Statistics and Excel Poisson Distribution Roller Coaster Line Example Got data? Let's get stuck into it with statistics and Excel First, a word from our sponsor Really? Yeah, actually we're sponsoring ourselves on this one because apparently the merchandisers they don't want to be seen with us but that's okay whatever Because our merchandise is better than their stupid stuff anyways Like our trust me I'm an accountant product line Yeah, it's paramount that you let people know that you're an accountant because apparently we're among the only ones equipped with the number crunching skills to answer society's current deep complex and nuanced questions If you would like a commercial free experience consider subscribing to our website at accountinginstruction.com or accountinginstruction.thinkific.com You're not required to but if you have access to OneNote we're in the icon left-hand side OneNote presentation 1536 Poisson Distribution Roller Coaster Line Example We're also uploading transcripts to OneNote so you can go into the View tab Immersive Reader Change the language if you so choose Either read or listen to the transcript in multiple different languages Being able to tie into the video presentations with the timestamps OneNote desktop version here in prior presentations we've been thinking about how to represent data sets Both mathematically using formulas like the average or mean quartiles the median As well as pictorial representations like a box and whiskers or a histogram The histogram typically what we visualize when we're thinking about the spread of data using terminology such as It's skewed to the right or it's skewed to the left We're now looking at families of curves that can be represented with equations Which could give us more predictive power if those curves could approximate our actual data set In prior presentations we looked at the simple curve of the uniform distribution We're now talking about the Poisson Distribution It's more complicated but it's not poison It's not that complicated It's Poisson Poisson Distribution So we have usually this is going to be related to like line examples When you're talking about oftentimes business type of scenarios So that's what we will be using here Imagining that we're waiting in line for a roller coaster ride So x equals the arrivals during one minute So we're trying to show how many people are arriving within a one minute time frame That's the time span roller coaster ride That's what we're dealing with And then the mean is what we're generally going to need If we're going to be using the Excel functions So let's imagine that in practice We were trying to determine the data related to how many people are showing up within a line And then we'll see if there's any observations We can make about it to see if it fits a Poisson type of distribution In which case we might be able to use a formula To give us more predictive power about what might be happening in the future in relation to the line Now in Excel we can have a random number generator here To approximate the Poisson distribution with an element of randomness in it So if you want to check out Excel you can do that We'll work this problem in Excel as well But instead of just using a random number generator We're going to have to give Excel the mean In order to create random numbers in accordance with the conditions of a Poisson distribution And so these are the numbers that we get from that random generation I think we generated like a thousand numbers in the example in Excel Although we didn't put all those numbers here in our practice problem in the one note So if we had all of our numbers what do these numbers mean? Well it means if we're sitting there with our stopwatch Seeing how many arrivals are happening during each one minute time interval We're waiting as each one minute passes and saying Okay this time and that one minute four people arrived In another one minute time interval three people arrived In another one minute time interval two people arrived In another one minute time interval six people arrived And so on and so forth I'm going to skip over here to the left now Once we have our data we can put our data into our bins or buckets So these are the arrivals that have shown up And we're going to say okay let's count the arrivals This represents the number of arrivals The people that have been showing up Within the time intervals which we said was once again the one minute So now we're going to say of the thousand counts that we had How many times were zero people arriving How many times was one people arriving two people And we're just going to count these items over here In Excel we can we might call that a frequency And you might use an equation like this to do it Now note that you also might say Why don't I use a count if function You could you could say this equals count if Meaning if you find zero in this number of fields over here Excel I would like you to count the number of times a zero shows up However sometimes when you use these random number generators It doesn't give you a whole number or something like that So sometimes that formula doesn't give you the right result So the frequency often picks it up more accurately I have found which is a spill array function A little bit more fancy frequency And then we're picking up the array over here And then the data bins here And this actually just spills out the formula So this means that I believe we did a thousand X's a thousand one minute samples To see how many people arrived and zero people arrived In sixty two one minute intervals One person arrived in one hundred and seventy one One minute intervals Two people arrived in two hundred and forty three one minute intervals And so on and so forth So if I total this up this number down here Should tie out to if I sum up this column The number of of samples that we had If we did this a thousand times the number of random number Generations that gives us a double check That everything is is properly calculated This is going to be the percent of the total So if sixty two people Sixty two times zero people arrived Then that means that sixty two out of the thousand times Sixty two that divided by a thousand or six point two times Is the percent That that zero people arrived out of the thousand So we can represent this as a percent of the total Right so if one seventy one Times one person arrived in the one minute interval Out of a thousand one minute intervals I could take one seventy one divided by a thousand And we would get the seventeen point one and so on So then we can say okay well if I look at the mean of the data We can we can calculate the mean And I could just use my formula in Excel to do that And that would be an average formula So I would take the average of this data set The whole thing I'm just taking the average of the whole data set Adding them up and dividing by the by the number of events Which was a thousand and then the variance This is the variance using the population formula And the variance using the sample formula And the point that we want to come out to is the mean Of course is close to the mean that we had when we started out Now remember that if you were doing this in practice You were sitting there with a stopwatch counting the arrivals You might not have any you might not know the mean You might have an idea of it but you wouldn't know what the mean is The reason we started with a mean here is because I need the mean In order to to generate these random numbers In accordance with a Poisson distribution So so notice when I take the mean over here Obviously it's going to be somewhat close to but not exact To the mean that we put in when we generated the random numbers The point we want to look at however is that if I took my data And also did my common calculation of the variance of the data Which would be this formula then if it's close to the mean Then that is an indication that it might be following a Poisson distribution So if I look at this if I looked at my data And I said okay is this giving me any predictive power On how I'm going to regulate my lines at the roller coasters And what not and how many people are going to show up Well then I can start to say let's analyze the data with the mean of the data Let's take a look at the variance of the data if those two are similar Then possibly I can approximate what is happening here With a Poisson distribution representing it with a formula Which will make it easier to kind of make predictions into the future We can also plot this information so if I plotted the frequency So we're plotting the frequency here So here's the numbers zero up to 29 Remember that when we're looking at a Poisson distribution The idea is that it could go infinitely up in this direction It's not going to in practice because it's not like an infinite number of people Are going to show up in a one minute time interval That's very unlikely but in theory it's like going up to infinity That's why you will typically have a skew to the right So this isn't exactly bell shaped It's going to