What's going on guys got Kyle here with laden sports cards, and we are ripping two boxes of 2022 2023 recon basketball This one is for Jeromey D. Good luck here. Let's see what we got some recon And guys gonna be switching over to latent channel to probably after this box here We'll switch over to late and channel to and keep the personals going We'll have four setting up here for group breaks tonight. He starts at 5 p.m. Eastern If you guys are interested in group breaks, he has hockey baseball basketball and football break in tonight a little bit of everything if you guys are interested Can always check out our website late and sports cards.com see what we got breaking. There's a LeBron insert Bogdanovitch gold foil Darius Garland Kauai they rock the rim a D a 299 Mitchell Robinson for the Knicks Cole Anthony base Chris Middleton Bogdanovitch and KCP is a O'Shea Baji rookie It's a 199 Tyrese maxi and auto 10 of 10 we've got Ben Matherin boom We go Jeromey 10 of 10 on the gold auto that is a sick-looking auto as well. I like that boys fired up Nice one there Jeromey on the base true potential auto 10 out of 10. We'll mag this one for you Very nice one there. We have been pulling some after in a day. Yeah, say Rollins rookie Dante leaving Chinzo rookie shade-on-chart Jamal Murray base Reeves, Aldama FVV Yeah, right, let's just done something. There's a rookie review that's a throwback for Jason Tatum Celtics there We've got to 299 norm pow and auto. This is going to be Gary Harris to 99 for the magic The auto to 99 green glorified signatures as it says God rookie tie-tie Smite Smite yeah, it's like Max has got it under control As always There's a nice rookie here future legends Jeremy Soham Cam Johnson Christian Wood din we There's a recon a vector that is Lamello. Nice looking one there on the Black and white. There's a step to 299 rookie Chet Holmgren Brad Beal and rookie future legends Johnny Davis. We got a rookie Jeremy Sohan silver Tyler hero We've got a top charts LeBron Walker Kessler nice rookie there for the jazz KD Lonzo, we've got a vector finals MVP Nicola Jokic Got to 99 RJ Barrett Christian Braun rookie Dude won five straight championships three high school or two high school championships Uh, I don't know three high school championships college championship and the NBA championship Five years in a row Zero zero losing for that guy Zero losing for that guy. He is not interested not interested in losing There's a shade on sharp future legends rookie got Mikhail Bridges gold foil The Andre Aten Again guys, this will be the last personal here on our main channel I will switch over to LSC to here give me about 10 minutes once the stream ends I'll grab whatever is left in the queue and we'll keep ripping over there LSC channel to 199 I did drop the stream or the link to the YouTube In the chat there guys if you guys want to subscribe you can see when we go back live Like I said, I'll probably about 10 minutes after we do go off here I need a little time to grab a couple more boxes There's a Ben Matherin rookie But we'll keep going over on channel two for personals guys if you guys do want to order some personals can keep it going for you We have a decent queue still, but we can keep it going. There's a chat home green vector rookie That's a 199 Jared Vanderbilt rookie Ken Lofton Kyrie got a rookie Daylan Terry for the Bulls a rookie Daylan Terry for the Bulls Gary Trent We've got fleet feet. This is a short print insert there of Damian Lillard fleet feet The 299 we have Jeremy Grants and auto to 149 and we have Landry Shamet Or these Suns on the auto to 149 Price McAllen's Laurie Markin and James Harden all systems go Dylan just Dylan just got visibly scared from Sam doing that He trembled he trembled you don't see people tremble very often There's a future legend Scotty Barnes go nulls to 299 we got rookie Jibari Walker for the Blazers Chet home green rookie base Gordon Hayward two packs left Good luck here at Jerome We've got a vector of Luca I mean you'll quickly go foil Jalen Noel Last pack It great on that gold Ben Matherin got a rock the rim Don Mitchell 299 scary Terry And looks like another auto it is a rookie auto of Benedict and Matherin number to 49 All right, all right. We'll just keep the Matherin going then there we go Jeromey number to 49 Another rookie Ben Matherin auto first one to 10 this one to 49. We'll take that sir Got Ryan Rollins base Lanza and PJ Washington Alrighty that will do it for your two boxes of recon basketball nice sit on both of those Both of those Ben Matherin autos. We'll get those right out to you, sir


