All right, we've got Dylan back joining us on the stage again talking about getting shells from java scripts So please welcome them to the tour camp stage Thanks for the kind intro So like I kind of mentioned this in the first talk I gave but I This is my first time attending tour camp and I didn't quite nail the motif On some of my talks. So this is a little on the technical side and I'm going to try to do my best to decode a lot of that but There's no the crème brûlée involved to this this talk So that being said I'll go ahead and get into it basically the premise of this talk is kind of just like highlighting some stuff that's already kind of I think well known by the security community, but The way I kind of tie it together and some of the bug bounties that I've submitted to I think can kind of paint Some of this in in a new light So most or a lot of people may be familiar with like the beef browser exploitation framework that that takes basically cross-site scripting to like the next level of like getting an implant and like surveying internal networks a little bit Really my intent is to is to kind of push that one step further of like basically highlighting how crazy the idea of like a web browser is in the first place like let's go to Untrusted websites and take code from them and run it in a sandbox way And then allow that code to make arbitrary network requests on every single network that I'm sitting on like if you Laid that out to somebody in the 80s That would sound insane But this is kind of the way we've rolled with it and we're kind of at that point now and I just want to show a couple of Ways that you can take advantage of specifically that of sitting on Privilege networks and going to the internet and running code and then being able to affect the privileged network that you're on But to get there I need to go through some kind of dry web appy stuff So hopefully everybody can bear with me for that So there's there's kind of like this this fallacy that I'm sure everybody in the room knows is like if we have Like a really hardened outside then like we can we can have the inside like really soft and gooey It's like a company can it's been a lot of time like hardening The exterior but like all of the interior assets Maybe they'll leave that a little more soft, and I say it's a fallacy because like the reality is like Whatever your mechanism is for breaking in whether it's fishing or through a You know browser exploit or a USB stick in the parking lot It's it's it's relatively easy to do and really hard to Secure that out external perimeter, and if your inside is gooey, then then you can just move around Really easily and and this talk is basically just showing another way of Getting that first implant that doesn't involve fishing or a USB stick in the parking lot So like I had this idea in my head of when I was like first Entering this industry of like how much damage can really be done if you click a link? like Most people don't have browser exploits most of the malicious links that are sent around Probably don't have a zero-day in Chrome Flashes on its way out like They've are I think they've already announced the end of life date They've there's tons and tons of exploits still left in flash, but Chrome disable is it by default So that's that's not really a vector as much anymore And in general folks are weary about downloading files So if you send them to a malicious link and it and it forces an exe download I think like most people at this point know not to run that So I you know that was a question that I had kind of like sat on for a while like you click a link But like so what like how much damage to could be done So, you know to get into the weeds here, I have to sort of in-depth go over Cross-site request for tree and cross-site scripting and then it's gonna be dry for like the next three four slides But then we'll get to the more interesting stuff after after we get through it So hopefully everybody can bear with me for that Basically at a high level the same origin policy is like the fundamental browser security mechanism like you visit Facebook comm and you want to be confident that Facebook comm cannot steal any data from Google and it cannot affect any change on Your Google account so we have the sandbox that separates the two origins and the the rules which allow you to Get data are dictated by the same origin policy and it's sort of self-describing it Limits you to only be able to do those within the origin that you're on with a couple of exceptions And those exceptions are kind of interesting. We'll talk about some of them So basically You take this with a grain of salt This is the way the rules should be now bracer browsers were often break this when they come out with new features and stuff like that But fundamentally there are two different types of HTTP requests in a browser There's the simple kind and then there's the non-simple kind and I didn't define that terminology that was defined by specification a simple request is One that is either get post or head and any of the content types you see on the left And you can't have any custom headers It has to be a very vanilla request one that you might get from a web form a typical request a website makes would fall into a simple request a Non-simple request is the type of request you start seeing in single-page apps and more complicated websites Where maybe they set the content type to application JSON or maybe they set a custom header Maybe they use a method. That's not get post and head. Maybe they're using like a rest framework as they use put and delete those types of requests are defined as non-simple and The difference between those two with regards to the same origin policy is a simple request from Facebook If you visit facebook.com and they send you JavaScript That JavaScript can force your browser to make a request to Google if it's simple and that request is credentialed It'll include your credential if you're currently logged into Google Which doesn't sound great, but that's just the way we've architected the internet And non-simple requests require some validation ahead of time to make sure that you're actually allowed to make that request So a request is made ahead of time By the browser under the hood with a method called options That basically goes to the website and question and says am I allowed to make this request and then the server Responds either yes or no or nothing at all and if it doesn't explicitly say yes, then that request can't be made So these kind of dictate the rules which allow you to make requests from one origin to another And so this is the complicated flow the pre-flighted flow first You want to make a request you ask the server permission. Do I have permission and then the server responds back? Yes, you have permission to make a request with these methods to this origin With credentials or without credentials and then the browser goes ahead and makes the request That seems like the flow that all requests should follow, but there's kind of this caveat of an older time Where you can make simple requests without having to ask permission Facebook can force you to make a request to Google a Credential request on your behalf And so that's that's what that looks like. It's just an immediate request And then the server responds at that point allowing your browser Either to view the content of that response or not to view the content of the response So you're allowed to make the request, but then the server can set some rules around whether or not the JavaScript can read the response And like I mentioned before this is kind of super dry, but it'll get more interesting in a minute So this is kind of like the traditional way that you'll Imagine cross-site quest for a tree working you Visit evil.com evil.com can then force you to send credential requests to Google and if there's a state changing operation that Google has available They can potentially force you to change state on your Google account Which is is crazy. It's insecure by default and we have to engineer these really wacky solutions to make that Harder to do and I'll get into that a little bit Basically the way we've fixed that is Outside of the browser we've hacked this artificial pre-flight on top of all of our requests They basically say Before you make this request make another request that fetches a token from Google and then on the state changing Request include that token to prove that you've been able to successfully read this response of a previous simple request and That whole flow sounds crazy insecure by default and stupid Because it is But this is kind of just the way we've architected the internet So like the conventional way of thinking about cross-site request forgery is like it's an attack on a user I Can force a user to do a state changing attack or to do a state changing action on their account If they're logged into Facebook and Facebook doesn't implement this wacky pre-flighting thing into their application I can force them to change their status or I can force them to add me as a friend I can't view the response from that because Facebook is never going to grant me permission to view the data that comes back But if they don't implement all that weird token stuff Then I can I can do things on their behalf if they visit my website That's the classical way of thinking about cross-site request forgery and it is by far the most convoluted complicated web attack that I know of Just the way we built this and the reason it's insecure by default and it's non-intuitive and I have to like explain all this And really boring way for people to understand it It kind of just sucks But really what I want to focus on on this talk is it's kind of what I highlighted a little bit earlier You visit a website on the internet, but your web browser it sits on a lot of different networks It sits on local host it sits on your corporate network, right? And if you're not Google and you're not running a weird beyond-corp situation Your browser can talk to your co-workers so you may visit evil calm and Evil calm then has the ability to make requests to your co-worker or to an internal server And that's pretty scary and So like that's that's kind of the way I I Am trying to push people to think about cross-site request forgery that it's not just an attack on users It can also be an attack on your infrastructure but if you visit a link and That link has malicious JavaScript that JavaScript can make arbitrary requests to your internal network And that can be really scary and I'll give some examples What makes this worse is recently browsers implemented this like peer-to-peer Way for two browsers to talk to on each other Without a server involved and I am not a network engineer And I'm not going to pretend to know all the nuances of how or why this works the way it does But one byproduct of it is it exposes your internal IP address to any website So you go to a random website that website Has the ability to pull the IP address of your local network, not just your public IP address And from that information they can then guess what IP addresses your co-workers are guess what IP addresses servers on your infrastructure are and That's that's just the