be basically skewed to the right is the general idea Now if I plot this data we're saying hey this looks kind of like a Poisson type of distribution And we know the mean is equal to the variance So that's giving us more evidence that this looks like a Poisson type of distribution This is the same thing but instead of representing the numbers in terms of the count The frequency column we're looking at the percent of the total So you can see you can in essence represent the same concept with the percent column As opposed to the and you get the same kind of distribution look and feel Quick look over here if I was to remember calculate our If I was to think about the mean and the variance calculations You'll recall that if I take all my data sets and subtract out the mean Which is this number we're looking at the distance between each of our data points The number of arrivals that showed up in a one minute interval Minus the mean and there's our difference And if I was to add up all the differences I don't have all my data But if I added up all the differences in a thousand samples it would come out to zero So you'll recall that we had to do something to get our number of spread Which is usually the standard deviation and the variance We squared it so we squared it so this is the difference squared Making all the numbers positive but also a lot larger as they are now squared Summing that up that gives us our two five five three So the squared sum of the difference and then if we divide that by the count Which was the thousand we did a thousand samples that gives us our variance Just to show you how we're getting the variance over here Another format to get the variance and then if I take the square root We get the standard deviation Okay so then let's now say okay well it looks like it might be a Poisson distribution So now if I take my same data the number of arrivals I'm going to use the mean This time I'm going to use the mean that we calculated in our actual data Two point three seven three And I'm going to use that to generate our Poisson dot dist Function so now I'm going to say let's take my same number of arrivals could be Either zero one two three four the number of people that arrive in a one minute interval And I'm just going to now estimate it not with my actual data But with a Poisson dot dist because I've now come to the determination That it might follow that function which gives me more predictive power And so all I need with a Poisson dot dist You have the X which is going to be the one the number of arrivals zero one two And then comma the mean all you really need is the mean And the mean we have over here at the two point seven three And then comma the cumulative the cumulative argument is going to be If it will be cumulative you're asking What's the what's the likelihood of say like zero to three people would be cumulative Up to three which would add up these percents Whereas if you say it's not cumulative which we're doing here false or zero Then you're going it's going to say what's the likelihood of just one person arriving Just two people arriving in this case not zero to two people And then we get our percent likelihoods this percent likelihoods Is is kind of similar to our percent of total column we got over here We're not getting the actual frequency because we didn't actually tell Excel How many tests to run we just use the Poisson distribution to give us this percent This percent column and then however many tests we run whatever the sample is We can multiply times the percent to get the actual numerical values right So that's going to be our Poisson formula If I look at the difference between what we got here with the with the Poisson Versus over here I got two point six point two seventeen point one twenty four point three Versus six point five two seventeen point eight twenty four point three So this would be another indication if I'm doing this in practice I'm like okay I got my my data set and look like the mean is close to the variance Which means it might be a Poisson distribution the actual graph looks kind of like a Poisson distribution If I plot out a Poisson distribution and look at what I got in my actual data set Compared to the Poisson distribution in terms of percentages it looks pretty close Which means that the Poisson distribution might give me some good predictive predictive power So so this is another I'll I'll go over this in a second let's first go to the right here So if I if I take the mean of the Poisson distribution obviously it's going to be that two point seven five And I can get that mean by and so remember when we when we calculate the Poisson We put in that it was two point seven five but if you look at this column here This column is taking column x times column p of x So if I multiply those two columns out all the way down so this is like this one is like two times point two four three Gives us about point four nine and then I sum up this column That's one way that we can get the mean over here so we get the calculation of the mean And we can also do that with a formula which is a sum product formula Just to get an idea on the Excel formula this is going to do the same thing So it's kind of a fancy formula that could be useful from time to time Some product and then we're picking up the two basically arrays And that will in essence do the same thing right we're taking the sum product of this column and this column So we'll test that out in our Excel presentation if you want to test out the formulas And then the variance if I take this and then this is x minus the mean on this column And then this is going to be squaring that number that's going to give us this column And if I sum up that column that's one way that we can basically calculate the variance And I can also do that with a sum product formula as well which we'll do in Excel if you wanted to do that And put everything into a formula here Notice it's a little bit kind of weird you might be saying well that looks a little bit strange to calculate the mean and the variance Notice it's a little bit different than when we actually had our data over here Because when I actually had my data then we're working with the data Whereas instead of working with like the percentages of the totals Whereas when I calculate the Poisson distribution over here We're not looking at like a sample of a thousand data units We're looking at the percent of the percent likelihood So we're basically saying this is the percent likelihood that one person shows up in the one minute time period So in any case those are going to be those items And then we can ask questions like What's the likelihood that less than that you have less than three arrivals So the likelihood that you had less than three arrivals If I look at my data set now you have to be this is equal or less than So if I went to my arrivals over here I can say well you got 6.52 of zero people 17.8 of one, 24.3, 22.12 So we come out to that what we get over here 70.75 about because those numbers were rounded And then you can also use the Poisson distribution using the cumulative in order to calculate that So you can say well it's going to be the Poisson distribution The X is going to be the number that we want which I just hard coded as three And then comma the mean is going to be the mean that we calculated up top or the one we started with at the left And then comma and then this time the one represents cumulative true or one So now it's counting up to that point zero, two, three instead of just giving us the result for three itself And then here we've got another question that could come up between if we want to be between say two and five Now that's a little bit tricky because in practice problems you want to say okay are you including the two or the five So you have to determine if it's between two and five and you're not including the two or the five Then you're just talking about the three and the four which would be 22.12 plus 15.09 So in like a book problem you have to be very specific about whether or not they're including the two and the five So we put in between the two which means we're not including the two or the five in this case Or you can use the Poisson distribution, this one gets a little tricky because you might say okay how is that going to work Because if I look at my Poisson distribution if I say the cumulative function If I say for five would be how many times it would be this up to five So but how do I get between two starting at two? Well I have to go from this up to five and then subtract out the amount that goes up to two Right so I have to do a subtraction so I could do that with two Poisson distributions in one formula Poisson distribution and then we're going to go up to four in this case because we're not including five So that's where it gets a little tricky because this isn't including five so I'm going up to four Comma the mean and then comma it's going to be cumulative minus we're subtracting another Poisson distribution here Which is going to be going up to two and then the mean and