All right. Hello, everyone. Welcome to second and last week of class. Everyone excited? Semester's almost done. Yay. There's a lot. It doesn't get picked up on the microphone, but they're just going wild here. Cool, okay. I'll be here Monday, Wednesday. Unfortunately, I'm out of town next week, so Connor's gonna teach class and clean up then on binary security. I think we'll be done with content probably by next Monday, but we'll see what happens. We'll extend stuff into Wednesday. As mentioned, because I guess some people don't watch things, although I guess if you didn't watch it on Wednesday, why would I expect you to watch it today on Monday, but release two modules as we all agreed on collaboratively on Wednesday. The final two modules, web security and binary exploitation. One important note, since that got brought up, if you, I might not log in. Let's go course. Okay, you're gonna see my grade. I'm failing this course, by the way, in case you were wondering. Undergrades. So you have the weight here. This weight, because it's all the same, means nothing. This is just a relative weight between the modules. So the fact that they're all eight doesn't mean anything. They could be all one, which I'll probably just change them to, although that will still be confusing to people. It could be all nines. It could be all 1000s. It really doesn't matter to literally just, that way, if when running this course, if I had wanted to say, oh, talking web is worth twice as much as the other modules, that'd be a two, and the other ones would be worth one. Something like that, right? But for our purposes here, it literally doesn't matter at all. So as stated, your grade is here. I will, this week before Wednesday, post your current status of extra credit in terms of means and thanks. I'll also pull down the latest code breaker challenges that were on the syllabus two and put them on here. That way, like as stated on Wednesday, these have the latest possible deadline of January 10th. Like grades are due the next day. So that's why everything gets cut off at midnight of the 10th. This means absolutely whatever I put in the Discord. So before I start talking about stuff that's on there, let me make sure I'm not saying the same content. But it means very simply that absolutely no extension. So like it's just fundamentally impossible. Any extensions there go into over and we need to deal with like medical incompletes and other kinds of things. So if you've been thinking about that, don't think about that. Like if you end up in that situation, I'm sorry, but that's just the way it is. During finals week, no in-person help. So finals week is in three weeks, right? So second week of class, last week of class and then finals week. So finals week, no office hours, no recitations. And I kind of can't force anyone to be here because they also have finals to take and everything. So you're kind of on your own on the Discord and you're feel free to help each other, but don't overboard as normal. I don't know, just this way with this, whatever grade you're happy with here that shows up here, that's going to be your grade unless, and it can only go higher with extra credit. So as soon as you feel like you're done, then you can just be done. It's kind of like having a button.  That way you can lock in and not feel like you have to do this until the 10th. Any questions on this? End of semester class stuff. Sorry, I just realized I was not on the 15 people on Twitch. Okay, no hands? All right, now let's get to learning. Cool, so we left off on command injection. So command injection, as we hopefully recall, is when a, most of the things we're talking about here are web applications, but when an application takes our input, concatenates it with other strings and then passes it to something like system, which then gets reparsed by BNSH just as if we had typed this in on the command line. So we saw different types of ways to exploit this. I'm not going to go over these because we went over them on Wednesday and you can watch that lecture. I think the key thing is I've seen some people maybe struggle in the Discord. The key issue here is to think you have full and total power here, right? So this, whatever you're typing in here, once you can execute a command, it is if you were, in our case, the root user and you're tricking the root user to type in whatever the heck you want. So even if, like in this case we saw, maybe running a certain command, maybe didn't show the whole flag where we weren't able to actually extract the flag that way, but we're still root. We can do whatever we want. What are some things maybe that we would want to do at a high level without talking about specific commands to accomplish our goal? What is our goal? Let's go one level up. What is our goal? On the challenges. What's always your goal? You've been doing this for eight, seven modules. This has been a key chunk of your life. Yeah. Get the flag. Yeah. So if you can't just output it directly by doing like cat flag because the program doesn't necessarily give you that output, what other things could you do? You could run LS, but you need to get the output. So the question is how do you get the output? So if you can't, if you can run commands without getting the output, how could you get the flag? You had a whole module on this about accessing stuff with control. Yeah. Move it to a different file. Like there's nothing