way it is and different browsers do this differently some browsers will give like one Internal IP address other browsers will give every single internal IP address that you're sitting on Which can include the IP address of the network if you're on a VPN I think Firefox usually gives a lot more information And that kind of sucks And so, you know if folks are familiar with Metasploit It's a malware framework, and it's an archive of exploits and there is a section of Metasploit of HTTP Exploits after you've compromised a host usually this is when it's it's it's used you compromise a host And then you want to move to other hosts within the environment These are all the HTTP exploits that are available like basically if an internal host is running Jenkins or something like that It'll fall into the HTTP modules and Metasploit, and if you compromise one host and your co-workers running Jenkins you can move from your host to their host with this HTTP exploit But what was interesting is when I went through this list of exploits Not only like so it's a big list of remote code execution over HTTP But the vast majority of these had no built-in protection against cross-site request forgery Which means like you don't just have to think of it as a means of like I've already compromised a host And now I'm going to move laterally from that host to another host Instead you have to think of this as what if I just visit a malicious web page? And then they get information about my internal subnet through WebRTC And now all of a sudden they can start slamming my internal network with all of these cross-origin requests because the browser allows it and Their remote code executions that are all of a sudden phoning home to the attacker So some some big ones I threw up on here Jenkins, Jboss, Struts, PHP, MyAdmin The list is really really long But these are all HTTP exploits that are also Vulnerable to cross-site request forgery and I'll caveat that by saying Jenkins has a Feature that you can turn on to protect against cross-site request forgery But you can also turn that option off And again if you're dealing with a large company and law of large numbers and the attackers literally just sweeping your entire subnet There's a good chance at least one person will have it turned on or to have the feature turned off. I should say So at a high-level overview a user clicks a link the Malicious web page loads JavaScript on the page It obtains that user's internal IP address even though they've clicked a link to a website on the internet That page can now get information about the internal subnet handed to them by the browser and Now they can just sweep the entire internal subnet with whatever exploit payloads they want Maybe pulled out of the Metasploit library or maybe exploits that people haven't found yet And I'm going to show how easy those are to find on some of these internal assets in a bit But basically, you know, you just click to link and then all of a sudden your coworker your internal servers your printers They're all owned and phoning home even though like there was never a browser exploit that the initial victim wasn't actually compromised well, they sort of were but they're No shell command was ever ran on their host. No malware implant was ever installed on their on their computer And so like how long that takes well, it took me about 30 seconds with a really rudimentary try to sweep a Slash 24 so here you can see my internal IP address on the bottom there and It took a particular exploit that I built out for one of the ones that I showed previously slammed it in slur slash 24 all 255 hosts And did it in about 30 seconds So it could be pretty quick and I think this can actually be made faster with web workers and other hacks So it could potentially be even faster than that So So far I've talked about a relatively blind way of doing this somebody clicks a link and then you sort of just spray and pray But there's a way to do this a lot more targeted and I think recon in general has sort of become a lot more sophisticated in the last couple of years a Means to figure out what internal hosts are running at a company Has just become really really easy to do and that's through a number of different means You could crawl through github and look through their open source repositories go through all of their old Commits and just see references to internal hosts. I've used truffle hog to do that before You could view certificate transparency logs Which is a log of every public certificate issued by a certificate authority So if they have TLS and their internal hosts you can figure out what their internal hosts are by this public log You can search virus total basically if you upload any file to virus total virus total will parse out all the links And then make them available to everyone You could do good old-fashioned Google dorking you could do good old-fashioned brute-forcing with tools like fierce You can use passive DNS. There's companies with DNS probes That'll just watch everything fly past it and it'll make every host that it sees available to anyone who asks for it Long story short. It's really really easy to get a list of every internal host name And I've done this with a company that I was supposed to blur out but then forgot to so Pretend that you can't see which company that is and Basically you can see I was able to find you know 48 sub-demands that were sorry 48 Yes sub-demands of the company that were definitely internal sub-demands. It was using their internal schema And then I was able to find 97 that Were partially public and partially internal It's really really easy to get the internal Topology of a network this way And then if you sort of start to combine that with what I talked about earlier Let's let's pick one. So it here's a random sub-demand from that list before It's it's a piece of code that I've never heard of Gocd Dot DevOps company network. So I googled gocd and it was this open-source thing So I was able to pull down the source code and standard up locally Which you see here and by default there's no authentication on the system You can add authentication to it But the default of just running it out of the box doesn't have off and that's a pretty good start And then when I sort of did some digging it didn't take long for me to find a cross-site request forgery exploit on this system and What's interesting here is if you think about a classical cross-site request forgery exploit the ability to set a status The ability to send an email like that's Relatively benign in the grand scope of attacking a company But if you're targeting one of these internal tools the scope just all of a sudden explodes. So this tool Has the ability to build environments. It has the ability to stand up hosts And as it turns out One of those endpoints the ability to build an environment doesn't have cross-site request forgery protection Which means I can now take this company's name. I can build a payload Such that when a person visits an evil link I'm specifically targeting that host and that piece of software which I found a specific exploit on And if that link gets clicked I can build an environment in their ecosystem That's pretty bad and It's really really easy to find these types of exploits these internal tools these open-source ones are usually not audited They don't go through the same scrutiny that say a public bug bounty website may go through They don't have intense security code reviews on them They're usually really vulnerable and they're usually in a position that can do a lot of nasty state-changing things in your environment So you know a summary of everything I've talked about so far Basically, you know if your internal services aren't locked down, right and you click a dangerous link Through a phishing email through a watering hole attack through whatever vector that origin Can move laterally from your browser To another host in the environment which can be blind or it can be targeted and then that host can get a malware implant phone home Without a browser exploit So I'm going to talk about another type of vulnerability here one that folks are probably more familiar with cross-site scripting basically the idea behind cross-site scripting is if you Visit a page and the page takes input from a user say from the URL and that input gets reflected back into the page in an unsafe way that can lead to a malicious user running arbitrary JavaScript on that page so if you think about it like if Facebook had a cross-site scripting vulnerability and you send somebody a link to this thing And then you render the Facebook's page. They'd have the ability to set statuses to Delete friends to do anything on your behalf because JavaScript has pretty much full control over the origin for which it runs So Some examples of things you can do with cross-site scripting Anything the user can do all of a sudden you have that ability you can steal data You can change state on their account You can create backdoors by exfilling session tokens or installing an app on their account Maybe you install like a Facebook app because you're running code on their behalf but these are all again sort of Peer-to-peer attacks not an attack on infrastructure If we look about how common cross-site scripting is as a vulnerability These are like the hacker ones most common vulnerabilities and you see it's like way on the list All the way at the top by a large margin So cross-site scriptings are really really common and people are really really used to seeing them in bug bounties And that kind of normalizes us to them to an extent which is kind of it kind of sucks because it is a pretty severe Class of vulnerability within the scope of the origin that it runs on There are a couple different types of cross-site scripting I won't spend too much time going into them Or all of them I should say but I will focus on the first two a Reflected cross-site scripting is you go to an origin with some kind of parameter in the URL So a link can be sent to you and that parameter then injects JavaScript on the page a stored cross-site scripting is basically Some other user on the system stuck some data in a database somewhere and then that got rendered out in another context And so at the bottom here you sort of see this quote from hacker one that like a reflected Cross-site scripting vulnerability is probably less severe than a stored cross-site scripting vulnerability I want to challenge that and specifically I want to challenge that with regards to what I've talked to so talked about so far So basically if if you if you think about Sort of what I've talked about if you've got an internal Jenkins host and the internal Jenkins host is Building stuff in the environment and it has the ability to Spin up new hosts or to run code on other hosts in the environment A cross-site scripting on that origin Reflected or or stored could potentially mean compromising your entire environment but a stored cross-site scripting would depend on a Previous request being successful Storing something in the database and then a second request to fetch that back out and rendered it Whereas a reflected cross-site scripting is more dry fi you click one link and then it runs So in this