it's also going to be cumulative Alright so if we graft these two things together then these are our graphs two different formats of the graphs So this is going to be blue is the actual Poisson and then the the orange is from our data set So you can see they're not exact in other words if I looked at my actual data set that's what we generated over here That's going to be in essence this chart that we grabbed that we got with our data set or this one with the percentages And then we compared that to the data that we got from the Poisson the actual smooth curve that we got from our formula And they're pretty close so in practice we can say okay we were going to gather our data we then took our data and we said Does the mean equal the variance if it equals the variance it might be a Poisson distribution we then grafted It looks kind of like it might be the shape of a Poisson distribution we then calculated the Poisson distribution Looked at the difference between it and the shape and it looks pretty close and then we can graph it on top of each other And say hey look these two things look they're not exact but they line up fairly close and therefore if I can use the Poisson distribution Then it's going to give me more predictive power into the future because I can just plug numbers into an equation That I have an equation for as opposed to a random outcome of numbers that I have no real way to extrapolate into the future That would be easy without you know more complicated kind of methods


We're here working on the Robosaurus Rex challenge. So Robosaurus Rex was a challenge from plaid CTF 2013, so it's a pretty old challenge. There is a huge gigantic hint in the name, Rob, so this should set you on the right path. In the regional challenge, we have a binary and we have the copy of libc. In this image, we have a copy of the Docker image. So basically we have a Docker container that if you run this command, it will pull it down if you don't have it, and it will run the Docker image when you see that it's listening on port 31337, so that if we netcat a local host 31337, what do I do? Just type in, yeah. It says win, but clearly I didn't win because I need to get a flag. If I read this whole thing, you can see that the flag is located at slash challenge slash flag. Yeah. Super interesting thing here. Apparently the current version of Docker by default uses setcomp to restrict the system calls that the binary can actually use, so if you actually want to go in and debug why your program isn't working or why your exploit isn't working, you have to run this command to disable basically this setcomp because otherwise you can't use ptrace and debug in any program in your Docker container. It's incredibly annoying. All of last week, we couldn't figure out. So Will thinks he solved this, so let's have him walk us through what he found. I'm in the hopper looking at the binary. Yeah. So, well this is a little different. You have to go to the dot text portion because there is no main function per se. Okay.  And so really, well the way I found out, I originally ran an strace to figure out how it was getting our input and it uses a read to get input. So I just went ahead and looked for the actual read call in the binary. And you can see that it calls read. I think it hex 0804, it should be 8466. Yeah. That's the actual read call where it gets our input. And so the next thing that I did just to check when you want to see have a buffer overflow is you just give it a lot of input and see what happens. See what happens. All right. Why? Do you want to go through the... No. Or you could look at this for five seconds. So you can see here that this is the call to read and we can see the hopper here. Oh, well, I see what you're saying. Yeah. Oh, yeah, that's right. It gives it... Yeah, you could look at the assembly because read has three parameters, which is the file descriptor, the buffer, and then how many bytes you want to read in. Exactly. And so hopper is nice because it automatically kind of parses this out. Yeah. So it shows it that far... So 0 is getting put on to far onto the stack. So 0 is the file descriptor. So we know we're reading from what? STDN. STDN. And then the buffer then is going to be whatever was in EAX onto here. And what is here? A load effective address from EVP plus far 88. Then we can see here that it's actually EVP minus 136. So then we know that that's where our buffer is located. So we know that that's... So from EVP to our buffer is 136 bytes. And if we just look at the next argument, we can see how much is this? That... 100? It's just 512? What? I can't see very well. Oh, 256. I was... Where's your next skill? It was... They deteriorated. Okay. No, it's easy. Because ff is 255. Yeah. So 100, 256. Anyway, so we know that we're copying at most 256 bytes just by looking at this, right? 256 bytes onto a buffer that's only 136... Well, the buffer itself is probably less than 136, but we know it's 136 bytes up until EVP. Yes. And so we know after that is EVP and then say VIP. And then we have whatever 130... 140 bytes minus 256 bytes to put extra on top of it. You can also see in the S trace that the read reads in 256 bytes. Cool. You could also do that. But as I showed to actually test that... Well, you could download it on your local machine and that would actually work. Or if you run this command in a different container... No, it gives you... Because you're already using the port? Yes. I think if you change the port, it'll be fine. Yeah. I don't see it for this. You're right. I don't need any port binding. You can see that it called read. Just wait a second. And we passed it to 26. Cool. Just like that. Cool. So we know that we have a buffer overflow that we can execute. So now we need to... What? What would be the first thing that we could do? Well, to test to see if we can actually execute it. Yeah. So how do we do that? We know that on the stack, so there's 136 bytes between the start of the buffer and EBP. So we need four more bytes to overflow EBP because we don't care about EBP. And then four more bytes to overflow EIP. So it's 140 to overflow everything up until EIP. And then, yeah. So I think... I don't know if it'll tell you doing it like this, but if you do it in GDB, it should just tell you that you get a seg fault at, I think, 63, 63, 63 is lowercase here, yeah? We can do this. We can pipe it through challenge. We can see a seg fault there. We can also run GDB challenge. And I do it like this. I do it. So I see it going. I know there's a way, but I think the easiest way is probably just to pipe it to a file outside of GDB. So nice music taste there. Just R. You don't need challenge. I didn't write GDB challenge. 63 is what character? Lowercase C. What's lowercase A? 61. Yes. What's uppercase A? 41. Yes. All right. Useless trivia out of the way. It's not useless. You can use it. That's hex. That's hex. Yeah. Hex 61. Okay. Cool. So now we did that. Now what? So now we want to figure out how or what we want to do, right? So we have a buffer overflow that we can execute. So what do we want to do with that? What's our goal in this binary? Generally, we want to get a shell of some sort, right? Yeah. Well, we want to get a shell. We want to get into their system. In this case, you want to retrieve the flag file. At least we want to get the flag, right? Yeah. In this case, we know exactly that we want to steal the flag. We actually don't care. I mean, executing a shell is usually the easiest. And it gives us the opportunity to do other things if we want it to. But with a bare minimum, because that's another thing you got to think about, right? Is maybe they restrict running a shell or they restrict other things. But if you can still read that flag, that's the key that you want to do, right? So. Objective. Exactly. You're always going to keep in mind what's your objective that you're trying to do. The shell actually allows you to do more things, right? But if you can't do the shell, maybe you can still do what you want to do over reading that flag. So now that we know that we want to get a shell. Yes. What's the very base level of how you, let's say you were writing a C program. How would you get a shell, right? You could use the system call. And system takes one parameter. Do you guys know what that parameter is? Is it a zero or a one? No. For system, it's a pointer to the location of the file that you want to read it. In this case, bin bash. Or bin, bin SH. I'm sorry. Yeah. Another important thing is system is in libc, so it's not a system call. Yeah. So our goal is to basically call system, which is a library called bin SH like this. So what are some interesting things about this program that we know from just running a file on it? It's dynamically linked. It's dynamically linked? 32-bit. First level. 