My name is Rulof Teving. This is my beautiful assistant, Harun Mir. We're doing a talk entitled The Tale of Two Tested Proxies. Just to give you an idea of where we're from, we're also the guys that brought you tools called Lecto, Crowbar, Beauty Blow, we're the producers of Hacking by Numbers, Terry putting the tea back in Cyberterrorism, the directors of When the Table's Turn, several sin-grays, fairy tales and contrary to popular belief, we were the inspiration for the Matrix Trilogy. So the talk is about two different proxies. I know most of you that are here have got a bit of a headache from the 303 party last night. So I'll try to keep it brief to the point. We're talking about two proxies and they're very different proxies. So don't get confused about the two different proxies. The first is called Suru, which I'm going to speak about, which is a web application proxy. It's kind of main in the middle, the same as things like the AdStake web proxy, web scare up, those kind of things. And then Harun next to me is going to speak about LR, which is a generic TCP proxy. So it's totally different things and we totally different people. Okay, so why do we need yet another proxy? It seems like we have lots of proxies, there's Burr proxy, there's Parros, there's AdStake web proxies, all of those things. Why would we want to have yet another proxy? Well, one of the things that we found was that none of those proxies actually does nice discovery of directories and files like we do it in Wecto with the back end miner. I don't know how many of these people in this room are using Wecto. Can I see hands? Okay, so you know that the tab there that does the back end mining that looks for directories, looks for files, different extensions, different directories. We wanted something to do that a little bit more intelligent. We also wanted something that could fuzz variables a little bit more intelligent, but also wouldn't try to be too smart about that because you get lots of these tools out there that are trying to be super smart about how they fuzz parameters within a web application and that smartness that they put in there is really their downfall. We also wanted to be fairly generic so that you can use it for just about anything. So, after looking at how the guys use web application proxies for a long, long time, we found that there's really no one button kind of solution for web applications. You can't really take this one button run it and it finds everything about the application, logs in automatically, bypass all of the forms, all of that kind of thing. It's not going to happen, right? But what we've seen is that people that are good at web application assessments, they really want to have full control over exactly what they send to the application, and then they inspect what they get back on the page, and then they make a change and they send it again. But a lot of the stuff that they do, they automate. They don't automate, they do it over and over and over. But there's just enough variation in that test that they do that you can't really automate it properly. So they want to have the control over the application and want to have control over exactly what they send, but they kind of want some power tools that can help them to do a lot of the stuff that they do repetitively. And this is where this proxy comes into play. I've also seen that lines between where the application start and where the web server ends are kind of blurring. There's a lot of the components and extensions and stuff that's really sitting between application level on the one side and a network level, network application on the other side. So this is what we set out to do is to build a proxy that can do these things. And it didn't happen just in one day. So I'm going to give you a quick brief history and you can kind of figure out how we got to where we are now. It really started off by when we did work on Wecto and for Wecto what we wanted was we wanted something that could do, you know, that won't be filled by friendly 404s. So we started looking at the content of what a page returns and matching the content between a test page and the real page. And that's really where the cleverness of Wecto sits. It sits in the content comparison algorithm. Sadly, some people still don't know how to use that option. Dude, you can't do that, that's mine. Okay, so we created, then we created Crowbar in early 2005 and it's also sad but most people don't know how to use it or how it works and it's really one of the most powerful applications that we built. And we extended the thinking in Crowbar that we said we want something that is really a generic brute force. So we would send a request that a test request and then we send the real request and we would see how these two match up. You'll see later on how it sits together. So how does it work? And hopefully this is the last time I'm going to talk about this. In Wecto, we basically, if we want to test through a file, let's say login.pl that sits in the script directory, we would first test for something in the script directly that we know that does not exist. Like moo, moo, moo, moo, moo, right? And that's the base response request that builds the base response. In Crowbar, we do the same thing. If we want to test for a username and a password, we would test for something that we know never would be correct like moo and blah and then we would actually use the actual test that we want to perform and check the content between the two and compare the content between those two requests. If the content are the same, then of course the file doesn't exist or the login attempt was unsuccessful. But if they differ, then we know we got a different page, which is interesting. So how does the content comparison algorithm really work? Sorry, I've got a question there. Can I take them at the end because we're going to kind of, is that okay? I promise, I won't forget you, sir. Okay, how does the content comparison works? Well, let's see, step one. What we do is we crop the header if we can. If there's nothing in the body, we use the header because then that's all we have left. We split the strings, let's say we're comparing string A and B, we split the string A and string B on new lines, on tag brackets and on a space and let's say we call that collection A and that results in collection A and collection B. Then we count all the blank items both in collection A and in collection B and we do a little loop loopy thing that says, you know, for every item in collection A, loop through all of the items in collection B and if they are equal, increment to counter and if you found a match within that, break out of the loop and look for the next thing that you want to match within those strings. And then what we return, we return two times the counter divided by the number of elements in collection A, the number of elements in collection B minus the blanks. Now, this is what it looks like. So let's say I'm testing a thing, two strings. First, the first string is I'm testing this, dudel sakduk, and the second string is I'm testing this kaas krallikis, then collection A is I'm testing this dudel sakduk and collection B is I'm testing this kaas krallikis because now we split and all those different things, right? And there's four words matching within the two collections, a blank count is zero and we have the number of items in collection A is five, number of items in collection B is five. So our return is 80% match, 0.8. If we have I was testing and I am testing them things, then our return is two times the amount of words that match, which is I and testing and we got a 50% match because we got eight words in total. That's how easy it is. It's nothing like super fuzzy neural networks. It's just kind of easy. Okay, so with this we have the ability to in crowbar set a level, a fuzzy logic trigger level, which is if it is below this particular level or outside of that level of the compare, then put that in your result. Okay, you'll see how it works just now. In crowbar we also did some content extraction. So in this example, for instance, we mining here the numbers that you see there circled, if you can see them, I know it's hard at the back, you probably don't see a thing, right? Okay, then you'll see here what we do is we basically put in names into Google and our start token and end token is of about and the bold tag, closing tag, which means we're looking at what Google returns, how many hits does Google returns on different names. And you'll see here, you got Peter has a hit count of 990 million, while someone like, you know, let's see. Audar has a count of 124 million. And you might go, I can write this in pool in like two lines of code, but you'll see later why this is interesting. Now, why does Victor suck? And it actually does suck, right? One of the features that we use in Victor a lot, lot of people use it, there's the back in minor thing. But what if the entire site sits in slash corp, you know? Then we're not going to find any directories in slash corp, right? So one of the thinkings behind the mirroring option in Victor was that you mirror the site first, you get all the directories that exist on the site, you load it back into the back in minor and then you search within those directories for other interesting directories, correct? But what if the site has a form based login? So there's a username password field and the whole site sits behind that, then what? Well, that's why Victor sucks, because it can't know that, it doesn't know what to do. It doesn't do any fancy stuff like looking at directories within directories if the directory name isn't in the list. And so at the end of the day, we say, I say, Victor is a blind chicken, peking away at dirt. Yes, okay. We also have a problem with this, we can't see when there is, let's say we look for a file. We see that a file has been served to login.asp sitting somewhere. Wouldn't it be nice if in that directory, we also looked for something like login.zip and login.bat and login.asp tilde. Well, it wouldn't be login.asp tilde, you know. You get the idea. So we start looking for other extensions. That's just one of the things that we can do very easily if we sit in line with that, in a proxy that we sit in line with the request and we can see what request has been sent. We can also do fuzzing with Suri, okay. Is it something I said? Sorry. If we have a content comparison algorithm, then what we can do is we can send junk into different parameters, right. And send like, let's say a thousand different strings. A thousand different strings in one parameter. See how this, how it reacts. And look at the content compared to a base response. Right, and group responses together. So that we say for a thousand requests that I've done to this application, I only get three pages as a result. So I'm going to show you how that works. So I'm going to try to keep the mic here as well. So here we got this little site. I can log in there, test and test. And you can see that it failed. And if we go to Suri, this is why I said you should sit close because you know, that's a small font. Now you can see here, there's a request. It's a post, it resulted in a 200, okay. It's got three parameters. I double click on it. And it basically shows me this request editor that I will keep still anytime soon. And I can say, okay, take the username parameter and fuzz it with all of the strings that I have. Okay, that's just the file. Okay, the file sits, the file simply sits in the, see what's happening, getting base response. Okay, the file simply sits in here in a config. So I can actually go to that file and I can edit the file here right on the fly. It's just the text file, all of the type of strings that I want to test against this thing. Okay, I just want to see why I'm not getting to it right now. Oh, there we go. And there on the right hand side you will see that it starts to actually do all of those requests to the server. I can then go and I can say, well group the responses with the tolerance of 0.02. That 0.02 is just the ob number. Remember, a thing that matches completely yields a one. Something that doesn't match at all yields a zero. Okay, so with the tolerance of 0.02 between different requests group those responses. So I'm going to click on auto group and even at the back you should be able to see that we get three