that says that it has to be in that file, so you can move it or copy it or alter the permissions. You can alter the permissions of the destination file. You could fundamentally do anything you wanted to do as that root user. So you could do all kinds of fun stuff. But yeah, so think creatively. Like as if you were as root there, you can't get the output of the command but you want to get that file eventually. Okay. Moving to HTML, yes, question. You are running as root. Set UIDs only so that it's copied with run as root. Right, so the fact is you are fundamentally running as root when you can trick the challenge binary, the challenge web server is running as root so it can do anything. Wow, super weird that nobody is sitting over there. Did you all do that on purpose? Nobody wanted to sit on that third of the room. Just all gravitated over here weirdly. Okay. But they're coming to the door. But some people come in that way. I am over it. I mean, obviously it makes sense, but it's very weird because most people have sat over there. Anyways, okay, this is what happens when it's close to Thanksgiving. Okay, so other. Huh? No, this has been a whole room. You guys have been normally equally-ish spread out in the terms of this room. Nobody has to sit over there. Don't move. Cause all your stuff's there. That's a false move. But look, you have a better view of this right now. Anyways. All right, I noticed these things. Okay, so other things. So we talked about HTML, right? HTML is a web application's way of specifying to the user what the structure of the document should look like, what links they can click on, what forms they can fill out, what things they can do to the web application. And so very often a web application will create its HTML response by again concatenating strings together. So here is an example application that has in between P tags, has a string hello comma and then some name in red being the user's input. So why might this functionality exist? You're writing an application. Have you ever seen a website do this? I can start calling on people. Does that help? Start at the left side of the room and go, what's up? Yeah, so the idea being now it's a Dynamics website that nicely greets the user, right? So depending on who the user is, how they're logged in, right? We can see, oh, it's this user. Great, that can be a friendly application. I can say hello to that specific person. Maybe like, so maybe the results that I give are also unique to that user. So the feed that I'm showing, whatever, if it's like a Facebook newsfeed thing or whatever, but the point is like, I can customize my HTML response to each of you depending on who you are. Now, the problem is if that input comes directly from the user, now fundamentally I can control and have any code that I want be executed. And one of the key things, so again, if we go back to, let me look at this here. Yeah, so we look back at HTML, right? So now if I can inject content and control the structure of this HTML page, I can get it to be whatever I want.  Maybe I can add more links to the page or something. I don't know, give them to trick them to click on something. But a key thing that we can make them do is, do I not have? One of the key things that we can do is actually get them to execute some code that will run inside of their browser, which actually sounds insane.  And that is JavaScript. So let's look at, I guess we can look at here. There is some JavaScript in here, yes? Where I start poking around. Remember how this works. Sources, I think. Scripts, yeah, there we go. Cool, so there's a ton of JavaScript. This is all JavaScript that's executed. Every time you visit any site on Pone College, similar JavaScript exists everywhere else. But the point is, this is code that is running inside of your browser and has access to everything inside of this webpage. So, oops, hello. Okay, let me show an example. Going to increase the font size here. Let's go back to our example. Okay, so this isn't really a dynamic website. This is literally just gonna be me editing a text file and then us loading that text file in our browser. Let's see if I can, cool. Everyone see, on the right, I have this. So if we pass in the name of CSE365, refresh. Right, so just like a dynamic website, so my browser is parsing this. And again, because it's a parser, it has to figure out where are those starting and ending tags so we can do cool things like we can change our name and make it into a link that the user can click. Can I change what happens before here? No, I can't because this is a constant string that is concatenated. So I can't control what happens before and I can't control what happens afterwards, right? So every time we're thinking about injection, we need to be thinking about what parts do I control and what parts don't I control. So here I'm controlling just this name in here. I could really mess things up. I could do maybe ending HTML and then the page looks literally like this. Oh, where's the inspect source, so big source. Yeah, so now it's kind of like, depends on how the parser is going to interpret this, will it like, do this is the end of the page, will it keep showing the stuff that's after? Let's check if I write something after here. I actually do see that, that's really weird. I'm not sure if this is common for all browser engines. I can start another, yeah, HTML tag and then what if I end this one. Anyways, the point is I can completely control everything that happens here. But one of the big things I would wanna do is start executing JavaScript.  