32-bit. That's the first thing, right? So 32-bit program, so we need to do that so we shell code everything is good. It's also dynamically linked. So if we were to run, let's say, ROF gadget. Oh, yes. And I say, I want to do the ROF gadget to generate a ROF chain. It's going to say it actually can't find any gadget. It can't find a right-what-where gadget. So this means that there's not enough gadgets in this code to just throw it into ROF gadget and have ROF gadget throw you back a huge payload to put in that would just work automatically to call. And usually, exact in SH is what ROF gadget tries to do. So we need to be more clever and do it our own way. So what's the goal? So we want to call system somehow. So what? Where's system? Yeah. That system is in libc, but system, because the library is dynamically linked, we actually don't have a hard address for system. Yes. And another key is that they actually provided a hint to us because they gave us the copy of libc. So they gave us the libc version, the exact libc version that they're actually using, which means they think at least that we shouldn't use this information, right? So if we were able to just throw ROF gadget at it and just get a payload, there's no reason we need the libc version. And so it would kind of be like, why the heck are they giving this to us? But they are giving us the libc, which probably means we need to use that. So if we look, let's see, we can just look in case we've never done it before. If they didn't, what happens then? If they didn't give us the version of libc? Gotta do everything by hand. It'd be much more helpful, but you could talk to them. Yeah, yeah. You'll see why we need their libc, but there are tools online where you could actually... I saw something which was really interesting, which... It'll give away the solution right now, but yeah. So you can see that all the program, all of the possible functions in libc are all in here. So things like read. How'd you get that? Loaded it in the hopper. It's libc.so. It was down provided by the organizers. Hopper's free, right? That's a free thing? Yes, it is free, limited time or something. You can't say... It's also $100 or something. Yeah, it's not. I mean, that's a lot. It's a lot, but not as far as these disassembly programs go. Interesting. So we have read here. This is what actually... So we've got to remember when the program loads, the dynamic linker, when it sees a call to a libc function, we'll find this libc on the system loaded into memory. But the important thing is remembering... It gets loaded at a different offset. So the offsets in here, like this library, can be loaded dynamically into any different memory region. So even though we know from looking at ROP and everything in the past that the program's code is always loaded at fixed memory addresses, right? So we saw... That's what Will was talking about. ROP source rex has fixed memory locations, right? So this jread is happening at 08048416. It doesn't change at all. This is always where this code's going to be. But libc is always going to be at a different location. How do you know that that one's always fixed? Generally, if you can see it in the object dump, then it's not going to move. The disassembly, whatever program you use, the disassembly address is not going to move. Will PIE move that, actually? Or no? I honestly don't remember. Luckily, there's a nice CheckSec program, which you can run to say that this program does not have a canary. It says another thing we didn't do, right? This program doesn't have a canary. It does have an X, and what does that mean? That's a good question. A non-X executable what? Stack. Stack, yeah. So the stack itself is not executable. This is what tells us we can't just use a buffer overflow on the stack to put our shellcode on the stack and jump to our shellcode, because we cannot execute anything on the stack. Yeah, the PIE and reloader, I actually don't remember exactly what all these things do. One of them will make the process. Well, I still think the code itself is usually not completely reloadable. I don't remember. I think this is set for every segment in memory. Correct. Yes, exactly. So every segment is, the other way to think about it is write, X or execute. So you can each segment in memory is either writable or it's executable. No segment is both. And that's a core security mechanism here. But we know that we can still get around to it. So how are we going to get around that? So we have to break down kind of what we have to do, right? We want to call a system with BNSH. So this is what we look at when we go to the whole state we want to get into. This is what we want to get to. So how are we going to get there? So there's two things that we need to really get there. One is we need to put the string BNSH into memory, because the actual system call asked for a pointer to the location. Not just the string. And the second thing we need is we actually need the address of system so that we can call it. The address of operator. So that's why this. Right. So exactly. So we need to find the address of system and we need BNSH somewhere in memory. So how, so system isn't located in our program's object dump anywhere. We need no call to system here. Otherwise it would be much easier, right? Yeah. We would just kind of jump because right with the ROP and overflowing the stack, now we can control all the function frames on the stack and so maybe we could make it look different or change the stack to call into system. It would be so much easier because we know when we make the payload of what we want to be written on the stack and overflow, we know exactly what we want things to be. So we need some way to find the address of system and it's not anywhere in our program, but we do have other libc functions in our program like read and write, right? Because we use read to read out the input and if you looked it uses write to write out when at the end. So we know we have the address for those two and we can actually use those to find the address of system. We have to do it locally and use GDB but because we're executing this on their machine and they gave us their libc, we can actually use their libc to find a offset between read and system. Yeah. Because we know in global offset table, we know that exactly at 0804... Do you guys know what the global offset table is? I think so. I don't. Will. So the global offset table basically, so you have a local... Wait, wait, wait. Let's step through. I think that actually... So if we go here, we can actually just step through and see, okay, this is the read call that we had. We know it's... And we know if we look at the man page, it's like man to read. Is this taking so long? So we know first that it's a libc function. So this is good. It's calling it libc. It's read file descriptor, the pointer to the buffer, and the number of bytes, which is exactly what we thought. So if we look here, we think, oh, this calls into the libc library, right? Because that's what we're doing. We're calling the libc function. If we look here, what it's actually doing is it's going to what Haver is calling j underscore read. And we can see here what it's doing is jumping to whatever is at memory location, read at GOT. So this is basically an indirect jump. It says whatever is, and read at GOT specifically is 0804961c. So the idea is, and this is how dynamic linking works. So instead of libc being compiled into our binary and included as part of our binary, instead of that happening, libc is loaded at runtime somewhere in memory, and the dynamic linker says, I know if I put here at, exactly at 0804961c, if I put the address of the read function here, those four bytes, that's what we'll jump to whenever we call read. So this is how you get that dynamic linking component, which is great because now if there's vulnerability in libc, instead of having to recompile your app to distribute it to everyone, you can just update your libc version on your system, and now new applications will use that new libc version. So we know basically what Will is saying, we know at runtime, at 08049614, will be the address of write in libc, and that 0804961c will be the address of read. So we actually have, in memory there will be two locations into libc. The read and the write. So how does that help us? Yeah. So, okay, so now that we know that we can get an address for read and write, we need to find some way to get to system. So you can either do that, again locally through GDB on your thing, or use their libc that they provided, and literally subtract the address of where read is in their libc from the address of where system is in their libc.  