context in a context where the attacker doesn't have access to the host in the first place But they get some kind of reflected cross-site scripting on this weird open-source thing that they're running internally Tomcat Jenkins or something else I've never heard of The reflected cross-site scripting can be a lot worse than stored cross-site scripting You're not going to get stored cross-site scripting on a lot of those things But you probably could find a reflected one if you look hard enough and even if you did find a stored one You wouldn't be able to store it because you'd need to be on that network But you can trigger the reflected one by getting somebody to click a link who is on that network And If you were to find a stored cross-site scripting you would need a cross-site request for a tree bug to go with it To allow a state-changing request to happen so that you could send that subsequent second request So it's it's it's less likely it's more complex and the reflected cross-site scripting I would argue is a lot more deadly in this particular situation of targeting internal applications So sort of again the old way of thinking about this is like you attack a user you steal a user's data But I want to kind of shift that paradigm and sort of And I know like other other people in the industry like beef for example have started to shift that I want to shift it even More to make people more aware of the fact that these like dangerous web browsers Sit on internal environments that that can make network requests any network that you're on and you can use these Webby attacks that seem harmless to attack infrastructure and to cause some real damage in an environment and so This is one example of one that I submitted to a bud bounty review board is an open-source tool for Performing code reviews you hook review board up to github it has the ability to pull projects from github and Anyone with access to review board can perform a code review I found that review board had no cross-site request for drew protection and There were several cross-site scripting vulnerabilities that I was able to find and so when you think about that I have the host name already because I've enumerated it passively and then I can build a payload That targets that host name that I've clicked by an employee would trigger one of these vulnerabilities and the impact of that would be I now have the ability to run code on somebody's browser and that Browser can make a request to an internal host and that host can Access all the source code in your company and then I can steal it all So end-to-end you click a link and all of a sudden I've stolen all your company's source code That's it's a pretty severe thing to do from something that we typically think is benign cross-site scripting And I guarantee you review board has not gone through an intense vetting process There's probably more vulnerabilities like that in it So the impact here is just way more severe than what we typically think of when we think of cross-site scripting We're targeting an internal host and if somebody clicks a link it causes irreparable damage to the company basically and So like that's the you know the kill chain here is like because it was a stored cross-site scripting I found you have to make one request to set the cross-site scripting Which you can do because there's no cross-site request for drew protection and then a second request to activate the cross-site scripting Which then exfiltrates all the data from the origin Which in this case would be all the source code or whatever source code you wanted to target So you can see here review board fixed this cross-site scripting vulnerability and gave me credit for it And then the bug bounty I submitted this to which was unrelated to review board also triaged this and they upgraded their version So another example is there was another company that I was doing a bug bounty against and And I love doing these bug bounties because it's I'm finding exploits on open-source software stacks So I could talk about them like it's not locked down. I can you know, it's it's open source I'm free to be more open about it So I'm doing some bug bounty on some company and they're running something global site company calm a Google global site I find out it's an open source piece of software and I just I tear it apart. I find so many vulnerabilities in this thing I found many cross-site scripting instance instances and I found a remote code execution Which was only triggerable if a user was logged in but if we combine these two things together if a user is currently logged in I can use the cross-site scripting to trigger the remote code execution and I can build this end-to-end link that if clicked by a user at this company is currently logged in all of a sudden their browser Targets this internal host and that host phones home So that kind of goes over what I just said you install the web shell via the user making one request You activate the web shell by making a second request and then that makes the host phone home And you can see they paid me out pretty well for that nine grand for all of the issues They recognize this is a really severe issue But this was just one host in their environment an open-source host Which their security team had never heard of never audited and they had a ton of other hosts that I haven't looked at yet And most companies do of just weird open-source stack running internally. You can target externally via these links So I want to spend a little bit of time talking about service workers Which is another new JavaScript feature that allows you to do these attacks in a more interesting way a Service workers intent is basically to function as a fake server in the case internet goes down so you make a web request and a service worker kind of pretends to be the server and Can service you in the event that there's no connectivity to the server? That's what it's designed for but what it allows you to do is kind of weird First it allows you to run JavaScript for five minutes after the user closes the tab Now if you remember I said 30 seconds is how long it takes me to sweep an internal subnet For five minutes is how long I get to sit on that after the user has closed the tab That's kind of scary It only runs on TLS hosts. So if you were just sweeping their internal subnet You probably wouldn't have much luck unless there's some crazy internal TLS tooling at that company But there is an exception to that and I'll get to that in a bit They're slightly sandboxed. So you don't have full JavaScript Execution abilities within a service worker, but you can make cross-origin requests Which means you can install cross-site request forgery attacks and you can trigger cross-site scripting attacks So, you know when I think of a service worker This is what happened when I opened up an incognito window and viewed how many service workers were currently installed Google had already installed one. They're kind of like malware. They're little bits of code that can continue to run after I Forget about the browsing context that I'm on And I personally don't want that like I you know, I use a VPN sometimes for some websites that I visit I don't like the idea that they can figure out who I am if I turn the VPN off four minutes after I visit the website But the additional thing that they allow you to do is send all these requests to all these internal hosts So if you find a bunch of internal hosts that are using TLS You can have your service worker just go to town for five minutes on those things could set up some command and control hook with beef And you can just continue to slam those hosts for five minutes after the person closes the tab There's kind of that thought when you have a cross-site scripting attack that it only runs for the short amount of time The person visits the page and if they just close the page immediately like you may be out of luck But these give you five definite guaranteed minutes And here's that exception that I talked about before it doesn't always have to be over TLS There is one exception and that's if you load a service worker over local host And you might be wondering like when can an attacker ever get somebody to load a service worker over local host on somebody's work station? And I've kind of come up with a kill chain here that is a little outlandish, but it works basically if you submit a file via bug bounty and Claim it some exploit an HTML file The person triaging the bug is probably gonna run that on local host and they're probably gonna do it on a privileged network Which means you could install a service worker on their machine on local host That can run for five minutes after they close the tab and now it can make insecure Requests to their network sweep the slash 24 that they're sitting on and Anybody running Jenkins or whatever else you're targeting those hosts can phone home It'll still run for five minutes, and it'll just allow you to make insecure requests Yeah, so Yeah, I'll speak to that a little bit so basically the Person in the front said like if you just open the HTML file It won't be running on local host and we're running on the file origin, which is correct However, there are different ways that you could coerce people to run it on local host For example if you included a bunch of HTML files and you wanted those HTML files to be able to reference each other Then you can say just spin up a Python HTTP server to make this work and chances are the person triaging the bug is gonna do it But that is a good point There are some other downsides to running things using the file origin There are some security implications to doing that And we could talk more about them later, but it is a good point. Thank you for bringing it up But that's that's basically the idea that that you can target these internal hosts Through the web browser you can do it in a very targeted fashion The recon and all the information that you can learn about an internal network has gotten really really sophisticated in the last couple of years and You can also figure out into a person's internal IP address because of a browser feature So that's basically That's basically What what I have for you. I'm hopefully bringing some visibility and bringing a new light into viewing these classical vulnerabilities I realized that a lot of that was like super technical But hopefully like bring it back up the overall idea of like how much damage can happen if I click a link I Just want to demonstrate that the answer is a lot Does anybody have any questions? Question the back Yeah, so if I understand the question you're asking How do I install a service worker on an origin basically? For a server that's up. Yeah, so just rolling it back a little bit a service worker Can be installed on an origin that you have control over so if you have control over an origin you can install a service worker for that origin and It's designed to be like a well I'm gonna install this just in case in case I go down then the service worker will kick in But the service worker has the ability to also run while the server is up it can run all the time Yeah Control the origin is So the way you install a service worker you visit a web page a web page