Since I know we got a little bit of time, we can do this. So this was the modern HTML that we've been looking at. Very static, has images, tables, you can set font size, but fundamentally the content was static. And this actually gave rise to early websites like Yahoo. Did you guys know Yahoo was literally just like a yellow pages or a directory for the internet? So there were different categories. If you're just an art or education or entertainment, you can click in there and there would be links to other places on the web. So it was just a way literally to find things in this incredibly, this is actually even before, there's a time before where it didn't even have search. There was no ability to search here. This was the first Amazon website. And you can see very simple, just literally a website to sell books. Alta Vista was one of the first search engines that actually allowed you to like type in stuff in the search bar and it would just very crappily look for any webpage that had that search term in it. And this was the, actually the shocking thing about all this is this was the first Google beta from 1998. And you can see that it's almost exactly the same. It's actually even simpler of a, more or less of a design the Google homepage than it was here. But the important problem is we wanna be able to do fancy things and animations and being able to dynamically respond on the client because every time you clicked a link on any of these pages or hit the search bar, your browser would then have to make a new HTTP request to the server. The server would process it, send the response back in HTML in your browser that has parsed that HTML. But for some times you don't need all of that. And that became the birth of JavaScript. So I'm gonna tell you a little bit about the history here. It was originally designed as a language to run inside your browser to interact and manipulate with HTML. How many of you know Java? Yeah, many of you. Great, JavaScript has nothing in common with Java except for the first four letters. And this was actually a literal, so it was originally created in 1995 for Netscape, one of the browsers at the time called LiveScript.  It was renamed in December of 1995, literally JavaScript as an open cross-platform object scripting language for the creation and customization of applications on enterprise networks and the internet. This is in 1995. Whereas JavaScript in Wikipedia is a prototype-based scripting languages with dynamic typing and first-class functions. So this actually has nothing to do with Java. It's literally a different, like the syntax is very similar because they both derive syntax from C, but fundamentally prototype-based is very much in opposition to class and object orientation. So calling it an object scripting language is like super weird. Literally, it was basically like a marketing ploy because believe it or not, I know this may be very hard to believe at the time, but in like 1995, Java was considered the hot new language. Like, I don't know, what's a hot new language that you all think is cool for us? Like, yeah, Rust. So this was like the Rust. Actually, it's a very good app description because with Java, they told everyone like, hey, this is great. You don't have to worry about buffer overflows, just like Rust. And you write once and deploy everywhere because you write it, it compiles to the JVM and different JVM implementations run on different machines. What it turned out was write once, debug everywhere was actually the real thing that happened. And so anyways, hope in 20 years, maybe you'll remember this class and as soon as people, you tell people that you used to think Rust was cool and they go, that's such an old language. Why would you ever think that? But anyways, in 1996, Microsoft added support for JavaScript to Internet Explorer and it turned into a standardization. So the JavaScript language was standardized in 1996, but fundamentally it was just created for one browser to add some dynamic capabilities. And now it is essentially the language of the web. So JavaScript is fundamentally the way that you think about and is supported by all browsers and it evolved organically along the way, which is why it's very, very weird. But let me show you some examples. So you use the script element and the script tags is the way of creating JavaScript. So you have script tags. This was a very, very old style of doing this where you had these tags here is a HTML