Yeah, well, let's look through here because we can see we have libc here. We actually already know where read is. We know that in the program, read is at offset D5980. So in this libc, add this of read is at offset through x D5980. And while system is here, is at offset 0x 3a DA0. So basically, and actually the way, I did it a weird way because I always found that I ended up mixing up, do I get the address of read and then subtract or add from it? So I'd always have to test. So when I was doing this last time, I figured out, oh, I should just get the address of read. So let's say I get x. So let's say x is the address of read on the system. But if I have x, then I subtract this offset. Now I know I'm at basically the first 0th byte of libc. And then I know if I take that and this offset to it, then this is the address of system. So if I take whatever read is, I subtract D5980. And of course you could simplify this very easily, but writing it like this actually makes a lot more sense to me. So D5980 is just a number? It's a number based on inside libc. And it's based on the offset of read in libc. So maybe different for different operating systems or different versions of libc. This is why they provided you exactly this is the libc version that reads. That's why you need to use the D5980. Yes, and this one too. So you subtract that and you have the other one and then you get to the right location. Then we know the address of system. So how do we get the address of read? Yeah, so we don't know what the address of read is, right? We know where the pointer to the address of read is, but we don't know what the address of read is. And this is where the first part is actually just your basic buffer overflow in a sense, right? Just what we did before, right? It's basically going to be, like the payload is going to be A times 136 to get us to the A's plus B times four. This gets us to EDP. Now we're at EIP. So now the next four bytes we go to is going to be the next address that gets executed. So we actually have a function that'll let us print stuff out to the console. We have write in our program. So we can actually write out, and write takes three parameters, which is a file descriptor, a buffer to read from, and how many bytes you want to read out. And so we can give write, the file descriptor for a CD out, we can give write the buffer, which is the pointer to the address of read, right? And that'll then read out what that address is to the console for us. The goal is to get the system basically been SA, right? So what Will's saying is what we really want to do is write out to file descriptor zero, which is standard out. We want to write out... Is it one? I'm pretty sure. Yes, correct. See, that was a test. We want to write out what do we want to read? Read, yeah. 0x0804961c How many bytes do you want to write out? Four, four bytes. Because we're leaking an address. So this is going to leak four bytes and send it back to us from the other side. So essentially this is the first function we want to execute, and then what do we want to do after that? So now we have the address of read. So to get the address of system, we just have to apply our offset that we found. Right, so then we essentially... So let's say calculate address of system based on a level. So now we have the... Now we have where system is located, so we need to put bin s h into memory and then call system, right? So we probably want to put... We need to put bin s h in first before we call system, and so we can use read to do that as well. Right? I want to read from what? You want to read from standard in, which is zero to... You're not even putting any random address here if I do like 41 for that one. No, it needs to be a valid address that you can reach. That you can write. Write to, yes. Yeah, that you can write to. So how do you find that? You can use the read elf. I think dash e will give you what you want. Dash... Oh, dash g. I don't know. What did you say? E. Scroll up a little bit. So this gives us all the segments in the binary. We're looking for something that's writable. Yeah. W's are important. And so you can pick anything. So we're going to write bin s h, but also the string, we have to null terminate the string, right? Because if we don't, and we start writing into some other segment, it's just going to... It's when we go to finally call system and point it to the buffer, it's just going to continue to read everything that we have after that. So we need to write bin s h, which is seven bytes, and then one null byte. So we need something that's at least eight bytes in size. So we don't want to use, let's say this, JCR for whatever that is, because that's four. We don't want to use detours or ctours because those are eight. So we either want to use... Which one did you use? I used .data, I think. BSS? BSS. That's only eight, too. The .dynamic, I'm pretty sure. Yeah. Scroll up a little bit, I think. Oh, no, it's right there. Yeah. Yeah. So, yeah. So we want to read in from standard in into this memory location eight bytes. So this... So that means on our side, we're going to have to send... We'll first read in four bytes that's this address of read. We'll then send eight bytes, which will be slash bin slash s h, null character. Then what do we want that to happen? Yeah. So now we want to call system, but our problem is, is that we don't actually have a way to call it right now, right? We don't have any system anywhere in our program. So what we need to do is we need to put system in our program. And the easiest way to do that is overwrite the address that we found of system with some other function. Or the... We need to... Sorry. We need to overwrite some other function with the address we found of system. So you can really choose any address that you want to execute. Yeah. I learned that you can actually save a line, Adam, if you just overwrite exit, then you don't need to call at the end. I don't think... No, you still need the... Yeah, yeah, yeah. Okay. So for this, because we already know what the address of read is, and we're lazy and don't want to type it out again, we're going to use the address of read. So we're going to overwrite the address of read with our address of system. So here, this is going to overwrite the address that was at 804961c, which is in the global offset table right here, 1c. So those four bytes will now, instead of pointing to... Instead of having the address of the read function at libc, we'll change that to point to the system function. Can you print that out and see it as it happens? Maybe just write out what you're reading into. Yeah, we'll look at the actual code in a second. Wait, what do you mean? Maybe just put, like, binsh, and then the second one, just address of system. So that's what we're we're reading into. And then, we're calling system, but really we're calling read. We're calling the... So we actually want to go here to j underscore read. So that's actually really what we want to do. I mean, this is how it is in Opera. We want to go to this j underscore read function and pass it And so, yeah, that's just what we want to do. Regular, so you would call read again with the same address you've been calling read with previously. Except in this time, instead of giving it three parameters, you're only going to give it one, which is the address of dot dynamic up in SH. So we'd actually call that read with this. So how should we look at your answer? Sure. Yeah. This is... I somehow messed up... Well, yeah, I had one that was, like, commented, but I messed up something and it wasn't working. So I pulled an old version down that I was doing with Voo. But so, anyways, yeah. So I did... I was trying to see where stuff was in memory, so I just did ABCDE to see how it was recycling. Why? Why not? Oh, no, I know why. Because it divides evenly into 140. I mean, I know that. I know that's why it works. Yeah. No, I was doing 4 bytes and I was like, this isn't going to divide evenly 4 bytes. So I did 5 bytes. Okay, so you can see I have two offsets up there when I commented out. I had a lot of trouble because I used the offset of Lipsy in my system, and I had a different version of Lipsy. So I had to use the Lipsy version that was provided to find the correct offset. Interestingly, Voo's Lipsy was the same as your Lipsy, so he didn't need to change the offset. And so I have up there... I know it's kind of poorly laid out, but the address of write, the address of read... Yeah, I remember it's in little end, because somebody doesn't know how to use that function, too. 080483.0c 080483.2c And that's actually... that's not the pointer to read. That's the... that's like the read at PLT.  