can run JavaScript on your page and that JavaScript installs the service worker and Then it points to another file being hosted on the origin and that file itself is or is the service worker So you can't quite install a service worker if you get a cross-site scripting on an origin for example But if you have full control over the origin like evil calm and somebody visits evil calm You could just install a service worker on that origin no problem and then use that service worker to make requests to the internal network Yes That's a great question the question was like can you write a browser plug in to just kill all service workers? I can do one better. You can actually disable service workers as a feature You can just in chrome turn them off, but you might find it breaks some functionality on certain websites You use Facebook Google they all install service workers, and they all do stuff with regards to their origin It might end up breaking stuff unintended question up front So the question is if you visit a web page can that web page install a service worker I'm just repeating the question so that everyone can hear it basically the question is if you visit a web page Can the web page install a service worker and then close the main page? It can certainly redirect you to another website I'm not sure if you have the ability to close a tab my gut is that you do And then what was your second question? Can a service worker open a new tab? Probably not is what I would think service workers are somewhat locked down and in the JavaScript that they can run one of those things that they can do is make requests to other origins, but my guess is that Included in that subset of things is not the ability to open a tab, but I am not a hundred percent on that There's a question in the back First of all really great talk Yeah, so I don't remember exactly, but I'll give you a scenario that's perfectly plausible I went to their certificate transparency I Went to a certificate transparency log. I searched for their top-level domain found all the sub-domain And one of the sub-domains was global site.company.com and then from that a Google global site found out was an open-source stack Spiked on it submitted the bug then they found this thing running that they weren't aware of and it went from there Yes On the client side Yeah, so the question was like from like a blue team perspective, what sort of behavior could you potentially? Fingerprint to identify this type of lateral movement. It's tough like Making HTTP requests internally is something that people do normally So being able to identify this. I mean you can write Signatures for the Metasploit library, but you don't know what you don't know about so if I have an exploit on global site and I Build out a payload for that You know, it's gonna be tough to to write a fingerprint for for that when you don't even know a global site is you don't know That it's in your environment What you could do is probably build some sort of heuristic on like if an internal host All of a sudden sweeps an entire network But then you're kind of getting into like behavioral stuff, which is a lot harder to write rules for and to scale and to keep up with So it's tough and I think that's another really good point that like This type of implant is a lot Trickier to get attribution and to figure out what happened and to trace back the story of like well This host got malware on it all of a sudden but like where did that come from like that host? You know they themselves didn't click a malicious link. They didn't even know about the guy on the other side of the company that did So it's hard and I'm not an expert in blue team by any means, but Yeah, I've got to answer your question But from the client side watching like what's that since if you're not like you go stealthy You already know what your target in the network. You're not gonna try and do it in network integration. You just go in and try it Target specific host hit it with your specific Like you describe in your in your talk and then you know So like you're asking basically what kind of endpoint detection can we put on the host of the person clicking the link? Are these I Think that would be tough to do I think like we're using the browser the way it's intended to be used It's possible that you could maybe write some sort of plug-in that detected If you visited an external host and then that external host is trying to do internal things That seems like something that you could probably alert on But So the origin header was introduced by browsers to be a method of limiting cross-site requests If you look at the OASC CSRF cheat sheet both origin and refer checks are listed as So that's a good point basically the person in the front mentioned that if you cross reference The origin header with the host header you can potentially tell that this network traffic was done cross-origin I think the problem you're gonna have is a lot of these hosts are target Well global site for example review board for example these were targeted against TLS endpoints and so you'd need some sort of TLS introspection to be able to see that and Then you're gonna have all the problems that go with full TLS introspection But it is a good point and we could possibly build some sort of browser plug-in like the other gentlemen mentioned to be able to detect that kind of thing Totally except for the case where I mentioned of like somebody runs something a local host And then you're just sweeping that internal sub to mate that that could be all unencrypted that you could that could you do Other question Yes The point brought up was basically like It falls back to what I said originally that that fallacy of like having a hard security shell and outside a soft security shell is a good security model I mean, that's a fallacy right. It's not true. We all know it's not true, but like Pointing some of this out that this definitely I think brings more visibility to that and like Google's beyond-corp model Of like let's just kill the internal network entirely. I think that is in my mind the only like ironclad like solution to this Beyond-corp and I apologize if I bastardize this definition, but the best of my knowledge beyond-corp is basically You have the ability to talk to the cloud. We're gonna view an access point. That's it You can't talk to your coworkers. You can't talk to printers like you have no internal network Okay, thank you And for all the bug bounty enthusiasts in the room I strongly encourage you to try this out It's really really easy to find these bugs. It's really really easy to find these open-source stacks ran and Like you're finding bugs on open-source things that are ran all across the community So you're giving back in a way that really gives back more than just a traditional bug bounty But you might find pushback which I did find at review board. They were like we didn't write this so we're not gonna pay you So that that side of it kind of sucks, but the upside is you get CBE's you can talk about it And you're giving back to the community in a better way in my opinion Yep So the question is like how do you do timing if you find a bug in an open-source stack do you first reach out to the Like hacker one platform or whatever or do you reach out to the vendor? Historically I am not a copyright expert, but the way I've treated this is when I disclose something to hacker one I am giving them intellectual property. I am giving them an exploit and that belongs to them at that point I'm not sure if that's I haven't read the terms and conditions I don't actually know if that's the way it works, but that's the way I've treated it and then I've said okay Well, I'm disclosing this to you. I'm giving you this exploit What would you like me to do next and nine times out of ten? Probably ten times out of ten. They're like, okay go to go immediately disclose that to the vendor and then CCS And then we'll stay in the loop Some other pushback you may get is like a company may say Well, you're just like spraying this across every single company you can find like that's not fair. You shouldn't be paid Five times for the same bug and so I try to do it on a one-by-one basis of like this belongs to you I'm not disclosing it to anyone else like whatever you want to do. That's that's what we're gonna do Other questions cool. Thanks everyone


No! Boy it actually has low lights, not highlights. Low lights. It's low lights. Paul is wetting his lip. So now we're sitting here with my guy. First and foremost, happy belated birthday to you. Oh, appreciate that man. Alright, 20, 22.  Oh, we got the third one. Theme bag boys. You might as well do this episode. Come on in together, let's do this together.  Because we got theme bags. We're the theme bag boys, we do everything together. Everything. These are my guys. It's getting personal over here. That's a little too much. They were at the wedding. I did the electric slide over there. Hey, was it a good wedding? Come on, tell me the truth. Good food there? It was good. What's your favorite thing about a wedding? It's just camaraderie. The camaraderie that it brings. The friends, the family, the environment. It's just better than going out to like a random bar. I think it's family is very cool people. I like them a lot. Great people. Very inclusive. You want to shout out to the Mrs. right here? Shout out to the Mrs. I love you. Dree. Get off my set. Don't try to interrupt my set. Let's talk about this, man. Because you were... Detackle. He was a detackle before. How much did you weigh? 287. 287. And now you've made the transition to outside linebacker. You've gotten your body trimmed and all that type of stuff. Look at him. His shirt is loose. This is a medium, y'all. This is a medium and his shirt is loose. We might need to get him a meal. But ultimately, can you talk to... Tell everybody who doesn't know football doesn't really understand it. What's that transition like? It was... For me it wasn't really intentional. It was just because I was running a lot in practice. Started losing weight. Already had bigger guys that was in the scout team in the middle. So I was running on the edge. And just started losing weight. The process is very difficult. Just losing the weight. And now maintaining it and everything. And just kind of learning everything new. It was difficult, but it's definitely manageable. Nothing's impossible in life, you know? Love that, man. Love that. And I think that, like you said, it's difficult, but nothing's impossible in life. So there's somebody out there dealing with something right now. Obviously we're in the middle of a pandemic. And you're going through something difficult. But nothing is impossible. So hopefully we can take that from Tui. So fans are excited to come this year. Come and cheer us on. What can they expect out of Big Nine 1 this year?  There's a lot of things that you can't control in this game of football. And one of the things you can't control is your effort.   A.J.T.M. A.K.A. Tui. The Atlanta Falcons. The good guy. Thank you Tui for being on man. We're going to keep building this year. I'm excited to ball out with you brothers. Thank you for sitting in the hot seat today. Oh yeah, big hot seat.