different responses. There are three different unique responses. Let's look at the responses that that generated. I can browse the request immediately there for all of those. And that is basically a CGI error that I get. Standard CGI error, right? That's one group of requests that I've made that resulted in the CGI error. This one over here, if I click on it, you'll see it gets to login failed. Please try again, which is what happens when I put anything in there that doesn't work. Over here you'll see there's one request that got a totally different response. And that is standard SQL injection, single quote or one equals one dash dash. If I browse that response, you can see that that gives me access to the application itself. Okay, so clearly I can test with any strings that I want and I can basically say show me how the application behaves in different ways. This application can behave in three different ways whenever I send junk into the username field. On the recon side of things, if I set my target to be intranet.postsense.net, I do directory mining, I put on directory smart scanning and file smart scanning. I clear everything and I manually reload. You'll see that it's now got 118, 117 jobs that it has to perform. And I can set the speed. These are recon jobs that it's performing. I can set the speed at which this thing is basically running on this side over here. Because maybe I don't want to have this reconnaissance process while it's trying to find these files. I interfere with my browsing experience, right? Because if you're flatlining this thing and it's starting to look at files, then you can fully understand that your link is going to get saturated. While in South Africa our links get saturated by things like this, okay? So I can up this a little bit, make it a little bit faster. Over here you can see the structure of the site so far that we've seen. Our VMware is not responding very well at this stage. There you go. We also have on this tab over here, we've got miscellaneous tools, so you've got a one click convert from your user input to the word since post to MD5, to hex, to shot one, by 64 encode, by 64 decode, all of those kind of things. You've got a search and replace on the outgoing, search and replace on the incoming. Just want to see what's happening over here. So I'm going to leave this for a bit. We'll get back to this as soon as it's done. Okay, is this where I was, I hope so. Okay. So there you can see actually what we've done with the request editor. We see the different request being broken up into different parts. And we can pause the request, nicely break it up into its different parts and let the user select exactly what part he wants to fuzz. You can also fuzz anything within the HTTP request. So in this case here, you'll see what I've encircled there is the user agent, right? So I can brute force, not brute force, I can fuzz the user agent, see how the application would respond to different user agents that I'm sending in. Maybe if it's a mobile application, it would look differently when my user agent is set to that of a mobile phone. We can also extract anything from the reply that comes back, right? In this case here, we always extracting by default the title that comes out. Other things why Siri is nice, we have a thing called automatic relationship discovery. So for instance, well let me first tell you what it is. So it basically looks at every parameter that you send into the system at any time. And it then in real time works out the char one hash, the MD5 hash by 64 encode by 64 decode of every parameter and puts that into a structure. And when you click on the auto relationship discovery button, it basically goes through all of the parameters that you've said, plus all of the derivatives of those parameters and see if there's any kind of match. Why would it want to do that, okay? For instance, if we log into an application and let's say as a cookie, we get send back the MD5 of let's say the username, which is really a bad idea, right? Then this tool will tell us, Siri will tell us, listen, those two things match. The MD5 of the username is actually the cookie. Now imagine you testing application with 300, 400 pages. That's useful because you're not going to keep track of all the parameters and everything that goes through, right? We also have search and replace on both incoming and outgoing streams with the ability to change binary data. So what you see there is the picture of Google, the little Google picture thingy. When we've replaced binary hex zero three to hex three zero, and that's going to screw around with the picture, right? Because those are things that's contained in the binary stream that's coming into you. Other reasons why Siri is really nice, it's really usable. We've really tried to make it super usable. So it uses the IE browser object to replay request. So you don't have issues with authentication, digest authentication, NTLM authentication, those kind of things. We can instantly replay request while we busy with it. And we can keep track of request that we played back because it marks the request and says, this is a request that you edited and played back to the system. Something that was quite interesting to handle was XML and multi-part posts.  It also handles multi-part posts very nicely, handles XML very nicely. Where do we see XML? We see it with web services, right? So if you have a thick application that is using a web service over SOAP, then you're going to see those XML coming into Siri as well. So it renders it nicely, you can edit the stuff, that kind of thing. You can save and load sessions. So you can work on something, say, well, well, well, I want to save this and I want to come back to it later. You can save it, load it, it's nice. You can instantly fuzz any variable as you've seen. You can fuzz any part of the HTTP header. Those fuzz strings that you have, you can keep it in a file. So it's not limited to someone's fuzz strings that they decided to give with the application. You just add on top of them whatever you want and it will always pull it out and tell you. You know, the application responded differently when you set this particular parameter in there. You have instant access to the HTTP raw request, which means you can go to that main window, you can add anything in the middle window right there, a post, a get, it doesn't matter what it is. You can send it to the browser or you can browse it or you can send a raw response, a raw request and it will automatically calculate the content length for you. So you don't have to do that. So it's useful in certain cases, right? We got one click direct reminding all of that kind of things. So you've seen all of those kind of things. Let's go back and see what's happening. It's not very, it doesn't look very promising. Let's switch back. Getting the demo kind of gremlins. I did this thing outside five minutes ago, but it's the Zen energy in the room that's just wrong. Okay, nice. It's a very nice new man in the middle proxy. It allows the analyst the freedom of thought so you can still control exactly what you want, but it automates the parts of the application assessment that's really mundane and boring. It's really a good combination between the best features of work to crowbar and e-all and a really useful proxy. If you need to application assessment, if you need to web application assessment, then I suggest you start off with something that's a little bit less complex. As my colleague Schauffen had well told me when he saw this the first time, he says this looks like the control console of a Boeing. So it's not that friendly for first time users, but as you get used to the other proxies, you will find that they have certain limitations and you want to use something like this to overcome those limitations. When you get to that stage, you might want to switch over. It was written in house by ourselves, so and we do hundreds and hundreds of web application tests every year. So it was written by people that actually is doing web application testing and therefore the interface and the way that it works is geared towards people that actually have to do the work and not by people that can program. That's probably why you don't see the results in the other page. The URL at the bottom there, if you want to write it down, www.sinspost.com slash research slash suru. And this is the stage where I hand you over to my beautiful assistant and colleague Haroon. And I'm going to switch over here. Let's see if it works. Okay, thanks for the sound effects. My voice is a little bit scratchy for no good reason. I didn't go big last night unlike some of the guys I spoke to earlier. So you're just going to have to forgive me. For something completely different, what we're going to talk about now is a tool called LR, largely because we never got around to naming it because it's not that packaged a tool. So LR is a generic TCP proxy where LR at the moment starts for last resort. You've used all the tools you can and nothing seems to be doing it for you. We fall back to LR. A quick background. Suru is neat and well packaged and has a shiny C sharp interface. It's even got something like 62 pages of documentation, I believe. And videos, Ros just corrected the number but I'm going to skip it. But Suru is neat and well packaged and LR is not, okay? LR is a collection of other people's cool tools tied together with some duct tape, which in this case happens to be Python. I'll say at the outset, almost everything that you can do with LR, you can get by using a combination of other tools. The truth of it is that LR just makes it convenient for you and we'll go into why I did it anyway. Okay, so what does the whole thing mean? The first thing it means is that clearly I have no future in sales or marketing, okay? The second thing really quickly, someday LR will grow up and become a neat, shiny Suru like thing for generic TCP connections. Today what it is is a bunch of really simple scripts that allow you to modify TCP packets kind of in the same way that Suru allows you to alter HTTP, okay? There's very little or no cleverness in LR that belongs to me. It's built on top of two much cleverer projects, one of which is Philippe Biondi's Scapi and the other is Neil Pickett's IPQ. We wrote it in Python just because all the cool kids were doing it. It was peer pressure, okay? So the question for why we actually did it, one of the reasons that I don't have up on the board there is just because we had this idea and wanted to play with it, we wanted to see if it would work. But one of the other reasons was because there's lots of limitations in current tools that get annoying when you just want to get something sorted. We also wanted to take a look at how simple something that to date has been pretty complex actually can be, okay? And we end up with a pretty simple framework for you to be able to do this and hopefully you'll see it, okay? And pretty much it was just to go into the possibilities, some of the stuff that you can get right once you're in the position to mangle TCP packets before sending them on. Okay, so one of the first questions you get are someone saying what about ITR, what about NGREP, what about insert tool that they've been using till now. Okay, lots of those tools are okay. All of them that I've seen require you to point your server towards the proxy. So you make ITR your server, you connect to it, it connects to the real server, okay? That's pretty okay, but in some instances this becomes a problem. For example, when you're doing some malware analysis, okay, what you really want to do is sit in line, watch the request go through, say I want to mangle this now, I see this DNS request going out, I want to give it an arbitrary response, or I see this request for a file, I want to give it another file. Okay, lots of them are closed source and lots of them require some hardcore packet foo, okay? If you take a look at anything written in LibNet or LibDNet, those are great products, great tool sets, you're going to end up using several hundred lines before you send out a few packets. Okay, so we were going for really simple, really quick and easy. Ultimately, we wanted you to be able to modify packets and payloads as they go through, and for you to be able to do them within complex sequences, okay? So maybe you don't want to change every packet, maybe you want to change the 10th packet if the day of the week starts with W, okay?  