comment. So it tells the browser, hey, consider anything in here to be a comment. And this was for browsers that didn't support JavaScript. That way they wouldn't show what was in the script tags. So if you're a browser and you did support it, you would know not to take off those HTML comments and you would start executing the code there. So you can do things like, there's a whole system and stuff, but it's very similar to what you're doing. It's not anything that's too crazy. So you can prompt things like, hey, please enter your name. You can set that to a variable called name. You can check if name is null, then write welcome to my site. Otherwise write welcome to my site. And then the plus is concatenation here. And so you can do this. You can also specify exactly the language here, although this is really not needed now. So you could run this page and it would say, hey, please enter your name below. You could enter something like add them in and then it would say, hey, welcome to my site, Adam. Okay. You can also include external JavaScript files. This is actually not strictly needed for what we're doing, but something that's very useful is you can have a source attribute that have an absolute or relative URL. And so the browser, when it parses this, will make another HTTP request, fetch that content and execute it as if it was JavaScript code. I'm gonna skip all this. We don't need to do this. Okay. JavaScript, though, is... Okay. So everything in JavaScript is an object. And guess what? You learned JSON way back when when you were making web requests by hand in Netcat, those fun, fun days. So JSON, everything in curly braces in JSON derives from the syntax for JavaScript for objects. Objects are pretty sweet. They're just like hash tables or arrays. You can add properties and values at runtime. So you can have something like var object equals. And so the curly braces is... So this is an object that has one property named test with the value foo as a string and another property num with the value of 50. We can then, so objects, you can think of things that can be recursive. So you can have object and this is accessing a property. So this is with array syntax saying the object, the property with name foo set it to be equal to object and we can log itself so we can do object test is what? Here in this example, foo. And then object foo is the object itself because we set it here, object foo. You can set num to be 1000, we can log it and then we can look at it here in the console. One of the cool things is you can just... If you're ever curious about how something works in JavaScript, you can open up your good old web browser here in the console, you can just put code here and you can just type it in. Can I make this? Oh yeah, there we go. So I can type all this in here so I can look and inspect this object. So this is my object called object that has three properties foo, num and test. Foo is the object itself. So if you keep going down foo, it will go down here forever. One thing, so I use this syntax, object bracket string foo. This is one way you can access properties. The other way is the dot syntax. So you can just say object dot foo and it's exactly the same thing. It's literally just the same syntax. The dot foo is just the same syntactic sugar for the exact same thing. Okay. Okay, I think that's all we need to do under here. There's much more complicated stuff. So what we can do is now we are here. So once we have this injection, we can write any JavaScript code we want inside of ScriptTags. One of the classic things, if you look up the alert function, so instructs the browser to display a dialogue with an optional message. This is one of the ways that as security analysts, we show that we can execute JavaScript code on your web page by making it pop up a window here. So this is JavaScript code. So this is when I refresh that, the very first thing it does. It's parsing this and the developer, the original developer of this website intended, did they intend for there to be JavaScript code here? No, this is only because we, the attacker tricked the web application to include this JavaScript code. And so we can do whatever we want here. We can, I think that's how you do it, let's see. Nope, that's writing it there. I always have to look at stuff up. JavaScript, overwrite, HTML, dot replace, document dot replace, document open, document write, document close, that's where it's in. In our HTML, there we go, that's how it works. So completely changing the content of the page. We can do, let's see, you redirect to the document dot, may have blocked it because of the domains, oh, location address, that's right. So redirecting them to another place, on Wednesday I can do whatever I want. I can, if the web application uses cookies, which this one probably will not, it won't even let me go back, that's really, yeah, undefined because I don't have any cookies. Let's insert some cookies. Storage, local storage, add new, password, I don't know, JavaScript. Depends