Yeah, yeah, yeah. So those are the calls into read and write. Yeah. Okay, what's this pop rock? So, oh yeah, we didn't really explain that, did we? So the... So this is the reason why this is a rock exploit, right? It's because the purpose of a rock is we want to use what are called rock gadgets, instructions that are already in our binary to do some things for us. So, for instance, let's say... Oh, okay, okay. It's fine, it's fine. Just because it's a little bit easier. So you can see the layout exactly. So we just focus on, let's say, this part here. So we see we have 136 As and we have 4Bs. So the 136 As gets up to EVP. The 4Bs overwrite save EVP. The next thing is where we're going to go. And this is 0804-830-C. So if we look at Hopper, we see... That's what you're injecting. When? On to the stack. Because we're overwriting the stack. And where we're overwriting is the saved EIP. So this is when this function is done executing. Control the return instruction will go and start executing from 0804-830-C. That's a function called basically to the write function. Now, the question is, this is actually what I messed up a lot because I didn't draw the diagram out while I was doing this. What? The thing that's above the address of... So our three parameters are the file descriptor, which is one. Which is exactly what we have on our scratch here. I don't know if I should go back to that. On our scratch. So we want to call write. So we're calling into the write jwrite. We're passing in one. We're passing in IU's write. So 0804-9614 which is write in the address of the GOT. And then we want four bytes. So this is what the stack looks like. Now, the question is when write is done executing so when I call this function, it's going to go to jump to the saved VIP onto the stack. And where that saved VIP is located is right here in between the function I was going to and the next three parameters. And to really get this, you have to draw out the stack and look at exactly what happens as soon as you start executing that new function. I had a problem where I had too many things in the stack there. I didn't have those in the right place. But fundamentally when we get here ideally we want to then call read 0 this other gadget. So we've written out correctly. But the problem is the stack, the next things on our stack are three arguments that we just had to the write function. So the trick is using finding a pop gadget basically. So if we look and we run rock gadget on here. So this is even if you can't make a chain, it will show you all the different gadgets. So we basically need a gadget that does pops we want. And how many pops do we want? Three. Why? Because that's how many parameters that we put on the stack. You want to go pop, pop, pop. So that way the next address that we go execute at is whatever next thing I want. If I do this, we can see that it's now the read function is where I want to go to. Because we want to call read 0, pop. So we look for a gadget that does three pops followed by a return. And there's actually a lot of those. Yeah, so here No, that's a four pop. Yeah, couple of that. 080484B6 there's a pop, pop, pop return. So each of those pops will change the stack pointer until right before that return this is the address that's on the stack. So this is where we will go start executing at. And then I think now we can go back. Because yours is going to be the same. So you have the right instruction, the pop rock, which is 080484B6 which is the same thing. And so you have the right address, we're going to call right. Afterwards we're going to pop three times. And then we have a file descriptor of 1, read global offset table 080496 1C and byte number of 06004. So file descriptor read that. And the next thing we're going to do is then call into that's actually the BSS address which actually worked. But you can use the dot dynamic as well. Wait, but where's... You're going to pop three times, right? Yes. Yeah. Yeah, that's not part of the payload. That's not part of the payload. I was just writing code, okay, and this is how it turned out. This is much better. So in the future, to structure it, it's better if you kind of have each of the chunks by themselves. I mean, it's fine to use the names. Like, you can see I didn't really do a good job of using the names. I just used constant values and then I messed up a few times where I put different values in different places which is not good. See, I was doing it as I went and then I realized I needed those parts. So then I just added them in as I was... Understandable. Having these in here kind of ruins the flow of like, here's my payload chunk and then here's my payload. I just want to see the entire payload laid out like that. So maybe a good strategy would be to put all those constant values just up at the top. Okay. So we have a read address. We're going to have a triple pop again. And where are we going to read? We're going to read from standard input. Zero, standard input. We're going to read into the VSS address which is this 08049628 and we're going to read into 8 bytes. Then after that since it's going to happen we're going to pop 3 times. We're going to pop, pop, pop. Go to here. Go to the read address. We're going to then go triple pop again. Read from standard input. Into the GOT 4 bytes. Yeah, that's right. Pop, Roppel, execute. We'll go pop off 3 times. And now we're finally going to write... This is actually, I did this because I was messing up a couple times. Yeah. This is debug output. What Will's doing is writing out so everyone can see. So he's calling the write function because he hasn't overwritten the write function. He's only overwritten read. He's calling write, he's doing a triple pop and then he's passing in... That's standard out. He's passing in the read GOT and then he's passing in the write for here. You shouldn't use byte now. Yeah, but I didn't. I can see that. So what's your rationale? Why did you do this? Yeah, so this doesn't actually affect the Ropp chain at all because we're just popping everything off the stack. But what I was doing is I was having some problem because I wasn't getting a shell a couple times. So what I did is I wrote out the address that was at the read GOT which I had thought I had previously written into read GOT. So I was using that write to write out to compare if the two addresses of system that I had were the same. Right? And that's just... I also did it for the BSS segment to see if BNSH was written to the correct place as well. And so you can just use write in your rock gadgets to debug internally. But at this point, our read has been overwritten. It should be pointing now to system. We have some junk because we don't really care. This should never execute. And then we pass in the argument of the BSS address where we put in slash bit and slash message and send it to the payload. So are you done? No, you have a couple more things. So after you send the... So we wrote in there. We're reading in from standard in. So it's expecting us to give some input to it. Right? So we can't just send the payload and get a shell. We need to do a couple more things. Yes, so you've got to think of... Remember this is an interactive shell, right? Because... This is an interactive exploit because essentially we're leaking those four bytes. This is the pointer to read. And so our code, our exploit code has to read those four bytes. Sorry, read that. So we have to figure out where the address of system is in this specific execution. Then write that back now so that when it... We have to first write out slash bit and slash sx0 because that's what it's expecting here. And the next four bytes that it's expecting are the address of system that it's going to write in. So when this rock chain executes... Sorry. When this rock chain executes is actually going to... When it hits the read, it will wait for our input. So that's how we're going to do it. And so this next section, I was very tired and don't judge me. Oh, good. It's Adam's code instead. So we send... So we send the payload and you can see here I also added debugging stuff because I... My payloads were kind of funky so I printed out the representation of p so I could see all the bytes. So we send the payload and now we know we need to receive specifically four bytes from the payloads because the first thing it's going to do is leak that pointer. So it's going to output four bytes therefore I can just say I want to receive... It took me a while to look up in bone tools but they have this receive end function which waits specifically for four bytes. This is also why I want to show this to you because it's going to simplify your life too. So I know that I've now gotten four bytes from remote. I turn that into a U32 function in bone tools so this turns it from the string into an integer 32 bit integer into the address of write and I do exactly what I was doing before. I do that and then I subtract the offset of the write function which is that df9f0 which is the baseline and I add 3a da0 It's pretty close to happen. So the baseline system then in my code I first sent the address of system and then I send the binsaf0 and then I get an interactive show. Will does this in a different way. I was too lazy to look up how to turn bytes around so I just did it manually and I didn't even do it the good way and I used a for loop I'm not proud but it works. Sometimes you just have to do it works but the nice part in here is learning better ways so I'm going to run Python I'm going to run Pone Devils CTF Solutions Xploit that will work if the libc version changes then we're going to have problems because our offset is going to be different but at least here now we have a repeatable exploit against the specific version. Questions? It's a pain to get 100% right. There's a lot of little details that's why these debugging tricks like writing out whatever you wrote in these kind of things and I guess just to prove mine also works. Hello we got root shell It's rm-rf please Sad Can you even exit? Will it allow you to exit? No it doesn't exit. Alright say goodbye everyone. Bye everybody.