I'm Anna Schmidt and I'm here with Tom Hollis and for all of you at a fantastic conversation coming up Tom tell us about it. We got a brand new world, brand new week, brand new world. Well Noah and Nicole Stratton will be with us. They are from the Museum of the Bible and I hope that you have been to the Museum of the Bible or plan to go. It's tremendous. There's so much to see there but they also have a world-class theater and they are doing a production of Prince Caspian. That is the second book in the Chronicles of Narnia series and I have to tell you I'm a big fan. I'm a huge fan but I had a chance to talk to them and they're going to be sharing about us what it means why it's important and what they hope to accomplish with this production. It's amazing. It's an amazing production what they've got coming. And there's so much good scripture tie-in with Narnia. I can't wait to talk about it so we'll be diving into that. We'll also be looking at an inspiring story about what is going on at the southern borders and then towards the end of the show we're going to have some ministry time with the Holy Spirit as well as Tom has a story for you. Story time with Tom. Story time with Tom but don't change the channel. No it'll be good and you'll enjoy that a lot but I do want to say to you maybe this is a situation today where you're going through something difficult. We've all gone through so many things you know and I just this past weekend there was a funeral for my uncle my dad's brother and you know he struggled a lot in his life but at the last 25 years he got right gave his life to the Lord, served the Lord and that made all the difference. It wasn't where he started that mattered or even the the fight through the middle section it was where he ended up that mattered and I got to give the eulogy and I said that because that's what really matters in life. It's not again it's not about where we start it's where God takes us and I know that he's rejoicing with the Lord today. Right it doesn't matter what mistakes we have from our past it matters that God makes us new that there is a new beginning a new life that he rebuilds restores and makes us into the the man or woman he made us to be. Absolutely yeah so uh you know if you need prayer you can always call our prayer line the number's on your screen you can pray for get some prayer with someone who's there just to pray with you that's why the prayer partner's there just for you. Well we're going to take a quick break and when we come back we'll have Noah and Nicole Stratton and a little bit of Narnia. Discover what God's word has to say about healing and deliverance bestselling author John Eckhart makes topical bible study easy with his new book scriptures for faith deliverance and healing this handy references for those who want to have a greater understanding of healing and deliverance to incorporate God's word into their prayers Eckhart also includes targeting commentary to highlight key scriptures and life application his spirit filled perspective will enhance your time and God's word and encourages the spiritual disciplines of memorization and meditation request scriptures for faith deliverance and healing as our thank you gift when you support cornerstone television this month request your copy today if you want to strengthen the ministry of ctv in share your best gift by visiting us online at ctv in dot org slash donate or call us at<PHONE_NUMBER> thank you for your partnership hope happens here as some of you know i'm a huge fan of the c.s lewis chronicles of narnia series and currently playing now through april 27th at the museum of the bible in washington dc is the amazing theatrical production of prince caspian check out some of the highlights from this incredible breathtaking production return to narnia with c.s lewis's thrilling adventure prince caspian the world of narnia comes to life on stage with stunning effects dramatic storytelling and life-size puppetry the logos theater's original production of prince caspian the world's first professional stage adaptation of this beloved tale has captivated audiences from near and far this is a very special production i was amazed at the quality and everything to do with this particular production fabulous performance um broadway caliber disaster phenomenal do not miss this play now you can see the show that fans and critics are praising from around the world on tour only at museum of the bible's world stage theater march 1st through april 27th for tickets visit the academy of arts dot org slash logos theater on tour joining me now are noa and nicole stratton from the academy of arts noa is the president of the academy and he also portrays miras in the play and nicole is the artistic director of the academy and was the first person to adapt the entire prince caspian book into a theatrical script noa and nicole welcome to hope today thank you so much it's a pleasure to be here with you yes so i'm excited i know we talked before uh and uh and you know i'm just excited to see the the play and i need to get down there soon but tell me about adapting such a beloved series i mean this is the one that a lot of people such as myself have read multiple times read it to our children we love it nicole what was it like to write that script well thankfully i am but i'm a luvist fan as well so that really helps to guide you as you're looking at the book instead of just looking at it as just another script we i really wanted to serve uh the book and bring it to life for fans like myself and have us enjoy it rather than be thinking of all the ways the book was messed up so um it was enjoyable we also got to work with uh douglas gresham like you saw on the video he's the stepson last living relative of c.s louis and he was the one that really helped to you know vet my script so that was exciting to be able to bring that to life but if you know prince caspy and you know it's not anywhere it's not lacking a lot of tricks there are trees that come to life you've obviously got the majestic aslin you've got to bring to life tales to reappear tell marines to disappear so many different effects um so god to blow up a bridge yeah so there's a need to and bringing the books to life to get into theatrical puppetry so all of that was quite the challenge but the logas theater is now becoming known for bringing the loas books to life on the stage so it was a real joy and blessing and thankfully fans have been very pleased with the adaptation so far so that's good well i mean it looks stunning looks amazing and and then your husband is the bad character your husband is mere ass what was it like know to play the basically the evil character in the play and he's such a nice guy yeah i got tight cast it's yeah no it's it's great playing playing the character what we like to do in in in these productions is be able to bring as much power and authenticity even to the evil characters because that then lets you see the good triumphing in even a more powerful way if there's a very simple pathetic antagonist it's not way that exciting to see them conquer to see the good win and louis is brilliant at that at portraying evil in a in a realistic way not getting gratuitous or going over top with it um but portraying it that way so portraying hit that character for me um it is a joy because i i like to portray it so that hopefully when he is taken down everybody's cheering so if everybody says they hate me i hopefully i did a good job that's good and he will look completely different we go with a viking look for the tellm greens because of how louis describes them so he's got a a face tattoo and a little ponytail and the whole works i mean they look pretty fierce well that's good yeah i mean i'm glad you're putting the intensity into all the characters like that but let me ask you about the aslan character i mean this is the this is the crux here this is what matters is getting aslan right and uh and i you know i've heard people say that as they've read the chronicles of narnia they've felt a love for jesus through that character like they'd never felt before and i i've experienced that as well what can you tell me about creating that character for stage and adapting it there and for us that was very important our ministry is a full-time ministry and we are out to not to reclaim the arts for christ we want to bring honor and majesty to that character because of who we represent so we didn't want to move forward on the books so we knew we could do as an well and thankfully we have the ability in our ministry to build life-size puppetry now we are the only christian company that we know of that are doing it full-scale professional puppetry like this for the stage there's only three other companies in the world and they all source broadway and west end so we were able to use our abilities in the puppetry department to build a majestic lion that's run by three men which we think is neat because three in one they all work together as one to create this puppet and it is such a powerful it's it's hard to call him a puppet but he has such a personality and power and then his voice is voiced by the founder of our ministry dr nicky chevers who's my father and um he founded this ministry in 1971 and persevered for years through many obstacles and his heart for the lord comes through in the way he voices it and he has such understanding so we have actually had people just tell us that as soon as as them came on to the stage and started speaking they just started weeping and um so it's a very powerful connection he makes with the audience so and then he's only one of several puppets we have two bears in this show uh two while a wild bear and bulgy bear i was gonna ask you about that how do you do all the animals there are so many talking animals in this book that when i read it to my daughter i kept messing up which animal which voice i was supposed to be using that's right so a lot of it is that life sized puppetry uh or even larger than life sometimes um so yeah we have seven uh full size puppets that are in this one we have three large trees one really large tree it's amazing seeing those come to life you know and aslan wakes the trees up to go win the day help win the battle we have the two bears we have aslan so it's just amazing um what god has enabled our team to do you know we we were begun like nicole said 1971 with the mission of making the bible come alive in minds and hearts through the power of storytelling and jesus constantly did that right with his parables parables he was telling stories and so we love to follow that model as we are made in his image he's the great communicator and so we get to communicate as well and communicate truth and we love c.s luis in a way that he did that with his storytelling yeah nicole let me ask you about that what are you hoping uh in fact you can both respond what are you hoping people to take away from this when someone comes maybe a long time fan like me the tough critic person who's going to come or someone who's never read one page of the chronicles of narnia when they come away from this what are you hoping to see we are hoping what luis really hoped as he wrote the book i believe is all the books is that they would engage in these stories and learn more and be drawn to know more about who jesus christ is in narnia and then outside of narnia in their own world and i think it's such a message of hope there is a message of faith all through all through the prince caspian so i pray that they're encouraged to walk not by sight but by faith and to be able to take those next steps in their walk with jesus christ and so so far even for our cast that has been such an impactful thing to do this production because the messaging that luis has woven through this book is life changing and so we hope it's more than a production we hope that it is real encounter with the holy spirit and to be able to see these truths come to life and of course we want the fans to be so pleased we want them not to walk away and be disappointed and thankfully as we've been performing this since 2017 we've had such great feedback so if you love the books you can't miss this it'll really come to life absolutely well let me ask you one one final question how are you two doing i mean this is a huge huge undertaking and you guys are at the point of this what what has it been like but one thing that's come to my mind is the the theme of sacrifice from it's 12 one and two it's just reasonable service to give your life back as a sacrifice to the lord so yeah it's a ton of work it's a ton of pressure but it's exciting to be in god's work and in god's service and every time we do a play we follow that theme in that play so the prince caspian of following of sacrifice of faith has been beautiful to experience in our own lives as well and we're grateful for museum of the bible they've made this possible caspian has never toured before it's too big of a show i thought but now it's touring on the road so museum of the bible is being a forerunner and bringing professional christian productions to the country we hope christians come out and and and support it so thank you for helping us spread the word and we have smart performance like literally in an hour so we're excited and the team is ready to go well i am so excited nicole and noah thank you so much prince caspian is playing now through april 27th at the museum of the bible in washington dc thank you guys and god bless what you're doing thank you so much appreciate it are you