on how it's set the cookies, but let me just double check. Cookie, not cookies, see, this is why reading the documentation is so important. This is why I tell you what to do, and that did nothing. Go to the console here, document dot cookies, cookie, cookies. Cool, so if cookies were set, I could get them. I guess it should be like this. Yeah, it could be about the specific way that I'd set them. If you could get them or not, there are like lots of possible security measures here, but fundamentally I can do anything. And this means that if I was now, and especially if you're logged into this website, I can now act as you as the user. So I could steal your cookies to try to log in as you. I could have you the user transfer me, remember when we looked at the bank, transferring money, right, between things, introduction. Oh yeah, here we go. Here's our good friend, the bank, right? So if I were able to trick blue into executing code from green from the bank that says, hey, transfer money $1,000 from red, the bank has no idea that this is coming from, not coming from the actual user. So you can really do anything. Questions here? Just for the record, when you go out into the world, this is called cross-site scripting. The idea being another, and a criminal or a hacker got you, tricked your browser into executing JavaScript that they wanted to execute. So that's the cross-site. So, and the abbreviation for this is XSS. So if you see that, that's what that means. Now, again, another case where people want to concatenate strings is with when creating SQL queries. So here we have a SQL query, select star from users where username equals single quote, con or single quote, and password equals single quote, password one, two, three single quotes. This is the example where we're looking at SQL. So what's the point of this query? What would be a use case of this query? Yeah, why would we want to look for the specific user's information? Say it again. Slider? Yeah, so we're trying to check, so this would be an application where they're trying to check, did the user provide the correct username and password, right? So like, yeah, they're gonna log in. We're gonna check first, hey, does there exist any user in this database that has the username, con or in the password of password one, two, three? If it does presumably, then we would log the user in. That's exactly what this query would do. Now, fundamentally, if we control what's in the string conner and here in this password, we can fundamentally put in whatever we want here. So do you guys wanna try it on a real database? Where is the real database?  Where do I have a web server running? Is the mic easily accessible? Ah, such a pain, I don't like SQLite. Okay, I think I have an idea. Let's see, I usually, I can quickly install something on here. Can't locate the package, MySQL. I think it's MySQL server. Okay, we'll just on MySQL server on a random thing. We'll create the table. This will be super fun. And then we will hack it. It's running, very good progress. I'm into MySQL server. All right, I'm running. So now what I'm typing commands in here is I say if we're running queries, so I could say selects, it's gonna say error, no database, flexed. So use, create a database first. Use 365, MySQL, I did, okay. Oh, I guess I can do that. Create database, hack me, use hack me. Create, what is it? Table, users, MySQL, data type. Varchars are great. Just means variable characters. Okay, it should just work without the strings. Yay, okay, insert into users, values, admin, super secret. Wanna make sure, insert into users, values, value one, value two. How do I do multiple values? I think it's just separated by commas like this. Okay, and let's go back to our thing. Admin, password, a Connor. Password one, two, three, select. Hey, got data in there? Cool, okay. Now let's go back to our query. So we're gonna simulate having a website. We are writing this statement. Okay, select, so it's gonna be select star from users where username is equal to name and password equals password. Okay, so let's run this. Why did that return nothing? And we don't have anything in the database that matches that. Okay, we did have the example of, there's space in front of here. Why is this not saving this query? It's gonna drive me insane. Connor, so now if we know Connor's password, we can log in and that returns one user. So our web application would say great, user accepted, log in, awesome. So you can write in anything where into this string. Where do you, what do you control? The username and password specifically after the single quotes. So why is the, so the application is specifically adding single quotes around your input because it knows that this is how you specify a string in MySQL. So specifically here and here we control. Inside of those strings, awesome. So select star from users, we're username is equal to Connor. So we can put in, if there's no restrictions from the web application, we can put in whatever we want here. So what might