still going to fight against Cruel Fate. Cruel Fate that put me on Earth with these broken thumbs. I'm still going to rage. I'm going to try to avoid this fate. That's like it. But I do deserve this loss. All right, super baby too. What do I do? Trying to hit me with my own super baby, huh? So good against reflect stuff. You've got to be a bit more careful than I was right there. Loops. Loops. One more time. I think you might actually drop like nevermind. He had enough hits done. This is going to hurt. This is going to hurt, but we're still alive. I'm not giving up. I know I should give up just to save myself emotional duress, but I'm not doing it. I'm not giving up. Never surrender. Never give up. Never give up. I'm not giving up, dude. I have never once give up. This is a GT matchup. It's can go. I thought he would throw Key Blast. That's just me personally. I could see how I was wrong. I could see how I was wrong, but I really thought Key Blast were coming.  I didn't stand a chance. I was like, yeah, this is a Key Blast read. He read my read, dude. Insane. Ah, didn't get to use the assist there. Oh man. Okay, we checked that at least. Tracks in the air. My goodness. Oh, tracks in the air. I'm never ready for it. Man, the pressure that provides is insane. Maybe you can jab out of it midair. Maybe that's the answer. I might have to try that. I actually am not too aware. I'm an early spark here. This is bad momentum. You can practically feel loss energy radiating off of this. And that when you can feel that your loss radiating off of the combo. That's when you know it's time to do a spark. Spin the win. Not any too rich. Really? Where are you running? Come here. Bardock has some words for you. Bardock is not going to let that happen. Drag a rush. Wow, he teched it. Bardock, then. The pressure you get off that is insane. Never forget how good that is. I definitely did forget that time, which is why I didn't make the most out of it. Oh, nice beam. My gosh, that is so good. Oh, 2H again. I didn't even think he would do that that time, even though he set the stage for it. Beautiful, making great moves. I'm popping up. All right, we go out in a baby here for sure. Let's stomp on him. All right, we take that. I hit there. That was clean. EX it to make the most out of it. Oh, I got to steal that. I got to steal that. I didn't know you could EX off heavy to get that. That was clean. All right, I'm barring that. Your tech has now been stolen. You baited me, dude. I thought that connected for sure. Get back in the corner. I can't believe I almost got baited.  I'm just doing this for the knockdown. I need to like, I don't know, when things get too chaotic, a lot of time I just level three to feel better about it. I almost did the other combo, but then I was like, why would I do that? There's no need to go for that damage. All right, we baby be assist here for sure. I reflected it, but still that is not bad. That is not bad.  I'm doing it again for some reason. I still feel like we need more control. We go overhead this time, or do we fake overhead below? Nope. Nope. He darkened his spring shot at us. He fell menacing walk. Oh, the Key Blast actually worked there. Nice. That was a good answer. I don't know if he meant to do that. I think he might have just been throwing Key Blast, but still very good. We got to switch super baby two out. No, we'll keep him in for now. Beautiful. Can't ask for much better. Why is he doing so much? Do I just grade it? Why not? Why not Gallagun? I could have done that for a lot cheaper and maybe I should have, but I want to see the animation. Gallagun. Now, do we make? If we if we land one ex grab, he's dead and that would make me. That would make me so happy. Oh, I'm going to do it, dude. Why not? Oh, I did. He got on the other side. Oh, no. Oh, no. I think if I would have done it, it would have worked. And what do you want me to grab?  I don't think it would. I think I said, oh, it doesn't matter. I got scared to reflect it. I got so scared. I got so scared. All right. Now it's actually crunch time. Now it's crunch time for real. All right. Let's focus. All right. I thought I dropped it. Oh my goodness. But we're going to wrap up this set with a game to three victory. Actually, we lost game two, right? Wait, it is two one, right? Yeah, no. Yeah, we lost game two.  All right. Let's see if we can win the next game as well. Great games. All right. So here we are up against an angel rank. Oh, I like that baby color. The orange looks nice. Whoo. Look at the trash. See that is just to see it. You can't tell me that's not a sea assist. I don't believe you if you say it's not. I don't believe you. It is a sea. They programmed it into the sea assist and they made a mistake. But it's so cheap. It's baby's best move, dude. It's got to be. It's so cheap. I messed that up. I messed that up really bad. Wow. That was tough. I just got to accept that I was bad there. Whoo. That is hard to accept how bad that was. All right. Gujida. Oh, is he all orange? Yo. Another fan of orange. Another man. Oh. I can't believe it. I definitely need to either spark or I'm going to spark. Man, we lost such a, like, I think good setup against baby. We got to spark. Yeah. It's all orange. I like this team. I like this team a lot. He's maximizing damage. Tell me that doesn't kill. He was one in. He was one second away from getting a level four bars. I don't even think he needed it. Whoo. Optimization station. Man through everything, but the kitchen sink at me to a chat. Okay. No, no, no, no, no, no. Oh, what an extension. Oh, I didn't think he had the range. Right. We got to get out. Okay. It's sparking. It's it's been sparking time. If we could be honest, he did super dash. He waited so long. I was like, okay, I guess he's not, which, you know, would have been fine. If that's what you wanted to do, I would have accepted it. All right. I'll take that. Okay. No, nevermind. Not okay. Not okay. Not okay. I didn't expect the seamless reflected the beat down. I did not expect that. That was clean. We're dead. Slow. Actually, hold on. Wait, wait. Maybe we're not slow fall level three. Drag him or silver one. Now we're not dead. Maybe it is Broly. Hold on. We're not dead. Let's go. He must not have known. Maybe he didn't think I was going to level three right there. That was definite level three territory.  