There's actually a lot more pseudo-elements and pseudo-classes out there than a lot of people realize and some of them let us come up with solutions that you can do with a couple of lines of CSS rather than trying to engineer more complex solutions. So in today's video we're going to be looking at three pseudo-classes that you might not know about, you might not have ever used that give us nice elegant solutions to common problems that can come up from time to time. Hello my friend and friends and welcome back to the channel. If you're new here my name is Kevin and here in my channel we learn how to make the web and how to make it look good with weekly tips tricks and tutorials and explore the wonders that are CSS and I'm really excited for this one because pseudo-classes are things that we know the basics of. We know things like hover and focus and that and we use them all the time but we don't always run into situations every single site where you need to use the ones I'm going to be looking at in this video but they're the types of ones that can really help you out in specific situations so let's go and dive in and take a look at what they are. All right so the very first thing I want to look at is an issue where sometimes you go and you have these sites that were then there's like a navigation that brings you to different parts on the page so we're all in the same page here and we click and it brings us to that section but we sometimes run into issues with that and we're going to look at a few of the fixes and one of them is going to be using a pseudo element and I'll throw a few extra bonus tips into this one as well as we go through it. So the first one is it's not really obvious that we're on the same page when this just jumps around so we could do an HTML and throw in a scroll behavior smooth just like that and what that does is it well makes our smooth scrolling come in. All right so now we can see when we scroll around we go around but as I said you might click on section three and think that it's actually bringing this into view so this is where our first pseudo element comes in and I've wrapped each one of these in actually a section so you know your markup might be a little bit different but I'm just going to say section target just like that and this means if something is the target of it might when I click my link and I'm in code pen so we can't see the URL changing but normally you get the hashtag there followed by the section or the ID so when it becomes the target like that we can do something interesting and we and on this I am going to use an outline and not a border for this a border would actually have size to it so we can impact the page whereas an outline shouldn't do that so outline will do a three pixel co-dobbied red just so it stands out I'm not saying to use this for your own you can come up with more elegant solutions than this but now when I click section one you can see it's actually highlighting section one or section two or then down to section three and it's showing me what section I've clicked on when I've done that so that's kind of cool and you could even go a step further you could say section target and then say h2 um no let's leave this one like that and we'll just do a section target each we'll do an h2 like that so it's only if it's a direct child and we can say color is purple and now if I click on section three not only has that changed but my h3 there has changed too and again I wouldn't necessarily want to make it purple like that this is getting kind of ugly but just to show you some of the possibilities that can open up with this and you will see section two has multiple h2 so both of them have changed so just but just to show you a few different ways that we can sort of style things and play around with things a little bit right there so I'm going to take that one off because I don't really like it now another thing you might notice is when you go to section one it really lines up with the top of the page which isn't super nice this isn't a pseudo class and so what I'm going to do is I'm going to come on my html here and you don't have to have smooth scrolling on for this we're going to add a scroll padding top and I'll do three rem but I mean the number is up to you and that just means that when I go to section one it's actually going to keep like a three rem of padding there or we can go to section two or we can go section three doesn't influence it because it doesn't reach the top of the page but we can use that and scroll padding is an interesting property you can do a bit more with it than just this but just to show you that's possible I could also be really useful if you have a sticky nav and you want to make sure that the elements don't slide underneath your sticky navigation so things like that could be useful so there we go that is my target with a few little bonus tips along the way as well and is it just really really fast here actually if we turn off the scroll behavior say you don't want it you'll see it still keeps that scroll padding there so that's not because we have smooth scroll on so a nice little fun tip right there and the next one I want to look at is something that's a this one I actually think could be pretty useful and actually I did a video a while back that looked at sort of a way you can hack that to make a CSS only light box you do a lot with target these next two are a little bit less popular you probably won't need them as often but they can come in in interesting cases um so actually I'm going to change my content here just really fast and I'm going to comment out all my sections and what I want to look at now is a pseudo element um or a pseudo class I should say and it's going to be p and there's two different ones we're going to look at um one is only child so you've probably heard of nth child and you have one two three or first child last child and one that I never see talked about is only child and where this is interesting is let's say you had a blog and the blog has different types of content sometimes it's a really long form one that has lots of content and other times you just want something quick of a single just a single paragraph it's like something it's a bit more inspirational it's there it's just something quick that's going on your page and so you have your paragraph and you know this could be section or if you're doing it in an article you know our article p only child or whatever it is um for this demo though I'm just going to leave it like this and what I'm going to say is font size is for rem and then it just changes the font size of that paragraph and so yeah I think this is one that wouldn't come up terribly often but you don't have to you know the fact that you can see if something is an only child I think that's super cool and just to show you that it is working if I come here and I add a second paragraph uh lorem 20 or 10 whatever doesn't matter we just need another paragraph it's not styling these they're not the only child there's multiple children in here so it is styling this one only if there's one paragraph I find that really really interesting and really cool I again I don't think it's one of those ones that's going to come up all the time but I've seen things we're looking for these types of situations with sort of a complex javascript solution where you're trying to diet you're analyzing the DOM looking for when something is the only child and it's a certain type of thing and it can get really complex and you can do it with one line of CSS so one of those things that I guarantee you won't use every project but you're gonna be so happy to know about it when it does come up and when you do need it and the other one is actually really really similar to this and we're gonna do this one with a block quote so we'll say block quote and instead of only child it's going to be only of type and so this is very similar to only child the difference between only of type and only child is let's turn all these back on and the when we have all of this here right now if I did a block quote only of type and what I'm going to do here is actually section just to make it a bit more obvious what's happening and on here maybe we say font size is two rem and the color is red just so we can see it really clearly and this block quote here should change because it's the only block quote within that section but let's say for some reason we have more block quotes in one section we can come here and say block quote and lorem 15 just we have some content in there there we go and by doing that now I have these two block quotes and they're not styled the same because it's not the only of type the only of type you can have a ton of stuff but it's the only element it's the only block quote and then it's the only one that the only block quote that is in there and then that's going to qualify whereas the only child it could I mean you could even do a star only child here and it's going to look for anything that's the only child so that could be really really interesting and useful in different circumstances now I'm not saying that I would want to use this for block quotes in this sense but again this is one of those times where you might have something where if it's the the only child might not work for