we want to put in? Another single quote, what's the point of that single quote? So it matches the first single quote and now, now what do you wanna type in? Yeah, so or maybe, so we say username is equal to blank. One equals one. What do you wanna put in for password? Let's just do password. Okay, what's gonna happen when I hit enter? Yeah, it's not gonna let me. And I wish it didn't do this. Oh, I have an idea. Let's do, this was a great example. Let's do this, quit. So you go to MySQL, you just write the command here. It's first the database name, hack me, hash c. Did you echo what it said or did? Yeah, that's right, okay, thank you. Cool, cause I wanted to simulate more of what happened and as you saw, when we tried to enter that command, the MySQL prompt wouldn't even let you type that prompt in because it has a syntax error. What's the problem? We put in single quote space or space one equals one and then the application put a single quote, password equals two and then this single quote, but then there's a password and then like a dangling single quote. So we're very close here, but the problem is we're not matching those things. And the problem is there's a bunch of gibberish that we have to deal with after this. So what was the trick we used in command injection in order to not have to deal with anything that came after us? What was that? Comment it out. Let's look up. I think we talked about it in the last one but then let's look up MySQL comment syntax from a dash character to the end of the line or from a, or sorry, a hash character to the end of the line or from a double dash to the end of the line. I'm gonna show you the double dash because the database you're gonna be using is SQL light and I wanna show you one that works on both. I believe it's double dash. Yeah, and so you can see this. Anybody remember this type of graph? Back when we looked at JSON syntax? So here in SQL light dash dash to anything except new line to new line will be a comment and that's the same in SQL light and in MySQL. So we do this. Really hope that was gonna work. Why did that not work? Oh, I think we need a space. Yes, there we go. Okay, why do we need the space? Because the characters were specifically a double dash without any space at the end. I guess MySQL is trying to interpret that as its own thing and doesn't really see the, let's actually look, this is crazy. Ah, insane. I wonder if this is what messed me up on a CTF once. It's interesting. Anyways. Okay, so what did this do? Why did this return us all the results in the database? Yeah, so this is the query that we ran. Select star from users where username is equal to blank or one equals one. How many times is one equals one true? It's always true. And true or false is true. So this returns true for every single row in the database that returned all of the rows. What if we just wanted to return the admin rather than doing or one equals one, what would we do? If I do this, what is it gonna do? Still gonna return all, why? Yeah, for all of them. So how do I fix it? Say it again? Cool. So now let's say we do this on the login form. We say, hey, we want to log in as the admin. Here's my password and password. But actually I say, we don't want to log in as admin. We want to log in as admin tick space dash dash space.  That's good. Let me log you in now as this user. And then boom, you've now logged in as the admin user. And we can even go, let's see. Make sure I'm balancing with time. Cool, oh yeah, perfect. Okay, we can even go crazier than here. So let's do, let's create table. I feel like I have that syntax. Nope, create table flag. Let's say there's flag. That's a varchar 255. Okay. Insert into flag values. Honk it, get this flag. Okay. So let's say we get this output. Well, let's say it's not the username and password, but whatever, we get this output, but we can control. So again, we can control anything in password. We kind of figured we don't need to do that because we can deal with anything that's in here. So we can just by changing this username. Now, can I control anything that happens before the username? Select start from users where? No, we cannot. But, so we can use this as we saw to get anybody's username. We can also, so let me, did we talk about that? Let's see if we'll get tables. So let's look up. So it turns out two things we need to look at. One, let's go back to just our normal, let's see. Ew, gross. That's too many tables. Table schema test, I haven't seen that. Nice SQL. This has a ton of information. Let's see, DB5. Okay, okay, here's, oh, am I not, wait, you use heckling? Okay, I feel like this should be a lot easier. Okay, there we go. Why does that reveal so much? I thought there was like, okay, well here is our hack me, and here's the users and flags. It's table orders for you. Yeah, there we go. Thank you. What do we put for table? Table orders for schema equals database table. Where's that? Let's check it with table. Oh, base table. But in dot, instead of dot column, you need dot table. Let's just do a select all on that. This is something you can look up by the way. It's not, well, where's the, why is this, this should be very simple. What are you trying to sort? I want you to see the tables, but just the user tables.  