tired of just getting bills in your mailbox find inspiration instead by subscribing to the cornerstone television's hope today newsletter each month we'll deliver good news about what god is doing in our region and world through ctvn's ministry we'll keep you in the know about our latest special programming and our full program guide will keep you connected to all your favorites you'll also find a new dashing dish recipe every month as you read our hope today newsletter stay encouraged knowing your generosity and giving to ctvn is making a difference in building god's kingdom we can't do it without you sign up today to receive your inspirational free hope today newsletter every month in your mailbox go to our website at ctvn.org slash news or call us at<PHONE_NUMBER> thank you for being a part of our cornerstone television family hope happens here oh we really would love to send you our monthly hope today newsletter each month we feature a cover article that has just an inspiring faith-based story we bring you encouraging testimonies of how god is working in our ctvn family and also through our cornerstone cares which by the way if you give to ctvn a portion of all that you give goes to support many different missionaries and organizations around the world that are doing amazing things and then of course we have our recipe tell me about crock pot pizza soup that doesn't exactly sound great but you try these well maybe it does come on you try these don't you you actually try before you put them in there so dashing dish is a program that we produce right here at ctvn and every month i get to pick the recipe that goes into the newsletter and i make them i taste them i test them make sure it's good for you oh man i have a pizza lover yeah it was fabulous a pizza usually on a piece of bread you could put in pepperoni sausage mushrooms all the good stuff well no that that's that's important it's important to know that there's so many good things in the newsletter if you don't have a subscription to it just call the prayer partner and get your free subscription yes and every monday if you stay with us you know that we have meaningful monday and this is just a story that we look for in the news that's inspiring that will make your day and so we're ready now for meaningful monday well more than four thousand people made professions of faith for jesus christ during evangelist franklin grams god loves you frontara tour along the southern u.s border graham said we've had a higher response to the gospel invitation here than anywhere else i've preached in the united states people are hungry and they are hurting they're hungry for truth and the tour began february 24th in brownsville texas and concluded march 9th in chula vista california and after seven stops the billy graham evangelistic association reported that over 33 000 heard the gospel preached well more than 4 000 surrendered their lives to christ praise god and we give a great thanks to milton quintania from christian headlines dot com for this inspiring story i love it you know i love it i love it because this has been so much a political issue so much about keeping the border safe or letting people in all that back and forth back and forth it's been like a political football what does god want in the situation can we stop for a second and say what does god want and what god wants always is that the gospel and i would be shared with the people anywhere and sometimes people in desperate times are more open to the gospel than any other time and so here is franklin graham bringing the gospel and bringing the love of jesus christ the people who need it the most and i say praise god 4 000 new souls into the kingdom it's it's a miracle like it's beautiful to see how god is working through his people and remember like we don't have to be franklin graham to tell people about the good news of jesus christ as we heard franklin say like people are hurting and they are hungry they are hungry for truth and so god has strategically put you in a place where you have a circle of people that you impact each and every day friends family your community and so pray and ask god to just show you like who needs an encouraging word today that conversation ask the lord to help you have a strategic opportunity to be able to share god's love his good news of salvation and then we get the personal joy of seeing those around us come to the saving knowledge of christ it's quite the privilege it is a privilege and it's fantastic well i want to share a little story with you i'm going to share a narnia story with you so please stay with me and let's see if we can hear the voice of the holy spirit in this in another one of the books not prince caspian called the voyage of the dawn treader one of my favorites uh there's a character named ustas he tags along with the uh narnia kids and he's a real pain he's their cousin he's a real pain in the neck he just is always a a problem and and spoiled in so many ways and and they're traveling on a ship from island island and they stop at this one particular island they don't know but it's called dragon island and uh they ustas ends up running off into the woods just misbehaving completely ends up going into a cave and finding a bunch of gold there now if you've read some stories you might know you don't want to be laying on gold that a dragon has and he actually puts a dragon a piece of the dragon gold up on his arm and what happens he turns into a dragon and uh he flies back as a dragon to his shipmates on the beach and they're afraid of him of course then they find out who he is he can't talk of course because he's a dragon and uh but he he uh he writes in the sand he lets him know who he is and uh anyway he actually becomes a a better person as a dragon than he was as a little kid and um but he's still you know kind of feeling sorry for himself goes off into the woods lays down besides a pool of water and then aslan shows up the jesus character and aslan tells him you need to go into this water and bathe yourself and he does and he begins to peel off a layer of skin kind of like you've seen a snake skin or a reptile does it and that skin comes off but he's still a dragon and aslan says you need to go back in there again he goes back and he washes again in this pool and he begins to see another layer of skin come off and he does it a couple times two three times and aslan says i'm going to get involved and he goes in there and he's a lion right and so he has his claws and he begins to scrape this dragon skin off of Eustace and layer by layer layer by layer and it says in the book it hurt it hurt but it was good and then all the dragon skin comes off and he's Eustace again he's the boy again and aslan bathes him and clothes him and he goes back and he tells the story of how aslan rescued him from being a dragon well maybe we can see the spiritual lesson here the spiritual parallel the world the flesh and the devil has put everything on you has put all kinds of layers of stuff on you all kinds of things our sin has put layers of hurt and pain and problems and falsehoods upon us people have said things to you maybe it was your parents maybe it was a teacher maybe it was a bully said things to you and that and you've taken that to yourself and it's become part of who you are and God says no it isn't that's not who i made you to be you're not the dragon that you think you are there's a person inside of you the one i created the one that the world the flesh and the devil has tried to obscure but i'm here today i'm here today to change all that because when we come to christ things change listen to this verse 2nd chrithians 5 17 says therefore if any man or boy or woman is in christ he is a new creature the old things passed away behold new things have come this is what that story is about and god wants to do that for you today what things have been put on you what things has the world the flesh and the devil have people put on you that you're wearing like it's who you really are and and god's here today to say no that's not who you really are he's going to put that claw in there and you know what it does hurt because we become used to those things they become part of who we think we are and sometimes it's hurts to give them up but when we come to christ all of a sudden those things are taken away and we become who we were meant to be everything's not perfect but everything is right with god that's where he wants you to be today so just take a moment say god i'm sorry for my sins forgive me of my sins take these things away from me take those falsehoods away from me and let me live the life that you've created me to live and it's freedom in him it is absolutely freedom in him and tom even as you are sharing the story you know i'm sitting here and i'm just allowing myself to get into god's presence and i i hope that wherever you're watching today that you also just enter into god's presence because what we need is fresh revelation of god's incredible love for you and for me that he formed you with his own hands in your mother's womb and before you were ever born he wrote a story every day of your life that would cause you to be a person that a child of god first of all and that you would also be a person of great purpose and influence but one who is made for relationship with jesus christ and see way back in genesis one and the beginning of the bible we read how god made all of us perfect you know like adam and eve were perfect but then they fell into sin because the temptation of the serpent who we know is the devil but god already had a rescue plan for them and for you in place by sending his son jesus to die on the cross to forgive our sins to be the perfect lamb of god the perfect sacrifice to take away all of our sins all the shame all the guilt all the fear all the things that took away the core of who god made us to be and then we become a new creation in christ and so today if you've never given your life to christ this is your chance to become a brand new creation where god makes all things new where he revives and he rebuilds and restores let me tell you i am living in a season of life where i am seeing the restoration of god in all areas where lives are being raised up and made new again and god wants to make you brand new and put you on a path to receive his love and be the man or woman that he created you to be so he's going to take those things off you he's going to take that that bad word that someone said about you he's going to take the the things that that years of abuse have put on you and he's going to say today is a new day if you are in christ your new creature walk as a new creature in newness of life today on tomorrow's hope today are you in need of a miracle in your life today pastor matt brown shares his personal healing story and discusses whether or not jesus still performs miracles today don't miss tomorrow's hope today cornerstone television wishes to thank all our faithful viewers whose consistent prayers and financial support have made this program possible


Have you been finding it difficult to sleep?  I'm going to give you four things you can do throughout the day to improve your sleep at night. Listen for the next 60 seconds. A lot of people think sleep medications are the only solution for sleep problems, but adjusting your lifestyle actually does the magic. First, let's talk about sunshine. Even though you may not think that the sun helps with sleep, it actually does. Our bodies are regulated by an internal clock known as our circadian rhythm, which is triggered by the sun. Therefore, going outside and letting the light shine on your skin can help normalize your circadian rhythm and promote better sleep. If you live in an area of the Pacific Northwest where daylight is scarce, you can also use a light therapy box to compensate for the lack of natural daylight. The next thing you want to do is to be careful with naps. Napping for more than 30 minutes during the day can actually make it more difficult to fall asleep at night. If possible, try to nap earlier in the day, ideally at around the midway point between when you wake up and when you go to bed. The best way to control the amount of time spent napping is to set an alarm. Next thing you need to limit is caffeine consumption. Restrict it to early morning hours only. Caffeine has a 12 hour half life, meaning that if you take 200 mg at noon, your body will still contain 50 mg at midnight. In other words, it takes some time for your body to process and completely get rid of the effects of any caffeine you consume during the day. So in order to avoid caffeine contributing to your insomnia, it is advisable to stop all caffeine intake at least 12 hours before you intend to go to bed. And finally, one of the best things you can do to improve your sleep is to wake up and go to bed at the same time every day. Our bodies are creatures of habit and routine, so when we follow regular sleep schedules, we develop mental muscle memory that helps our bodies know when to start preparing for sleep. Remember that sleep is a holistic process that is the result of everything we do during the day and during the night. By making small changes to our behavior during the day, we can set ourselves up to have a restful night's sleep. You might want to explore the benefits of PMF therapy. Our chi coil enhances specific frequencies which aids in achieving a restful night's sleep, and this can be accessed through your mobile phone. Comment, sleep, and follow us for more tips.