And we wanted to do it really quickly because we've got more important things to do, like retain our title as Office Minesweeper Champion. Okay, so how it currently works is really simple. At the moment it's sitting on top of IPQ or IP Divert. Okay, so all that happens there is we've got a firewall rule that grabs the packet as it goes on to the network and moves it to a user space process. Okay, once it's in user space, we then use Python and Scapi specifically to mangle the packet. Okay, so Neil Pickett's IPQ is allowing us to grab this packet off the IPQ and Scapi is then allowing us to say what that packet is and what we can do with it. Okay, really quickly, if I'm going to do this, it's only fair that we pay homage to Scapi. Okay, Scapi is available at sective.org by Philippe Biondi. It's by far currently the easiest way, most convenient way to generate packets. This year it was 28 on Feodor's top 100 security tools, which means that most people have yet to discover how cool Scapi is. Okay, if you haven't used Scapi, I'd advise it, go play with it, it's really worth the effort. These two quick examples stolen from Philippe Slides that he gave earlier this year shows that creating a packet is simply a case of saying, I want IP destination this, ID this, TTL this, make me a packet and send it. Okay, in his slides he says he wants the equivalent of you ordering fast food. So you should be able to say I want a burger, extra onions, hold the cheese, make it now. Okay, and what you see down there is an example of the land attack, okay, famous for old IRC's, okay, but literally what used to be a few lines of code is now a one line Scapi script. Okay, so quickly SPLR is going to grab the packet through IPQ, then decode the packet using Scapi, mangle the packet using Scapi, and then put it back on the wire using IPQ again. Okay, so you understand why I say the heavy lifting is done by other people. Okay, at this point we were supposed to give you a live example of this on the internet, which we can't because we have no internet, but we've got several other examples that work locally on VMs. Okay, so for this first example, which you're just going to have to trust me for, we do a simple Google search replacing a search for foe with a search for ba, okay. At this point you should be saying that's a pretty easy packet modification to make because we haven't altered the payload size. Okay, as long as you're not altering the payload size of the packet, modifications are pretty straightforward thing to do. Okay, and then you get bitten as soon as you change your TCP packet payload with new check sums and with sequence numbers. Okay, one of the things you bump into here is a common misconception about TCP sequence numbers. I'm not sure where this started, but there's actually texts on the internet. You even see it wrong in some books. Which basically describe the TCP flow that says, the sender sets his initial sequence number to something, sends a packet, which in this case is five a's. And what you find in incorrect texts is that the receiver then adds one to the sequence number and sends the packet back. Okay, now clearly this is incorrect. Your receiver doesn't just add one to the sequence number. The receiver adds the number of bytes of data that he received in the payload and increments that to the sequence number sending it back to the sender. Okay, so he tells the sender, this is how many bytes of data I received from you since your sequence number. Okay, now why this causes a problem for us when we doing arbitrary changing is because you creating a desync between the client and the server. Okay, and we'll have to find a way around that. It puts us in the position to do a classic man in the middle attack. Okay, so all we do is sit in the middle of this TCP stream and don't let sequence number or act numbers go through as they want to. Okay, so the client sends through his sequence number. Okay, so if you take a look at this example, as I have to tell you, this photograph here is completely arbitrary and has nothing to do with the presentation. I asked someone at work to do this Vizio for me and he said he would do it if I gave him mad props. Okay, so I'm not sure if this counts, but that's Shal getting mad props because of his Vizio. Okay, so at this point, we have a client that sent the request for Foo. Okay, we grab this with our proxy and we change the search to Foo Foo Foo. Okay, the problem is we've now added six to the data that the client sent. Okay, what's going to happen is the server's going to act nine and the client is waiting for an act three. Okay, so this desync is going to be a problem because you're going to end up in a loop where the client's going to keep retransmitting saying what the hell are you talking about and the server's going to be saying already told you I saw that. Okay, so what Alar does in the middle is just does this translation. It says we added six as the sequence number comes past we're going to subtract six and keeps both sides happy by playing man in the middle. Okay, and once we in line, it puts us in a position to alter any data that's going to the client or to the server and it becomes interesting for the new wave that everyone seems to be focusing on these days which is client side fuzzing. Okay, it becomes interesting for just about any lame client side security bugs and if we're going to talk about lame client side security bugs we probably have to say something about the VNC 4.1 authentication bypass. Okay, so sometime earlier this year someone writing his own VNC client figured out that the VNC protocol actually had this bug in it. The client and server decide that they both speaking remote frame buffer, whatever, whatever version and then the server sends the client in a ray saying I'll happily talk to you with authentication type one which is password or two which is certificate or whatever and the client then sends back that's cool, I'll talk to you with authentication type one which is password. Okay, the problem that turned out is the server never checked that the option that the client chose was one of the options that it actually offered. So the server said I'll like to speak to you with two, three or four and the client said that's cool, let's do zero and the server said cool, let's do it. Okay, where the client was actually choosing type zero which meant no password, okay. So it was easy enough to build a tool for this. All you have to do is alter the VNC client to always offer up zero or if you wanted to, you could achieve this using in our case LR, okay. So hopefully I'll have good luck with the demos. This mic is clearly in my way but if we go XVNC viewer to the Win2K box, okay. What you should see is that the WinVNC box comes up and asks for password. Okay, at which point we put in our password and everything is happy. Okay, at this point what I'm going to do is pass the packets through our proxy and this time we're going to tell the proxy that actually what we wanted to do is modify that authentication type to always be zero. Okay, so running the exact same client, what you should see is authentication completely bypassed in this case because the proxy got in the way and said hey let's not do this authentication stuff, let's just skip it. Okay, at this point you're passing through a proxy that's written in Python so it's going to be a little slow but it should work for just about anything that you want to do. Okay, I'm going to go back to my slides if I can find it. Okay, once we at this stage obviously we in the position to do header modification of the TCP packets, at this point it becomes totally trivial. So we are looking for a good example to show you guys and the obvious one that comes up was a problem that FreeBSD had a little while back where if you changed the header flag or the ECE flag in the header, if you set it FreeBSD firewalls thought that you are part of an established session and just sent you through. Okay, so what we've got here is a FreeBSD version that was vulnerable to this and for those of you with super sharp vision, what you should be able to see is that this firewall has two rules. The first rule says allow TCP if it's part of an established session and the next rule says deny everything else. Okay, so if you familiar with this type of firewalling you should know that nothing should get through. Okay, I can't send any SIN packets through which should leave me sitting quite badly. Okay, so at this point if I tried to telnet to the FreeBSD box on port 22, okay, as expected I should get back nothing. Okay, and this should work for just about all the services on this box. Okay, I shouldn't be able to surf to it or anything like that. Okay, it should just spin its wheels. At this point, all we're gonna do is start sending packets through us again. Okay, and at this time we're gonna tell we're gonna tell our proxy to add the ECE flag to everything. Okay, what you should see is that same telnet this time happily goes through. Okay, and in fact you should find that just about any connection to that box should happily go through to the server. Okay, so again all the proxy is doing is saying grab the packet, you ask me to modify the header, here you go and the stuff goes through. Okay, the bug in FreeBSD is pretty old but you guys know there'll be other bugs. Okay, the interesting thing about this is we released an exploit for this way back to allow you to do the same thing and originally even though it stole stuff from LibNet, the amount of code that you needed was around 270 lines of C code, okay, to achieve this. Using LR today, you can do it in 20 lines of Python code, okay, and about four or six of those lines are actually comments. Okay, so pretty much you should be able to say grab this packet, do this, pass it on and you'll be a happy camper. Okay, other uses for it, we found you can use it nicely if you're doing some sort of malware analysis. Okay, it's really useful and at this point you get the joy of hooking up with a clever project like Scapi, okay, so I don't actually know when a packet's going through what that packet is or what that packet contains. I simply ask Scapi, hey show me it's IP field.  Please show me what your UDP request is or your DNS request is. Show me what your DNS request ID is and Scapi happily says, well this is what it is. And if you've ever tried to modify a DNS request as it went by on the wire, you'd know that it's not just a text record, okay, there's some ID stuff, there's some stuff that identifies it. In this case, I skip all that complexity and leave the cleverness to the guy that wrote Scapi. I say, make your DNS a result, www.food.com, Scapi does it, Scapi magic, and gives me a packet and I say send this packet out. Okay, what this needs and for those of you who caught the Matasano talk on PDB, anyone who's doing this stuff bumps into the same problem. So I've effectively fixed the desync between client and server by sitting in the middle.  Okay, so while you're sitting mangling your packet, the client's going, I sent this and didn't get a response, resend. I sent this and didn't get a response, resend. Okay, and what you really want to avoid more than the noise is the client and the server breaking off communication because of a time out. Okay, so nobody's really solved this. I figure we know how to, we just didn't have time before getting here.  Basically what we're looking for is to tell both client and server that you're now being debugged, please stop what you're doing. The problem is we doing it by sitting on the wire so we don't have direct control of the client or the server. Okay, what I figure we can do for this is to steal an idea that tarpits use. Okay, if you've ever used a tarpit for anything, you'll know that if you set your TCP window size to zero and talk to a client or a server, you're basically telling that client or server, I'm too busy right now, please stop talking till I tell you you can start talking again. Okay, and what my plan is with this is that we have a lot sitting in the center and as soon as you want to mangle the packet, it spoofs the TCP window zero to both the client and server saying, can you please just give me a second? Okay, both guys stop and when you're ready, you send them both a window update saying, okay, let's start talking again.    