you because maybe you have a section with let's just say here in my article I do have an h1 and the h1 is my article title here so let's go and get rid of all of this once again and so if I did my paragraph only child and ignoring that the paragraph only child's not going to work now because I have an h1 within my article and so and again usually you'd probably do something like that article paragraph only child it's not working and then they go oh I wanted to do that thing Kevin told me about I thought it'd be cool well that's where the only type could come in not only of child only of type there we go and then that paragraph will get styled because it's the only paragraph within the article so there is a bit of a distinction between the two I think they could both be used in interesting ways depending on the circumstances and again they're not something you use in every single project but they're ones but they're ones that could really help you out in the right circumstance and the target one that I talked about I made a video a little while ago on how you can make a CSS only light box using the target and if you want to check that out it is right here for your viewing pleasure and with that a really big thank you to Zach and Randy who are my supporters of awesome over on patreon as well as all my other patrons for their monthly support thank you guys also very much and of course until next time don't forget to make your corner the internet just a little bit more awesome


I was scared then, and I'm scared now. And today, scientists say we have a lot less than 50 years to turn things around.  Did you grow up like that? I can't really imagine what it would feel like to look at how beautiful the world is and not feel like I was grieving for a dying person. I think most of us understand the external dangers of climate change. Rising tides, melting permafrost, polluted air, these are very real problems. But have you taken time to grapple with the harm this is causing in our minds and hearts? They are equally real problems. Children breaking down from trying to carry the weight of the world on their shoulders. The guilt we feel every time we do normal things like buy food or turn on a light switch. The trauma of the slaughterhouse and the factory farm that we know and suppress. The oil drillers and farmers and manufacturers who must constantly cope with the choice between respecting the planet and earning a paycheck.  There are so many parts of this crisis and I can't speak to all of them. I can speak to how it feels to be a young adult on the verge of independence and know that it's not enough for me to finish my degree, get a job, and have a family. I know how it feels to believe that if I don't give everything in me to stop these ecological massacres, to literally save the world and billions of innocent human and non-human creatures will suffer. I know how it feels to wonder if my future will be only a series of disasters and crises one after another. I know how it feels to ask myself when I was only a child if the human race even deserves to survive. I am not the only young person who feels this way. Maybe it's our role in the world to feel the pain that others will not or cannot feel. We have grown up with a shadow over our heads. Of course I asked myself if I had the power to change all of this, what world would I want to see? When I think about that, I keep thinking of the word honest. I want us to live lives that are honest about three things. Honest about limits, honest about work, honest about pain. To be honest about limits means that we take planetary boundaries seriously. We would like to always be comfortable, to never have to make sacrifices, to have access to everything we want, but we can't. Our planet has limits, and we will run up against them one way or another. To be honest about work means that we reckon with what it takes for us to stay alive. We get connected to our food, to our bodies, to our communities. We make meaningful work a part of everyone's life at every stage, and we get used to working with our hands and feet because our bodies are the most honest things we have. To be honest about pain might be the hardest thing we ever do. It means that we surrender to this truth.   We do not control it. Can we let go of the lie that money, possessions, and power can protect us from feeling grief and pain? Can we trust our communities, trust nature, trust time to help us handle hard things? Somewhere in ourselves, we already know these things. We know that limits, work, and pain are real. We know that without them, the world just doesn't work. And our attempts to avoid what scares us have resulted in so much harm to the world. I grew up with a shadow over my head, and I spent a long time trying to avoid that shadow. But when I faced it, when I leaned into my grief over the state of the world, I found a sense of meaning that I had never known before. To turn our path around means that we all have to find the courage and the empathy to face what's hard. If we can do that, we can reinvent our relationship with the world. We can make sure that no more children grow up under a shadow, but in the full light of the sun.


In addition to being able to use the rules of inference, it's almost as important to be able to identify logical fallacies, and these occur as follows. Sometimes we wish that a statement has a certain truth value. A logical fallacy occurs when we conclude a statement has the truth value even when it might have the opposite truth value. For example, suppose the conditional if A then B is true and A is false. Let's explain why concluding B is false is a logical fallacy. In other words, you know the antecedent is false and the conditional is true. And so the question is, are you willing to put $20 on the claim that the consequent is false? Well, that would probably be a bad idea to see why let's set up a truth table. And since we know the conditional is true and A is false, we know that we're in one of these two cases. So from our truth table, we saw that B could be true or false. So if we claim it's false, it could have been true and that's a $20 lesson on logical fallacies. So deciding that B must be false is a fallacy since it could be true. And it's worth pointing out it won't help us if we claim that B is true because it could actually be false. And if we make that claim, that also is a fallacy and it'll cost us another $20. And this fallacy is so common it actually has its own name. Claiming the consequent false because the antecedent is false is a logical fallacy known as denying the antecedent. So for example, suppose if this is Tuesday, this must be Belgium. If it's Monday, why can't we conclude that it's not Belgium? So again, suppose is math speak for let's assume this is true. We're assuming the conditional if this is Tuesday, then this must be Belgium. That's if A, then B. And if it's Monday, that's the same as saying it's not Tuesday. That's the negation of A. But if we conclude it's not Belgium, the negation of B, we're denying the antecedent. That's our logical fallacy. How about another one? Suppose if A, then B is true and B is true. Let's explain why concluding A is true is a logical fallacy. So again, our Hexter guarantees that B is true and the conditional if A, then B is also true. Are you willing to put $20 to say that A is true? And we can set up a truth table. We know the conditional is true and the consequent is true, which puts us in one of these two cases. And there's no way of knowing which case we're in. And since A could be true or false, then concluding that A is true is a fallacy. And we're likely to lose our $20. And again, this logical fallacy is so common that it has its own name claiming the antecedent true because the consequent is true is a logical fallacy known as affirming the consequent. So assume that if it's raining, I'm carrying an umbrella and that I'm carrying an umbrella. Can you conclude that it's raining? So we're assuming the conditional, if it's raining, then I'm carrying an umbrella. We're also assuming that I'm carrying an umbrella. But if we conclude it's raining, we're affirming the consequent, a logical fallacy. The third common logical fallacy emerges as follows. Suppose the disjunction A or B is true and we also know that A is true. Explain why concluding that B is false is a fallacy. So again, our Huckster sets up the table and guarantees that both A is true as well as A or B is true. So are we willing to put $20 down on the claim that B is false? Well, let's set up our truth table. So we see that A or B is true and A is true could be in one of these two lines. So B could be true or false. So if we claim it's false, that's a fallacy and we'll lose our $20. So again, this is a common enough fallacy that it has its own name, requiring only one term of a disjunction to be true is the fallacy of affirming a disjunct. So you can have cake or ice cream. If you have cake, are you unable to have ice cream? So we're assuming the disjunction, you can have cake or you can have ice cream. We're also assuming that you have cake. But if we conclude you can't have ice cream, that's the negation of B we're affirming a disjunct, which is a logical fallacy. And in particular, you can have both cake as well as ice cream.