This is Virginia. She's a research student at the University of New Mexico. She's studying submerged aquatic macrophytes, which are plants that live completely underwater. Her focus is on the East Fork Hamas River. In order to understand the impacts these macrophytes have on the Hamas River ecosystem, Virginia measures their biomass. Biomass is the mass of living organisms in an ecosystem at a given time. No, no, no, not like that. First, we collect samples from the same place multiple times throughout the season. After bringing samples to a lab, they are weighed and burned in a special machine at 500 degrees centigrade. That's three times hotter than when you bake cookies. Another measurement gives us the dry weight and is the total mass of living matter. So what about fire, you ask? Well, most aquatic macrophytes can survive a fire, but seasonal rainfall after a fire can be disastrous. Flash floods can wash fire debris away and rip many plants with it.  Well, if we lose these plants, we lose the benefits they give to the ecosystem. Fish that depend on the plants for food become vulnerable to predators and starvation. As a result, animals that eat the fish and animals that eat those animals also become vulnerable. The waters of the Hamas River and the Rio Grande depend on the plants to naturally filter the water. If the plants die, there may be a sharp increase in blue-green algae, some of which make toxins harmful to animals and humans. Rising temps due to climate change can cause a change in morphology or how the plants grow and what they look like. By studying these macrophytes when they are healthy, we may better understand how to react to changes and plan to address our needs and the needs of future generations.


Hi, this is Mitch Mitchell. Let me start with this that Was my reaction to the Ferguson announcement last night And it's a different reaction than the one I had with the Trayvon Martin decision Last year where I was really angry and I was in that mood where I really wanted to go out and hurt somebody But of course I couldn't because one I'm too old to I was not in my own hometown Am I gonna about a time I thought about hurting someone I probably wouldn't have done it anyway In this particular instance, I think we've known for probably a few weeks that this was the decision that was coming down I mean, let's be realistic here. The governor put out the National Guard ahead of time That never happens with a grand jury This whole thing was pretty much being set up to well Equit this guy that that's all it was they didn't want to bring it to trial the prosecutor basically did everything that prosecutors never do to Try to in my opinion get this thing thrown out. That's all it is and Usually prosecutors are actually at least want something to go to trial to have some kind of thing going but you know what? I think that these people in Ferguson really are just trying to hide from this now I'm not going to talk about that specific thing Instead I'm going to talk about some aftermath stuff, which is interesting to me. You know, you know, there was this riot There's the riot going on in Ferguson and that's not a surprise because you know It happened earlier in the year and they've been writing and they were prepared for it and you expect that And it was amazing that there were people in other communities around the country who worry about writing in their town from this I said really? I mean cops in LA were worried about a riot in LA They weren't worried about rioting after those cops got off in Detroit Back in 90 was it 92 the Rodney King beating, you know, no one right it in Detroit No one right it in Baltimore. No one right it anywhere else for what happened in Los Angeles So I thought that was you know, kind of a unique thing But there was a question that someone put up Um on facebook and I thought well, this is kind of interesting and I wanted to basically go after it And her thing was I don't understand why they have to go and riot and burn down businesses in their own communities That doesn't make any sense to me And I'm gonna address that And some people aren't gonna like the answer, but I'm gonna address that, you know People don't riot just because of one thing You just don't if everything had always been good And all of a sudden one day a kid was killed People aren't gonna riot It has nothing to do with the one instance what it has to do with is a build-up of Incidences and finally one gets caught on tape and everyone says, okay, finally This is the one that's going to show everybody what's been going on. And you know what? Every time in these communities they get off They always get off That's just the way it is and let's think about this. Where else are they gonna riot? Or they're gonna go like 10 15 miles into the suburbs and riot in those communities Yeah, that's gonna work real well. You know When you're ready to riot you riot where you are you're not going anywhere else one of the stupidest things I've never heard Why are they rioting because you know, this country is pretty much proven that sometimes the only way you get any kind of Overall justice later on is by violence For all the people who love to talk about non-violent and you know, I'm not necessarily a violent guy But every time there's a riot or there's some kind of violence something changes Whether it's just a conversation about how things are going or whether the political structure changes or whatever something happens and This is what's gonna end up happening in Ferguson at some point You know, it's just amazing to me that we have this major racial divide That no one really wants to address and no one wants to talk about and no one wants to realize that it's the absolute truth But it is, you know last night the mayor of Rochester and Rochester's got a black mayor and Rochester has a real strong high black population Came out with her statement And I thought it was a pretty nice statement But all the people in the Rochester newspaper who commented were against her they all hated her and some said sure She only cares about minorities, you know, she's a black mayor And how they want to get rid of her and how they hate her and I'm thinking are you really? But the other side of it was that everyone who commented was like I'm just saying, you know We really had these these divides that were never going to get to Before this thing came out in Ferguson They did some kind of survey CNN did some kind of survey and they came out and said there's a great divide between races Based on the you know of opinion on Ferguson. I'm thinking really duh There was a great divide on the Trayvon Martin thing. There was a great divide on Rodney king There's always a great divide. There is no real justice in this in this world Let's look at new york city new york city is supposed to be you know This this mega mix of people where everyone gets along.   What are you kidding?  I don't think there were any and then if there are any are going to get totally cleared and free and get to go anywhere else Never gonna happen in any city in america today. It's never going to happen This is not an issue of black and black crime. Let's not like muddy up the water with apples and oranges Also the kind of stuff. It's a totally different thing. This is cops killing unarmed people And there was another story the other day of a white cop who killed a 12 year old a 12 year old Who was shooting the bb gun or had a bb gun and he killed him because he you know thought it was a real gun Now You know what that one i'm not so sure about because they showed the gun and i gotta tell you the truth I don't really know anything about guns. So if i looked at the gun I might have thought it was something also and i don't know if the kid aimed at it or whatever But you know if if there's really a situation where you're not sure about your life or whatever Okay, i'm not blaming cops on that But some of these things that are happening, you know folks you're gonna get a realization The realization is going to be that you know what white people aren't always going to be in power in this country You're not always going to be the majority of this country as a matter of fact in 20 years You're not going to be the majority of this country. Hispanics are now. They don't have a great Political base. They don't have a lot of great economic base to really enforce their authority Uh, so things are pretty much there's not going to be any real change You know, so all you people who are worried about it, you know about the immigration like, uh, michelle bachman Twitter stupid self the other day saying oh, we just got five million uneducated people who are going to vote democrats It's stuff like that Where people say these things and sometimes they apologize for it And sometimes they don't that make black people think you don't care you could care less as long as you get to stay up here And stay above the fray and then later on come out with your I don't know why they do that or oh, they They shouldn't be rioting or they shouldn't be please really I don't know I just think that we're gonna see a lot more furgussets. We're gonna see them hitting closer to home And this is you know, there it is.  I'm sorry. Are you kidding?  This is totally different than the Trayvon martin thing because I think I was already prepared That this was going to be the thing Um, I will say that I wish peace on the people of furgusson In my opinion, I hope you get your political base together and elect some leaders who will represent you Since I understand the city is predominantly black elect some people who will represent you go and vote Go and vote So there I am y'all take care This is Mitch Mitchell And of course you hear the cool sound because that's my wife's cool sound. So she's sending me a text message That's a great way to end the video Y'all take care See you next time