Okay, so we'll try it as soon as we get back and it should be on the final version of the TGZ that we put up. Okay, so with this, what you should have is a really trivial easy way for you to mangle packets. Remember, one of the core objectives with this was just for guys to see how simple the stuff actually is to do. Just about all of those things that I used for the FreeBSD thing, for the VNC thing, they're about 30 lines of Python. Okay, where at least half of it is templatable. Okay, where you're saying, here's the packet coming in. If the packet looks like this, change it like that. And you literally, for those of you who've seen any Python script, you know that it's pretty readable, unlike most of my old Perl. Okay, so you should be in a position to mangle the stuff pretty easily. You should be in a position to say, well, hold on, if we can do this, we can do the following 10 things. Okay, which is pretty much what we want you guys to do, to go back and say, well, you can use it for the following and you can do much cooler stuff with it. The TGZ for this stuff will be available at www.sensepost.com forward slash research as soon as we get home and actually upload it. So yeah, download it, play with it, give us feedback.  With that, we go back to the good looking one. Who needs to alter. So, in conclusion then to our talk. We basically, when we train people, we say, listen, it's not about the tools, it's about the thinking. And if hacking is art, then tools are really the brushes. But a monkey with a brush is still just a monkey, right? So the bottom line with these things are, we preach to everyone that it's not about the tools, it's not about your exploits, it's about the thinking, it's the way that you think about things. But having nice tools really makes it easier to really make cool stuff. So, again, we don't want to sit here and say, hey, look at this tool, look at this tool, look at that tool. But it is quite cool, I think. The stuff is available again at that URL, www.sensepost.com. You can have a look there, go to the research area as well, if you want to. And at this stage, I want to take some questions, there was a sir there that I said. I promise I won't forget. If there's any questions at this stage, I know we got, I think we got five more minutes, two more minutes. Do you guys use the mic because then I don't have to repeat the question. Two quick questions. What's the support for HTTPS on those tools for SSL? And what's the support for internal proxies? Okay, good question, the first was SSL. Yeah, there's full support for SSL. We do it as all the other proxies do, manual with the certificate, same thing. In terms of internal proxies, that you mean training proxies together. Now, I haven't done that because it's actually not, it's doable, it's totally doable, but I haven't done it, so it's just implementation. So I'm sorry, at the moment you can't change it. Is the source going to battle? No. Depends on which one, so LR source code, it's just source code, it's just Python. So I just have a question about how you handle packet loss because if you're changing the payload size and then you change the sequence number, you're adding and subtracting these digits, if it says all right, we lost three packets and it's going to continuously send those first three, not the whole, absolutely. At this point, the easy answer is it totally screws you over. As does fragmented packets. You can get away from both in the short term by having your firewall handle it for you. So do reassembly at the firewall level. I wouldn't advise you to use LR as a genetic proxy while you're just oddly surfing around. So you want to use it while you're doing testing on an application. It's not going to handle heavy loads. You're simulating an IP stack in Python. So yeah, at this point we not and to be honest, I don't think I'd build it in because I think it would be more trouble than it's worth. I have about three questions regarding suru, your import-export format for saving sessions. What kind of formats are they in XML, CSV? No, it's suru format, so. No, it's totally text, so you can modify it if you want to read it, but it's totally proprietary. It's not XML, it's not CSV. You can probably convert it if you want to, but at this stage it's not any of those. Okay, and dealing with your auto-relationship discovery where you look at the parameters and different encoding methods, do you look for clear text also through other parameters? No, we actually don't. So it's something that we thought about doing, at the moment we don't do it. So if I understand you correctly, that is if there's clear text in one parameter that is contained within some of the other parameters. Yeah, correct, so like if you have some post and it has a username or password and then it's putting that username in the get request. No, at the moment we don't look at the clear text. It's easy to add, it should be trivial to add. Okay, and then last question is, so mainly the way that the new Wicdo backend that you put in Suru works is that it works off of 200 versus 400 or mismatched responses. If you have 302s in those and they're popping over to the same website, does it look at anything else in there like content length or? At the moment within the directory and file mining in Suru, we don't look at status code at all anymore. We took it out completely. So length only? Sorry? So you only look at length only? We don't look at length, we look at the comparison to that and a base response. Okay. So it's the same, what we found is in, so it does the same testing like we do in Wicdo with AI option switched on. And we decided to leave it like that because the results that we're getting is quite, it seems to be, well it's a lot more reliable than looking at status codes. Sure, okay thank you. Thanks. I was wondering how LR handled TTL values? Well as it stands, it handles it exactly as Scapiwood. Sorry the question is how LR handles TTL values. It handles it as Scapiwood, which means by default it'll leave anything you don't specifically mangle. So if the packets coming through with the TTL of X, unless you choose to make TTL Y, it'll handle it exactly as another hop on the way and pass it through just fine. So again, that's none of my cleverness. Scapi handles the stuff really well. Anything that you don't mangle in a packet, Scapi will try to intelligently fill in for you. And in this case, that's exactly what it'll do. It'll just pass it through. So any more questions? Thanks for your attendance on this late. Okay, thanks a lot guys. Day in Defconn, thanks.


This is hers All right, babe, we're gonna have to start heading out because they want to take picture I know they want to take pictures and stuff Me alley Megan Madeline, okay, I'm gonna take the camera though because we want to get camera footage Yeah, so I'm gonna come say goodbye Lipstick, I always put chast- I put chast- I thought that was lipstick Okay, all right. Bye. Love you. Bye All right, what time are we gonna be home? I'm not sure maybe in like a couple hours But So funny we will see you guys in the car. All right guys, we are finally in the car I'm so sorry for the bad lighting, but as you guys just saw we just told the boys that we're going out dinner Which we actually are we're going with my sister and our best friend Allie But today we're gonna be doing a video as you guys saw on our channel.  I hope I would assume he would they would notice that we changed outfits I mean no way they're the boys are kind of delusional sometimes So I'm hoping that they're not they kind of noticed because that'd be kind of a fail on our end But he saw me wearing this and I'm pretty sure he'd be able to notice if I wasn't wearing it I think it'll be really funny because I have not done this on Steven yet Oh, yeah, so he has no idea really about it. Yeah, I don't know if bill would put two and two together But I think it'll be different since it's like just and he would least expect it too Yeah But yeah my real squad if you guys are not subscribed to Madeline's He'd make sure go over and subscribe to them. They are married now, which is crazy. Isn't that weird? Yes, it's so crazy.   Look at that because that was really really crazy It's okay bill fell for it more than me. He did bill was almost about to cry Thanks for going over their channel and check that out But if you guys are new they should go hit that subscribe button and turn your post notifications So you guys gonna find every single time we post I am really excited to go in there and get the reaction But first we got to go to dinner and then we'll be back and I am starving. We are hungry as Heckers we're gonna eat some food, but I wanted to show you guys what we're gonna be wearing So I have this lingerie top. So actually tomorrow is halloween, which is gonna be so fun What's our first halloween together? I know it's crazy Um, but this video will be up to sunday.  Yes, I got fish. Yes, which makes it even more Sexy, but we're gonna go out dinner and we'll be back when we get here and we're all changed and ready to go I'm so excited. Are you excited? Yes. It's like team madeline and mariah All right guys, we just got done eating and we just changed into our outfits. I'll show madeline. This is hers Oh, we even showed them what we weren't wearing. Oh, no, we didn't but it looks way different. Yes Looking snazzy We're slightly the madeline's but I gotta go hard Okay, we gotta go in the car because it's freezing out here and I'm literally wearing a tank top It's 20 degrees not even 20, but it's like 30. All right guys So we're gonna go back to the apartment and we're gonna get their little booty butts. I just want to say I am stuffed to the max I should have not A lot of food we were hungry and you don't want to see us before that would be a hangary We're gonna go home and hopefully they're not in the room so we can set up the camera easily I'm hoping they're doing stuff. I'm sure they will be because I know steven said he had to do homework today And bill's probably in the room cleaning or something But we're gonna try to set up the camera and get them. Yeah, we'll figure it out We'll figure a storyline, but I guess we'll just we'll just wing it. We're good at winging it girls rule boys drool So you already know.  My shirt's not off. Hey steven's in the other room. Yeah, but Steven don't come out of your mind. It has your shirt off for some reason.  That's a top That's a top. It's a lingerie top. What do you mean? That's that's a bra It's sexy lingerie top. Put your shirt on Who cares? I care. I care. What do you mean? We just took pictures so I wanted to wear something cute That's why I'm wearing this. Wait, when did you you guys see the leap of that though? Huh, what do you mean? You come out? Wait, hold on. You didn't even when did you you put those on too? We wanted to take cute pictures with the girls so we just wait you went to dinner at this. We yes Yes, we we took pictures first and then went to dinner.  Yes, so you went to dinner in that. Yes. That's why we left early Yes, we want to take you. That's a bra That is not it's fine. It's not that big of a deal.  It's that's a bra. That's a bra. Oh, it's not a bra The lingerie top. Look at your clothes are right here. Why are you here? I don't care put on anything No, I don't stop. I don't have to put it on so you're telling me what is to dinner Yes, I could dress however I want to dress. See anything is that bad that I wear this? I don't want to look down. Can I see anything? Well, no, it's like it's literally a bra. I don't know why you're telling me how to bra, please No, you actually went out to dinner. Stop. It's not a big of a deal Like your shirt is freaking riding up on your legs, too I'm not trying to control you, but this is not okay. That's literally who wears that stuff out Are you? Hers is not even that bad, but why did you guys change because we wanted to take you picture Why do you have this on now? I don't see what's big of a deal. I could do this I don't know why you probably do change your clothes because you you knew I wasn't gonna be okay with this I'm not trying to be controlling. So we're dramatic. I'm not being over dramatic. That is terrible. Yes. See it Yes, you are Come on, please I don't want to wear it. I won't promise you to see my bra dress. It's lingerie. The windows are open, too I already wore it out. Why does that make a big deal? Okay, I think when that can see you now can and steve is in the damn room. Why are you okay with wearing that? lingerie is still you wear under your your normal clothes, right? I will say lingerie is for for your for me. So why are you wearing it?  