That was a lot of damage myself. Okay. I think first plan should be getting baby out of here. I think that's a little obvious though. So we're going to buy time. I'm out. I'm out. Set my feet. Oh, I should have had that punish back to the corner though. So that's fine that we didn't get the punish. I'll take a level three. And this gives up corner. But you know what? Not too bad. We got it with the baby B assist that I didn't even know would really work there. I was just kind of free styling. Okay. What's the mix? Oh man. I had it. I had it to which the EX a lot of people are using that against me now. I guess that was. I mean, I'd never do that. No. Drag rush here for sure. Oh, I thought that would work all day every day. Cheap dude. You saw him try to reflect to stay away from the pressure. Cheap. This move is so cheap. Regret. Okay. We got a guard cancel there. Oh, regret. Regret. Regret. Lots of regret. I don't know. I don't know that the spark is going to run out before we die. I think the game is going to be pretty much decided before sparking decides it. Yes, dude. That was beautiful. That was beautiful. You won't see me complain. I'm just going to level three here. I don't I don't want to risk anything. He has sparking. He'll heal a little bit. Super Saiyan 4 won't care though. Let's keep a cannon. Come here. Come here. Let me get let me get that health bar for you. Nice. All right. We're at two bars as well. He's going to be at seven. So we might if a wrong little five kills here by the way. So we can't we can't be too aggressive. Nope. I'm not a note. No, not attacking there. God, I'm nervous. I'm dead. I'm dead. I'm dead.  It is bond but it is I'm gone. I'm gone and it's going to look like a flex but really it's just needed. Oh, goodness is going to hurt go. Gina. Maybe mercy mercy. Oh, no mercy. She lie. She lie. Help. She lie. Help me. Wow. So we really just plain favorites. Now you like Broly more than GT Goku. All right. There. What if I don't know why that. It made me laugh. I just thought about what if they programmed in like a 5% chance of you're playing Broly. You just got wished away that actually you know what that should actually be programmed into the game. I'm going to say it. Oh, I should have used baby B. That was so cool. Baby actually got away. Okay. So he's still is one of says. All right. Now we're both assist list. Things are about to start. Yeah. There we go. That was cheap too. I'm really focused. I don't know why I've been so focused this video. Oh my goodness Broly just talk to me that if you don't want to react and wait too slow. Just barely understood what was happening to me there. I was like that is a grab get back in the corner. Let me talk. I gotta stop. I gotta stop mindlessly mashing. This guy is moving. No, I did it again. I mindlessly mashed. I did it right after I said not to and then I started jabbing again. All right. Baby's back in the driver seat. Call me baby driver. Let's go. That was so corny into just getting destroyed. Not bad. Challenging me. I thought Goku assist had that. I thought Goku had that. I think I just got reset as well. Vanish. I'm maybe I'm alive because of that. Let's go. I don't I don't know why you vanished. That was not supposed to be old. Mayday Mayday. This game is looking real bad. This game is looking like it's entering a real bad state. But oh, we're living again. Just barely. Okay. Good. Actually I have a lot more sparking time than I thought. Why? Why? Oh, they came back. Two H'd. Oh, DP is pretty good as well. Oh, Big Bang. Okay. Still possible win. Not incredibly likely. But if I just believe, I believe. Got tired of that. She needs more buildup time. These were buildup time to hit. Huge damage. Huge damage and sliding. What? How did that work?  Maybe I've just been doing your wrong. All right, odds of powering level one hitting here. I mean, killing here. Super Saiyan 3 comes through. Actually a little bit more damage as well. So we had a little more room than I thought. All right, that was big. That was big. I do it again. Do it three times. Just be safe. Mercy. We should be fine as a normal level three. It's not. I didn't know you could get slow level three off that. I forgot. So we're dead. So we're just dead. Oh goodness. Why, Broly? What a monster. Well, I think that's going to go ahead and be the video. Do we get one win this set? Hopefully you enjoyed it anyway though. If you did, definitely let me know down below in the comment section by hitting the like button or by letting me know your favorite moment. And if you want to watch more videos like this, definitely make sure to check out the ones that should be on your screen right now. Other than that, you can always like and subscribe, of course, if you want to support the channel. I have been Datsudoya. Thank you for all of the support. And I will see you in the next one.