Yeah, hi everyone. I'm Julius and I'm going to talk a little bit about the theming app as this was the first part where I contributed into the next cloud. And yeah in the past there was always this theming thing but there were PHP classes which you had to change and it was always this thing that this themes broke after an update or you had to actively watch what's going on with the theming and what's with the theming app in the next cloud is that it's basically always in there and we have this simple form where you can just fill out some basic values and even after updates those theming should work and yeah for now this always works and yeah the key point is we really want to keep this simple we often have this request for different icons for yeah every position in the UI but as you can see there's basically only one logo and the login image and yeah it's always kind of fun playing around with this as you can see this was at the hack week and right in the last months that's already also where I started contributing was doing some small fixes in the UI elements adding the logos right like there in the sharing button or Lucas did some performance improvements with rendering the image smaller and so this theming is basically in most places and next cloud but there are some things missing it's this basically all the icons and this is what I'm currently working on but there's yeah the support for S4G images is still not that good as it should be so yeah I created this dynamic creation so we can create colored icons for the folders or for mime types for different mime types and we can also generate fuff icons depending on the color or the app icon or even if you upload a custom instance logo you can then get the fuff icon with this logo so this is what's coming I guess with next cloud 11 when we get this ready yes and we have this capabilities API where the theming values are also in so any client developer can now ask the server what is the color used so clients can also like the Android app is already doing this for the background image I guess or it's coming so clients can also use those theming values and yeah I'm always thinking about how we can go further maybe a plain background image or something uses one because those yeah photo is always taking some time to load and maybe with someone some people don't want it or yeah maybe custom CSS but that's a little bit against that simplicity that we have now and we also have some features for app developers like we have CSS classes to apply the theming colors to your apps or we have this JavaScript object like in some apps you have some special cases like the notifications app had this little well icon in the menu bar and then of course you need to check is there a dark background or is it a light background and therefore you can use this JavaScript object but I guess the most important thing for app developers is to just use as much native UI elements as possible and don't try to mess up too much with your own styles yeah and I'm always welcome for any hints ideas for the theming app and thanks


Hey, this is Brett, and this 2017 Ford F-250 SuperCab Long Box is stock number 123437Z. We're here at Summit Automotive in Fond du Lac, Wisconsin. You're new and used heavy-duty truck headquarters. This 2017 Ford F-250 has the 6.7-liter Power Stroke diesel engine. This truck has been fully-safetyed and inspected by our service shop per the state of Wisconsin inspection process. It has a fresh oil and filter change, all the fluids have been checked and topped off. And this truck is 100% ready to go. We're going to go inside, underneath. We're going to start it up, take a look under the hood. In this video, BlueJeans Metallic is the color, and we shoot all of our videos in 1080p, 60 frames per second. So if you have HD capabilities on your computer, tablet, smartphone, or television, I highly recommend turning them on right now because it is your best way to check out the quality, condition, and options of the truck before seeing it in person. And if you like the video and how we do things here at Summit Auto, and the upper right hand part of the screen is a subscribe button to our YouTube channel. Click that, and then click the bell notifications, and you'll get updates every time we do videos here at Summit Auto. This one comes with the painted 17-inch alloy rims, and it has Michelin LTX AT tires. These are LT 265 70R 17s. They got right around half the tread left on them. Frame and underbody is in really nice, clean condition. Front fender is in excellent shape. I didn't see any major dents or dings on there. Headlight lenses are nice and clear, and it does come with factory fog lights. Front bumper and lower valance is in excellent shape as well. No major dents or dings on that. And the chrome trim grille is in nice shape. The hood is in nice shape as well. No major dents or dings on there. And the passenger side front fender, excellent condition as well. No scuffs or scrapes on that rim, and it does have blue jeans metallic. Like I said, it's got a lot of nice metal flake to it, really a good looking color in the sunlight. And as you go down this side of the truck, take note of how clean the body is, how reflective and mirror-like that paint is. We take these HD videos, so if you are far away or even if you're close by, just cannot make a trip down, but you're still interested in purchasing the truck. You can see the truck, hear the truck, and have confidence in the vehicle that you're looking at before you even get here. So when you do get here, there's absolutely no surprises. And you can make a smart and informed buying decision from wherever you're at. And if this video helps you make that decision, let your salesman know that you saw the video that it was helpful and that Brett sent you. Back rim is in excellent shape as well. And the back tires have just about as much tread as the front tires. You do get the nice plastic wheel well liners, which keeps your frame and underbody looking good. It does have the camper package with the anti-sway bar right there. And that frame and underbody, pretty nice shape, does have all the remaining factory exhaust. So it hasn't been altered in any way. And the lower rockers and cab corners all look pretty good too. Comes with the nice factory chrome step bars. And on the passenger side here, I didn't see any major dents on the box. Coming around to the back, rear bumper is in nice shape, has a backup parking sensors, full towing package, which includes a receiver hitch, four pin and seven pin wiring. And the tailgate is in really nice condition as well. Comes with a spray and bed liner, has a gooseneck hitch, and side box tie domes. Tailgate shuts nice and solidly. And as you go down the driver's side, just as clean as that passenger's side, a major dents or dings on the box. And for full disclosure, this back rim, excellent shape as well. Down on the rest of this side of the truck, looks really good. It does have the driver's side door code entry. We do have the code for this truck. And if you ever want to figure out what your code is for your 17-22 Super Duty, and the upper right hand part of the screen is a link to a video, where I show you how to find your code on a 17-22 Super Duty. Heated mirrors, telescopic tow mirrors, they are the power scopes. I'll show you how that works in a second. Inside the XLT package gives you the gray cloth interior. No rips or tears in the seats, does have the 40, 20, 40 split bench seating, power driver seat with lumbar, and factory carpeted floor mats. Power pedals, auto headlamps, tilt telescopic steering wheel, power windows, power locks, power mirrors. Like I said, these power fold in and telescopal, but the ignition has to be on. So, I will turn that on, and then we'll show you that. There we go. See, they power fold in nicely. I always like showing both sides that both sides are working properly. Then they do telescope out like so, and in, and once again, driver's side, working nicely as well. Alright, instrument cluster. You can see that this one has 21,301 miles, I'll dim it down just a little bit so it's easier to see. You get a digital speedometer, compass display, instrument cluster is nice and clean, does have the cruise controls, information center controls on the left, Bluetooth and audio controls on the right, steering wheels in pretty nice shape, and it does have the six-speed automatic transmission with the optional tap shift, has the AM, FM, and Serious Satellite radio capabilities, and this is also where your backup camera shows up, and you can see that's working nicely, does have a CD player, turned out four-wheel drive, factory brake controller, climate controls, heated mirror button, you get a USB, it does connect to your Bluetooth cell phone, passenger side format and seat are in excellent shape, no rips or tears on there, and the headliner is in excellent condition as well. This one does have these six auxiliary up-fit switches and map lights right there. We'll take a quick look at the back seats and then we'll start it up and take a look under the hood. Back seats are just as clean as front seats, no rips or tears back here, it does have the latch child safety system for any child car seats you may have, fixed glass rear window, these seats are in excellent shape, you get a little bit of storage back here and the carpeting is very nice and clean. I do like on the new body style these doors, they do open up almost all the way there, which is pretty sweet, and then they swing shut like so, and they also, those windows do power roll down as well. Started up, take a quick look under the hood, no check engine lights or anything like that. I would personally like to thank you for checking out the video today, and hopefully from this HD video you will have been able to verify the quality and condition of this truck all the way around. Under the hood we have the 6.7 liter power stroke diesel, engine base very clean, runs very smooth, once again this truck has been fully safety and inspected by our service shop, has a fresh oil and filter change, all the fluids have been checked and swapped off, and this truck is 100%, ready to go, shocks have been a nice job holding that hood up, there's your vehicle emissions sticker. And to see more pictures of this truck or one of our other 450 new and used cars, trucks, SCVs, minivans, Wranglers, halftons, sweet quarter tons, one tons, you name it we've got to go to that website right there www.summonauto.com, full pictures and descriptions of every single vehicle from two locations all at www.summonauto.com. If you'd like to check out more HD videos you can go to www.youtube.com. Remember to like, subscribe, and share on this video and all the videos that you see there. Click the bell notification so you get updates every time we do videos here at Summit Auto. In fact in a second you will see a link to subscribe to our YouTube channel on the upper left, a link to more F-250 videos like this one on the upper right, a link to this vehicle on our website on the lower left, a link to one of our latest YouTube videos on the lower right. Click those check us out and we're super excited to help you with this ultra clean 2017 Ford F-250 SuperCab Longbox XLT and BlueJeans Metallic. Thanks again for checking out the video remember to like, subscribe, and share.