Now I'm in the big partner Wear that for me not for other people. Now I know it's that it wasn't that bad It's not. That's cute. I will say I wouldn't want not to wear lingerie outside Also, we're wearing this for our home. What I don't understand. So right this for our home But why are you guys okay? This is what I don't understand though. Why are you why did you guys change? You left in a different outfit Why did you guys change? We did it. Well, we had different outfits. Y'all, that makes no sense. Why didn't you just leave in that? Why didn't you just leave? Why didn't you just leave in that already? We showed y'all these outfits last night for our halloween costume. We're okay for our halloween costume, no Not for wearing in public. I thought you were just wearing them. I don't want to see your eye I thought you were just wearing them from pictures I do. That one does. They look cute. Can you please go change? Please. All right, it's not even. I've never seen you wear pink Are those panties? What are those? Okay, I'm just confused. I don't want to see what's going on. Why aren't you guys wearing? I don't care about boots. Okay, that's not my thing to say. That's Steve's thing. I'm comfortable with not wearing this I wouldn't want her to wear lingerie. That's terrible. Laundry is terrible.  You do look good, but not for our public Mariah. That's like a swimsuit. Yeah, I don't see it. People don't wear this. It's a swimsuit though. I will say Mariah as soon as I look down. Okay, it's a swimsuit and not like 30 Steve's! That's what eyes do. That's what guys do. He literally just said. Every time I look at Mariah, I just like glanced down.  Okay, that's not Steve's. But that's what I'm talking about. That color dude in that rush found was the same like Why can't you respect me? Why couldn't you ask me? Or tell me I'm gonna wear that out. No, it's not. Yes, it is. Okay, but you're still showing him. Where's the tip? You're still showing him though!  You are so annoying. Well, I'll put my jacket back on so Steve doesn't have to look at me. Okay, versus talking about that. Yours is terrible. I didn't have anything cute. I don't even want you showing it in the video. I don't even want people seeing this in our video, babe. Guys, that's not even cool at all. You literally have my heart racing. I was literally about to get so mad, babe. So are you happy? This is so much better. First of all, I can't believe that you wore this walking out through the bathroom.  You still wore it out in public. It's not even a prank. You still wore it out in public, girl. Yeah, I had my jacket on like. So you didn't show one inch of red. No, I literally was like this. Oh my God. Literally, this video is turning into 50 shades of gray right now. This is crazy.  Stephen, we need to get them back. They're literally like, we're here. Hard at work. I just made a thumbnail. Stephen's doing homework and they're worried about pranking us right now. What are you talking about over here? I asked if we ever teamed up. I don't think we did. Dang.  What's your team name, then? Mad Mariah. Mad Ryan. Mad. Because you're mad. Okay, anyways. What's their team name? I'm done with this stuff. We're literally here chilling out, having a good day. And you guys are supposed to be at the wait. We did go eat. We did go eat. Okay, I was gonna say. Because you were out for two hours, almost. I don't know what you guys would have been doing for that long. But before we end today's video, we have to show all of our fan mail. Oh, guys, literally. Okay, so besides the fact that she just pranked us, don't worry. I'm gonna get her back. Team building is coming back in the lead. Even though most people say they're team Mariah, I low key feel like they just feel bad for her because a lot of them are secretly on team building. So anyways, we're gonna show some fan mail. Here's all the fan mail. This one girl wrote a really long one. But she tried to read it off camera. If you did not know, everyone, before you click out of this video, we have a PO box that you can send us letters. You can send us notes. You can send us things. Anything you send us, we will literally open up and read and literally just maybe even call you guys if you put a phone number on it. So make sure to set up our PO box numbers right here along with the address to mail it to. Look at how crazy good this one is. This is from the last address drop. In particular, but if you whoever drew this. Oh my gosh. Trinity. Trinity, what? That is amazing. This is the stuff I'm talking about guys. You literally make a look at this marble. This is with like an iron thing. We got a picture, some stickers.  Thank you so much Amy for the $20. You did not have to do that. Literally. It's super sweet of you and we did read your note. You said snap is so cute. You're so sweet. We love you. All of you guys, literally thank you for sending us so much fan mail. We read all of them and we really do try calling all of you guys. That's awesome. Thank you. That's awesome. But anyways, if you do send anything to our PO box, we do open it. You might even make it on our YouTube video as well. And we're putting it in a scrapbook. We do have a scrapbook in the other room. We have a bunch of stuff for you to put together. I'm going to take a time one day and just start doing it. We have a scrapbook with over 250 pages. So over like, I think there's two per each page. So literally we can put hundreds of hundreds of marble squad, paintings, drawings, anything in the scrapbook. And I think it'd be really cool to look back on in the future to remember all of your guys' notes and everything. But here, you can close out today's video. I don't want to. Let me just say, shout out to my best friend Madeline for helping with this prank and Stephen. Even though you weren't really. I didn't want to look at you. Stephen's trying to, yeah. That's really offensive. I'm really disappointed in you guys. You're going to do this. Stephen in the video guys straight up goes, oh well, it's hard not to look down. Like I've looked down like five times now. I know, I was shocked when he said that. What are you looking at? Like what am I supposed to do? Like every time I glance over I'm like. That's terrible. But hey, that's a show. If you guys are not subscribed, go subscribe to them. They've done a really crazy prank on us.  So it's really fun. Yes, but. And I got a new purse guys. You guys know how I don't really carry purse as much. Well, I finally got a new purse. All thanks to the challenge that we did. I got a Michael Kors purse. Yeah, so make sure to go watch their recent video that they're posting as well. As thank you for watching this one. I hope you enjoyed even though I got pranked in this one. But don't worry, I'll be coming back and it'll happen soon. We have to do our end of the video post notifications video. Shout out. And this shout out goes to Lauren Sargent. Thank you so much for being a part of our channel. We love you. Thank you Lauren so much. And wait, what's the end of the video question? Rate my look down below. Let's just say like how good was the look one out of ten. Yeah, how good was the look. Our look. Their look. So one out of ten. Comment down below and we'll be having a re-responding heart. Some of you guys' comments as well. And we'll see you guys in the next video. See you in the next video guys. Peace. Love you guys.


Just a picture of his condescension how low right how low the Lord of glory stooped to save sinners But in verse 2 we see early in the morning. He's wasting no time Wasting no time. He's about his father's business. He is diligent He's earnest this demonstrates a servant's heart, but early in the morning he rose He came again into the temple and all the people came to him and he sat down and he taught them Just the power of his teaching here draws a crowd Doesn't mention here that he performed any miracles He simply went into the temple and taught and the people again listening to the Lord Jesus Christ preach as No one else could and no one else ever has One speaking with authority not the words of a mere man, but direct revelation from Almighty God Jesus is preaching and the people just gather to him his teaching draws a crowd and the Lord again in his condescension Just graciously teaches them he sits in the temple and teaches them That morning though as he's teaching in the temple the scribes and the Pharisees brought a woman to him They brought a woman to him and interrupt his teaching and we see in verses 3 through 5 the accused the accused verse 3 says this Then the scribes and Pharisees Brought to him a woman caught in adultery and when they had set her in the midst they said to him teacher This woman was caught in adultery in the very act Now moses and the law commanded us that such should be stoned, but what do you say? So now the issue before him in the temple now Is an issue of the law They bring before him an issue of the law the woman stands accused in the midst of her accusers The emphasis here in verses 3 through 5 is that she was caught in the very act The word is katalambana for you greek guys. It means seized Lay to hold of she was literally seized In the very act That means in conjunction with their law their judicial process that they had the witnesses necessary to put her to death She was seized in the act the jews at this time very judicious And we read the scripture sometimes we miss this they were very judicious about their legal procedure very precise Contrary to what we see at the kangaroo court where christ was tried Ordinarily aside from that they were very judicious about their legal procedure And so to put someone to death the burden of proof was very high From extra biblical writings in the first century We know that the the two the witnesses the two or three witnesses must have been eyewitnesses to the very act They couldn't disagree at all on their testimony and they had to Explain things exactly the same and witness the act itself in order for them to put her to death There's an account in an apocryphal book susanna about a woman who was Falsely accused of adultery and she was acquitted of the adultery because the two witnesses in the case Couldn't agree on the kind of tree that the act was said to have taken place under it So that was the burden of proof that was necessary for those witnesses in order to put this woman to death, okay And there's no law there's no doubt what the law says about this act No doubt what the law says about this sin a leviticus chapter 20 verse 10 listen to this The man who commits adultery with another man's wife He who commits adultery with his neighbor wife neighbor's wife The adulterer and the adulterous shall surely be put to death That's in leviticus. That's the law of god listen to deuteronomy chapter 22 verse 22 If a man is found lying with a woman married to a husband Then both of them shall die The man that lay with the woman and the woman so you shall put away the evil from israel So now in reference to verse five that moses and the law commanded that such should be stoned Neither passage actually mentions that the woman should be stoned to death, right But in deuteronomy chapter 22 the very next verse chapter 23 Or verse 23 It actually says that an adulteress who's betrothed or engaged to a man if she's caught in adultery should be stoned to death But ordinarily when death is prescribed for sin in the bible it usually involves stoning That's confirmed for us by the prophets often that meant take them out and stone them to death So it's not a stretch what's being said here by the Pharisees Now considering all of that we have an issue a problem of law We know what the woman has done the Pharisees have brought her in she stands accused in the midst of her accusers And we know what the law of god clearly says is the punishment or the penalty for this sin What might be from our reading what might be an obvious question you might ask at this point Where's the man? Where's the man? Where's he they brought the woman forward? She's standing there accused. Where's the guy? Adultery takes two here and if they were caught in the act, okay If they were caught in the act these witnesses Witnessed the act and they caught they seized they laid hold of her And where is the man asking that question of our setting here begins to pull on a thread so to speak That is going to uncover great Wickedness on the part of these Pharisees on the part of these scribes It is a great travesty what they're doing here They witnessed the act and yet they did not bring the man in her in there with her according to the law of god The law of god clearly says this now at the very least think about it for a moment At the very least they let the guy go And he abandons her to die At the very least that's what happened At the very worst it was a setup And they wanted to entrap this woman and the man was in on it Either way either way It shows contempt for the woman It shows contempt for the law of god and here they are in the temple showing contempt for the lord jesus christ, right? It's a hypocritical double standard and listen. That's not all They actually do this They use the law of god they use this woman to entrap christ They do this in order to entrap him She wasn't the only one accused here jesus christ in their eyes stands accused verse six says They were there to test him that they might have something in which to accuse him Now showing great contempt for the woman They actually tended to use the law of god as a weapon against the law giver Now in verse five moses and the law Commanded us that such should be stoned But what do you say jesus these Pharisees and scribes ask the you there in the emphatic position in other words It's you hey you what are you going to say about it, right?  They were incensed That he would just forgive their sins Angry that the people would listen to him angry that the people would flock around him coming for Mercy coming for grace right he eats with tax collectors and sinners I want you to see an example of this There's a contrast here between the the attitude of the scribes and Pharisees And the attitude of the lord jesus christ that is being set up turn with me to luke chapter seven luke chapter seven Let me give you an added an example here of this contrast Luke chapter seven and drop down to verse 36 Here we have an example of the lord jesus christ being invited to a Pharisees house And I think this just depicts the the difference in attitude really really well Look at verse 36 one of the Pharisees asked him to eat with him Now he went to the Pharisees house and sat down to eat now from this story We know that this Pharisee is not sympathetic to jesus here He's not sympathizing with him and asking he's not coming to him like nicodemus came to him It most likely this Pharisee is probably trying to trap him to trap him in his words He's going to show contempt to the lord jesus christ All right So he went to the Pharisees house and he sat down to eat verse 37 and behold A woman in the city who was a sinner Meaning there that she's a prostitute She's a prostitute When she knew that jesus sat at the table in the Pharisee's house She brought an alabaster alabaster flask of fragrant oil And she stood at his feet behind him weeping and she began to wash his feet with her tears And wiped them with the hair of her head and she kissed his feet and anointed them with the fragrant oil Now notice this This is no hard-hearted prideful self-righteous Wicked Pharisee Now this woman is repentant and she's mourning. Why is she mourning? mourning over her sin She has come to realize her condition before god and she is there weeping before the lord Wanting to be cleansed wanting to be forgiven. She's seeking the lord of glory for mercy She wanted forgiveness. She wanted to be right with god this woman knew Using the Pharisee's words she knew what manner of woman she was and she wanted to be changed But in great contrast to christ who shows compassion to her Look at the attitude of the Pharisee simon verse 39 Now when the Pharisee who had invited him saw this he spoke to himself saying This man If he were a prophet He would know who and what manner of woman this is who is touching him For she is a sinner and look at the contempt Do you see that? Absolutely no mercy. She is an An object of derision an object of shame So don't let her even touch you don't touch her. She's unclean Just showing contempt for this woman And simon spoke to himself and jesus were a prophet He would know what manner of woman who is touching him So now jesus being more than simply a prophet Reads his mind Reads his thoughts and jesus answers him verse 40 and jesus answered and said to him simon I have something to say to you. So he said teacher say it There was a certain creditor who had two debtors One owed 500 denarii and the other 50 one denarius was about a day's wage A full day's wage. So we're talking about a lot of money here Verse 42 And when they had nothing with which to repay He freely forgave them both now. Tell me therefore Which of them will love him more To simon the Pharisee Answered and said I suppose the one whom he forgave more and he said to him you have rightly judged Verse 44 then he turned to the woman and he turned to the woman And he said to simon the Pharisee. Do you see this woman? I entered your house You gave me no water for my feet But she has washed my feet with her tears and wiped them with the hair of her head now simon by not washing his feet or not having his feet washed. This was a great insult He showed contempt for the lord jesus christ by not having his feet washed when he came into his house. This was a great insult Look at verse 45.  Who is this guy who even forgives sins?  Satan It sounds like satan And in just a few more verses jesus christ Their lord an eventual judge will accuse them and judge them with the righteous judgment chapter 8 verse 44 says Listen, you are of your father the devil and the desires of your father you want to do He was a murderer from the beginning and does not stand in the truth because there is no truth in him Wow, it's a powerful statement. There's a few verses from now They're going to stand accused. I want to give you an example of this Notion or idea the Pharisees are they're accusing Like the accuser they're breathing threats and malice and murderers Like the accuser they spew lies and blasphemies like the accuser. Do you think that satan is present in all this? Absolutely he is turn back with me to zekariah Zekariah, we're spending a little bit of time there today zekariah chapter 3 Just before your new testament zekariah chapter 3 And look at verse 1 with me This is at a time when the people are coming back into the land after exile Right, so they're coming back into the land and you have in this account joshua The high priest who stands before the angel of the lord as a representative of the people and look what happens Then he showed me joshua the high priest Standing before the angel of the lord and satan the accuser satan the adversary standing at his right hand to oppose him That joshua is the high priest of the restoration people are coming back to the land and he represents the people here Who does he have standing next to him? Satan the advocate adversary and what is satan doing satan is accusing him He stands next to joshua the high priest in front of the angel of the lord and proclaims Or spews Accusations against the people before god that's what satan does He stands next to you so to speak before god and accuses you the accuser of the brethren look at verse 2 And the lord that's speaking of the angel of the lord Said to satan the lord rebuke you know that they're the angel of the lord The lord is a claim of deity The angel of the lord is often in the old testament to christophany The angel of the lord is often a pre new testament appearance of christ as it is here The lord said to satan the lord rebuke you satan the lord who has chosen jerusalem Rebuke you if you're in christ, you have been chosen by god But if you're in christ, you've been chosen as a vessel for honor cleansed and forgiven Sanctified and purified and one day glorified for his praise and worship You are a chosen brand to so to speak chosen jerusalem Is this not a brand plucked from the fire in other words plucked out of judgment plucked out of exile Now joshua verse 3 was clothed with filthy garments and he was standing before the angel this picture is our sinfulness doesn't it Apart from christ, we all stand in our filthiness in our filth the word here Is the same word used in isaeth chapter 64 verse 6 When god says that all of our righteousness is as a filthy rag to him It means a means a cloth used to clean up a menstrual discharge Just a filthy thing considered unclean Verse 4 he's standing there and he's filthy garments before the angel of the lord look at verse 4 Then he answered and he spoke to those who stood before him saying Take away the filthy garments from him and to him he said see I have removed your iniquity from you and I will clothe you with rich Robes this is justification amen We have our sin removed Cleanse from our sin forgiven his wrath propitiated our sin is taken away forever And we have his righteousness Clothed in his righteousness given to us imputed to us It's a glorious blessing. This is justification Look at verse 5 and I said Let them put a clean turban on his head and so they put a clean turban on his head and they put the clothes on him And the angel of the lord stood by Then the angel of the lord admonished joshua was saying thus says the lord of hosts If you will walk in my ways and if you will keep my command Then you shall also judge my house likewise have charge of my courts I will give you places to walk among these who stand here here Oh joshua the high priest you and your companions who sit before you for they are a wondrous sign The bride of christ is a wondrous sign of god's forgiveness of god's grace of god's mercy They are a wondrous sign for behold i am bringing forth My servant the branch using my servant very common in the prophets to refer to christ The branch another name for christ verse 9 for behold the stone Another name for christ that i've laid before joshua upon the stone are seven eyes speaking of his omniscience his infinite wisdom Behold i will engrave its inscription says the lord of hosts and i will remove the iniquity of the land in one day And that day says the lord of hosts everyone will invite his neighbor under his vine and under his fig tree Man all satan can do is accuse All satan can do is flap his jaws in your ear right? And if salvation Were conditional upon our own works upon our own righteousness and he'd have something to accuse us of wouldn't he? But praise be to god that it's not Praise be to god that it's not your work not your righteousness all the things that you do it is all of christ god is the one who justifies So back in john chapter 8 now the scribes and Pharisees are playing the part of satan they are satanically charged satanically empowered and they're satanically here accusing Genuine christians listen genuine christians don't act like this. They don't act like these Pharisees. They don't act like the scribes You acted as they did With contempt in your heart And you stand accused and guilty just like them then you'd be like them Other so-called christians often accuse their brothers They so divisiveness division discord slander Their wickedness and they do that with contempt for for the lord's people contempt for his church It's an obvious contempt for the people of god We've ever seen someone share the gospel with contempt like that Out for nothing other than to win the fight right win the argument and expose them in their sin with no mercy No offer forgiveness no grace from god i've seen it The most notable example if you have watched the news in recent years is the the crew at westboro baptist That's just a notable example because they're in the news.  We can't stand for any of that You have to call it out where you see it divisiveness slander discord backbiting tailbearing wicked accusations When people do that they're acting like satan We must take a stand against wickedness, you know today. We consider our our times our culture today. We see abortion just running rampant it is mind boggling The devastation that abortion has caused in our country or homosexuality now with the decisions of the supreme court and everything that's going on We have to stand and preach christ In that context we have to stand and we have to preach the judgment of god that those who practice such things Will not inherit the kingdom of god But you have to do that with compassion with love with the the desire to see them saved With the desire the pleading of your heart to see god show them mercy and grace Adultery is a terrible sin here back in john chapter 7 john chapter 8 adultery is a terrible sin. It's a it's a Devastating sin and it's broken families. It's caused divorce. It's led to abortion adultery is a devastating sin It has led to terrible Evil but make no mistake about it the self-righteous hypocritical slander of the wicked Is an abominable evil before god. It's an abomination to god. It's going to lead these here to murder Their messiah in just six short months That's self-righteousness that pride that contempt that can flow out of the human heart, right? This is this this exposes our depravity doesn't it? it exposes what is Potential in the human heart the depravity of our hearts here. We see it oozing out of these wicked Pharisees so Essentially now so far we've uncovered the plot of these wicked Pharisees And what did that plot entail? they wanted to Bring forth this woman and thrust the lord jesus christ upon the horns of a dilemma And trap him in his words For the purpose of killing him for the purpose of murdering him So what exactly was the dilemma the dilemma we see in verse six Verse six says this they said these things they said. What do you say lord about the law and this woman? This they said testing him That they might have something of which to accuse him But jesus stooped down and wrote on the ground with his finger as though he did not hear Now the purpose for their questioning him wasn't because they were confused, right? They didn't come Perplexed and wanting his advice. We don't know what to do. Let's go to jesus for advice That wasn't why they came right? That's not what they were there for the purpose wasn't to entrap him and to ensnare him with the law They knew they knew that he was compassionate They knew that he showed mercy to sinners that he forgave sinners Multiple times they complained that he received them that he ate with them And so they were angry they were envious that the people listened to him that the people flocked around him They could have listened they could have just tried her in their own courts Right, they could have gone to the sanhedrin Could have conducted a trial put her to death and never have involved jesus at all. That's not what they do They had another agenda here being wise in their wickedness They seized upon the opportunity to present jesus with what they thought was a hopeless dilemma for him. Here's the dilemma If he actually takes side With the woman against the Pharisees and spared her Then he would violate the law of moses What does the law of moses clearly say death put her to death both her and the man But in doing that he would effectively abort his claim To be the messiah if he violates the law of god, he's not the messiah Okay, the scribes and Pharisees were just standing around waiting they were just Anticipate waiting for some kind of word to come out of his mouth that would violate the law of moses But the lord jesus christ cannot set aside the law of god or the justice of god Lord jesus christ being holy God is holy god is just the bible says that god will by no means acquit the wicked Proverbs 17 verse 15 says this he who justifies the wicked Is an abomination to god? So to justify her so to speak would violate the law of moses however If he upheld the law If he upheld the law and called for the woman to be stoned to death Then he would be siding with the Pharisees and condemning the woman In his reputation for compassion A friend of sinners would be destroyed in the eyes of the people Right how many sinners How many sinners would come pleading to christ If all they were to receive from him was justice and judgment Condemnation for their sin. How many women would weep at his feet?  You remember don't you When you first became wrecked with conviction over your sin And went weeping and mourning before the lord jesus christ for salvation for forgiveness If you're a christian you remember A point a period of time where you you came to understand your depraved condition You mourned over him whom they pierced He's one mourns over a son You saw your state before the lord and you came pleading for mercy pleading for forgiveness pleading for grace because you knew you needed it This very dilemma raises a question That all sinners should long to have answered doesn't it? How can sinful man Be right with a holy god? How is it that god can be both just and the justifier of sinners? How is it that justice? God's justice perfect justice can be harmonized with mercy doesn't doesn't grace undermine Justice doesn't grace undermine mercy Doesn't grace sacrifice god's holiness God's law demands justice is he'll chapter 18 verse 20 says the soul who sins shall Die, that's justice according to god's law All under the law are cursed by the law to death Galatians chapter 3 verse 10 for as many as are of works of the law are under the curse for it is written Cursed is everyone who does not continue in all things which are written in the book of the law to do them Romans chapter 4 verse 15 says that the law of god brings about his holy wrath How then does god Forgive sinners like me and you without setting aside or violating his holy law The lord the lord's response here is amazing verse 6 It says that jesus stooped down and he wrote on the ground with his finger as though he did not hear Now there are a lot of speculations here about What he wrote a lot of people try to explain some people Quote Jeremiah chapter 17 that says that those who go astray their names are written in the earth So maybe he was writing their names writing the names of those Pharisees in the earth with his finger Some say that he may have been writing their sins in the dust in his verdict against them No matter what is said it is all speculation right We can't know for sure but one thing that appears to make most sense to me is he was just waiting for a few moments He's delaying for a few moments. They come rushing in belligerent and hostile with their plans already set interrupting his teaching And jesus is just going to give them a moment to cool their jets a bit because what he's about to say to them He wants it to sink in he wants the the appropriate response The answers them before cooler minds may prevail. This may not go well They need to be rational and they need to be thoughtful about what he's about to say and the lord We know for sure has perfect timing. He is the master of the moment And so he's just going to wait for a moment And so in verse seven then we see in the lord's response His indictment of them. We get verse seven When they continued asking him it says there they persisted. It's in the imperfect. They kept asking kept asking So finally he raised himself up and he said to them He who is without sin among you let him throw a stone at her first And he again stooped down And wrote on the ground Then those who heard it being convicted by their conscience They went out one by one beginning with the oldest even to the last and jesus was left alone and the woman standing in the midst I can imagine Right the scene That's all it is.  It's simple right profound A great economy of words here infinitely wise They put him in this dilemma. I just I These are precious stories right Precious accounts of the wisdom of the lord jesus christ and in confronting wickedness like this just the brilliance of it In the economy of words infinitely wise jesus upheld the law Because he did not deny the woman's guilt And he brought the law of god to bear on the consciences of those wicked Pharisees And jesus didn't oppose the law of god. He didn't oppose the law of god He opposed those wicked and abusive scribes and Pharisees who perverted it The law in deuteronomy chapter 17 7 Also demanded that the witnesses of the crime Were to be the first to throw stones at the guilty You would raise the witnesses would raise their hand in the stone first and then the people however in order to do that They themselves had to be innocent of having anything to do with the crime now Just like those temple guards who came into the temple complex to see them and they couldn't These men confronted by christ Indicted by their own sin simply could not do What they had come in intending to do they were hostile They were unrepentant and maybe for a moment Maybe for a moment they saw their hypocrisy. They saw in the lord's response what they were about to do What they were plotting maybe they knew they were guilty Of adultery themselves whether a physical act or even in the heart right matthew chapter 5 If you look at someone with lust on your heart, you've committed adultery already with them in your heart Bottom line bottom line. They were wicked judges and they were unfit To judge her or to judge christ or to judge the people So to be clear here the lord in his response not setting up a standard By which jurors must be sinlessly perfect In order to Dole out justice or to judge righteously otherwise no one could sit on a jury We'd have no justice right because everyone sins The lord here again is rebuking hypocritical judgment. Listen to this from calvin Christ is not prohibiting sinners from doing their duty in correcting the sins of others But by this word he only Reproves hypocrites who mildly flatter themselves and their vices But are excessively Severe and even act the part of felons in censuring others You get it? He's condemning those here. He's condemning those who ignore their own sin And yet they want to judge and condemn others without mercy so now The question that they came in with no longer for jesus. It's been turned On their heads. The question is now for them They're one by one from the oldest right the oldest would be more experienced have a little more wisdom youngest most likely to be immature and hostile hot-headed, you know It was in their youth So one by one from the oldest to the youngest they left Under indictment for their hypocrisy Under indictment for their their lack of mercy under indictment for what they were doing Their conscience bearing witness against them So jesus upheld the law he indicted those wicked Pharisees But there was something else that his response accomplished here He showed great mercy to the woman in saving her life from being stoned to death For her sin look at verses 10 and 11 the mercy We see here the mercy of god verse 10 says when jesus had raised himself up and saw no one but the woman He said to her woman.  There's no sarcasm here. There's no gloat gloating Jesus just assures the woman that those who sought her life No longer there No longer accusing her where are your accusers? He said as no one condemned you The only word spoken by the woman in the entire account is no one lord She doesn't say anything until this point No one lord The reality of this is affirmed by the lord himself. He hands down his his own sentence here not merely as a good teacher Not merely as a man who lived a good life But he hands down a sentence for this woman as the only one perfect Who has ever walked this earth who has power on earth to forgive sins and set at liberty the captives And he says neither do I condemn you doesn't mean here that he approves of her adultery Doesn't mean here that he simply ignores her sin quite the opposite In fact if you think about our context because in just six months from now In a short amount of time Having lived a perfect Sinless life Having fulfilled all The just demands of god's law his righteous law In immeasurable love and in immeasurable grace He would be Her Substitute in death He would be her representative in death He would bear the penalty for her sin of adultery in fact all of her sin On himself on the cross and give his life for her He would take in himself the punishment and wrath that she deserved So that that day she could be saved And so that God may be both just and the justifier of the one who has faith in jesus christ. Amen The law demands death for sin And the grace and mercy of god jesus delivers for those Who would turn from their sin and put their faith in him Herman ritterboss states this he says jesus Silences with a word or a gesture The curse of a law torn from its base And by re-establishing justice on the foundation of his grace A justice on the foundation of his grace grace does not do away with the law Grace does not oppose the law of god those things are not they're not enemies grace and law They're close friends close companions Law and justice kiss Justice and mercy kiss so to speak Christ does not do away with justice here exactly the opposite turn with me quickly to romans chapter 8 romans chapter 8 romans chapter 8 Think about this in light of this glorious truth look at verse 31 Here the lord says paul says to the romans What shall we say to these things if god is for us? Who can be against us who can accuse you? Who is it that condemns you the satan in your ear who can be against us? verse 32 he who did not spare his own son But delivered him up for us all how shall he not with him also freely give us all things Lord jesus christ died To satisfy the demands of the law Died to propitiator to satisfy the wrath of god against sin Who can bring a charge against god's elect verse 33 it is god who justifies Who is he who condemns where are? Your accusers Who is it that condemns you it is christ who died and furthermore is also risen Who is even at the right hand of god who also makes intercession for us? Look at these glorious promises from god, right? If you will but turn from your sin put your faith in christ and trust yourself to him These promises apply to you who can separate us verse 35 from the love of christ shall tribulation or distress Or persecution or famine or nakedness or peril or sword As it is written for your sake we are killed all day long We are accounted as sheep for the slaughter yet in all these things We are more than conquerors through him who loved us For i am persuaded that neither death nor life nor angels nor principalities nor powers nor things present nor things to come Nor height nor depth nor any other created things shall be able to separate us from the love of god Which is in christ jesus our lord amen jesus saved this woman and what an astounding Example right what an astounding encouragement For sinners to cast themselves upon christ To to throw themselves at his feet for mercy right to claim to the cross Where he paid that penalty for those that would repent and believe the gospel What an encouragement to abandon your life of sin and be saved What an encouragement to go to christ for forgiveness for cleansing for grace He says to this woman in john chapter 7 john chapter 8 and to every sinner Who is accused and condemned by the law where are your accusers? Neither do i condemn you However The grace of god in christ does not then give us a license To continue in sin the lord doesn't approve of her sin He doesn't approve of of her adultery Of the lifestyle christ saves us to be holy He saves us to be holy I can say We right as a church together can say If you're here today And you're lost You're still living in your sin I can say that For the name of christ And for the sake of christ That we desire to see you saved to christ But if you are saved to christ You'll be saved to a christ that Will break the chains That bind you to your sin And will set you free To submit to the law of god for his glory to be holy That's the christ that we serve That's the salvation that is offered And we see that in the universe 11 with the call the call to discipleship the call to the christian life Jesus said to her verse 11 neither do i condemn you Go and sin No more you know today we see Such a pervasive Lawlessness among those that profess the name of christ Such a pervasive indifference Neglect of the christian life Such a pervasive antinomianism is what it's called an easy Believism no interest for the things of god not laboring and striving to be diligent in serving the lord Jesus says go and sin No more that's when the law that's when the war begins to rage right Go and sin no more and that war for holiness that is the christian life that battle To be pleasing in his sight that battle of forsake sin in the power of the spirit to Mortify the deeds of the flesh and the power of the spirit. That's where that war begins God's holy law his standard comes but listen to the believer that's standard That law is the christian's delight We delight don't we to do our duty We delight to be well pleasing to him romans chapter six verse two says How shall we who died to sin live any longer in it? The lord says go and sin no more look with me at romans chapter eight verse one Romance chapter eight verse one We see the glorious promises of god The indicatives of scripture so to speak if you're understanding your greek But we also see the imperatives Of christ in the word of god We're to live according to them roman chapter eight verse one There is therefore now No condemnation to those who are in christ jesus amen That is justification that's praise god The woman this woman has been justified freely by his grace. There is no one left there to condemn her No one to accuse her However, who are those who are justified those verse one who do not walk They don't live according to the flesh But according to the spirit in just a short amount of time this woman who the lord saved here Will receive the outpouring of the holy spirit by which she will live for the lord And the power of the spirit will live in a way that pleases god in a way that fulfills the law look at verse two For the law of the spirit of life in christ jesus what? Has made me free From the law of sin and death for what the law could not do in that it was weak through the flesh God did it by sending his own son in the likeness of sinful flesh On account of sin and he condemned sin in the flesh listen So that verse four The righteous requirement of the law might be fulfilled In us who do not walk according to the flesh But according to the spirit in what way there is the law fulfilled and what sense is the law fulfilled One sense is justification Law was fulfilled by christ and that righteousness of christ imputed to us We are covered clothed in the white robes of christ righteousness Who fulfilled the law for us, but in what other sense is the law there fulfilled in us We have the power By the spirit of god to obey it and we're commanded to obey it listen.  We have life at our justification But this that he's speaking of here in verse six is sanctification life It's spirit given life in the life of a believer to live for him to walk according to the spirit look at verse seven Because the carnal mind is enmity against god. These are unbelievers For it is not subject to the law of god Nor indeed can be so then those who are in the flesh cannot please god now He's setting up a contrast here between unbelievers and believers unbelievers don't and they can't Subject themselves here to the law of god What's the contrast what's the implication? The believers can The believers can an unbeliever can't please god Or what's the contrast the contrast is that believers can By the power of the spirit we can please god we can walk in a way that is pleasing to him This doesn't mean we're going to obey it perfectly We won't But that's part of the joy And reassurance of justification that there is no more any longer any condemnation We have an advocate with the father christ the righteous if we confess our sins He is faithful and just to forgive us of our sin and to cleanse us from all unrighteousness No longer any condemnation That doesn't mean though that we have no obligation to keep god's holy standard drop down to verse 12 there in romans chapter 8 Therefore brethren We are what? debtors Therefore brethren, we're under obligation to go and sin no more We are debtors not to the flesh to live according to the flesh for if you live according to the flesh you will die But if by the spirit you put to death the deeds of the body you will live Go and sin no more right in a power of the spirit of god for as many verse 14 as are led by the spirit of god These are sons of god. We can't do it in our own power. This is holy spirit power This is an only justification power This is sanctification power. Amen A woman in our text is soon going to receive the holy spirit whereby God Ensures that she will walk According to his statutes that she'll go and sin no more Right what a glorious picture of our salvation The completeness of it. It is the it's the complete diamond in all of its facets nothing lacking god Will not fail to see to it that his people are saved to the uttermost And this is how justice and mercy kiss It's how god can be both just and the justifier Of you if you'll put your faith in him if you'll trust him if you'll entrust yourself To him. It's a glorious great salvation. Let's not neglect it. Amen. Amen. Let's pray. I want you to take a moment In silent prayer and just ask that the lord would bless the truths of his word to your heart Ask the lord to help you in applying these truths to your heart and to live for him. Let's pray


SCP-1018 Object Class Safe Special Containment Procedures SCP-1018 is currently contained in Storage Unit ██ located at Site ██. All components of SCP-1018 are to be kept at 1 meter by 1 meter by 3 meter containers and kept under guard by two members of security at all times. No liquids are to be introduced to SCP-1018 components without the express permission for one member of level 3 personnel. Description SCP-1018 is the overarching designation given to a group of three statues, hereafter referred to as SCP-1018-1, SCP-1018-2, and SCP-1018-3. All components of SCP-1018 depict an emaciated or elderly human male and are composed primarily of concrete and gravel. A red luminescence is visible on several points on the surface of SCP-1018 components, mostly present on the head and throat. SCP-1018-1's anomalous effect is activated by applying pressure to the back of its neck while SCP-1018-2 and SCP-1018-3's are activated by contact with liquid. When SCP-1018-1 is activated, the area within 10 meters of it will experience heavy rainfall, and situations where SCP-1018 is activated indoors. This rain will rapidly fall from the ceiling of the structure. Further examination of rainfall produced by SCP-1018-1 shows no anomalous properties. This rainfall will last 30 minutes before abruptly ceasing. The rainfall brought on by SCP-1018-1 will typically activate SCP-1018-2 and SCP-1018-3 when they are in the same structure. When SCP-1018-2 is activated, six manifestations of what seem to be emaciated children will appear in the area surrounding SCP-1018-2. These children appear identical to several who disappeared two months before SCP-1018's recovery. All manifestations will approach individuals present and frantically request water. These manifestations are incomparable and so are unable to consume water even when it is provided to them. Twenty-five minutes after the initial activation, all manifestations will clutch their throats and fall to the ground, or they remain for an additional two minutes before disappearing. SCP-1018-3 appears to have been heavily modified at some point in the past. Several parts of its structure appear to have been removed and replaced, most notably the left leg and the head. A small hole has been drilled into the left ear of the statue, suggesting something has been removed or inserted. The purpose of these modifications is currently unknown. When SCP-1018-3 is activated, it will begin speaking in a highly distorted male voice. SCP-1018-3 will generally repeat the phrase, Are we cool yet? Although rare variations on this have been noted, such as, Aren't we cool yet? Are we God yet? And Mars we cook yet? When these variations are spoken, the distortion of SCP-1018-3's voice will increase heavily. The speech will continue for 30 minutes before season. The components of SCP-1018 were first recovered when they were activated at a charity gala and tended to raise money to provide clean water to those in troubled areas. Mobile Task Force Epsilon-23, art critics, were dispatched to recover SCP-1018 and did so without incident. Security camera footage of the incident shows two local activists placing the SCP-1018 components backstage and activating SCP-1018-1 before fleeing. Efforts to locate them has yet been unsuccessful.