There's three out of 30 tables.  Yeah, I would like this, but with only the user table. This is definitely, oh, they're right at the top, but I will find this. Okay, that was going to be a cool demo. Oh, that's what I want. Inject all the things. Payload, there we go. Payload all the things, that's what I want. Okay, this has everything I could ever need. Cheat sheet, MySQL injection. MySQL, oh good, it has all the comments, testing. Yes, okay, great, great. Extract database with information schema. Thank you, tables, that's annoying. Oh, schema, okay, great. Ah, okay, okay, okay. So these are all the different databases. Excellent, okay. And then, how it does this, I see. So I had to first figure out what the database name was. Okay, and I can just do the table name. Now I figured out how to pin it in here. Okay, perfect. Where were we? So we were back here, select star from users, we're username equals blot. Okay, this is where we were. Now let's say we have our tick. Now, everybody remember our friend, the union syntax? Which was used to union two select statements? Yeah, so, how many columns did our user stable have? Two columns? We may or may not know that, depending. If we don't, we can actually just keep guessing. We can do foo bar, so this select foo bar. Yeah, so if we did, and what's super interesting, you won't have to get into this, but oh, it does do that. So you can figure out how many columns are needed by just keeping adding one to the select statement until you get the correct, you get an output, a non-error, everything else errors. So what this does is says, hey, select star from users, we're username is equal to nothing, which we don't care about. Union that with select one, two, three. Well, select one, two, three is not very useful and select foo bar is also not useful. Why is this not useful? This foo bar, like we gave that input. So it's just proving that what we give comes back to us. But we gave that, so that's not interesting. But I don't know, even know where the data is that I want, but I know by looking it up in that payload all the things that I can select in my SQL and other database engines have very similar things, I could say select and that's gonna fail because that has the different wrong number of columns. So what I really want from here, where did I want from Schemata? I want the schema name, select schema name. Again, not gonna work because when I'm unioning has one column on the right side and two columns on the left, so I just need to add something. So this shows me that, hey, there's my SQL schema, information schema, performance schema, sys and hack me. Hack me sounds good. Let's figure out all the tables in hack me. So now I can use my other query. Now that I know that I can do, or was my query, there we go. So now I'm gonna union that query with select star from information scheme dot tables where table schema is equal to hack me. That will not work. So I want, I believe it's just called table name. So table name, I have flag and users. I'm already querying all the users table. So which data do I want? Like which table do I want of these two tables? Flag, we want the flag, let's get the flag. I actually, from here, I don't know what the columns are, but you can actually read if you really want to. You can read all the columns in that table so you can figure out of the flags table what are the columns there. But we can do that here. Now that I know what table to search for, select star from flags, wrong number of columns. So I actually now will need to do that. So let's select dot columns where table name. Select star from columns where table name is equal to flag. Okay, wrong number of columns. I will do column name. Aha, there's a flag. So it should just be select flag. From flag, that won't work because of the wrong number of columns, plus flag, column one. So now I've finally got the flag. So fundamentally from doing this, you can actually get, are the parentheses necessary around this select statement? No, they're not. It just helps me when I was doing that. That was a good question on Twitch. SQL syntax is almost a little too forgiving. So I like to, I'll just be very careful there, yeah. Yeah, so this just means, so, so what I'm saying is, hey, select from the table flags and for my results, I want the first column to be flag, whatever is in the database as flag. And the second column, I just want to be one, like the literal one. So that's what this does. This just makes, this just returns one for the password. I could make it return a string as foo. I can make it return whatever I want. I could put flag twice. But the important thing is because with the union, the select on the left, the users table has two columns that the result when you union them has to have two, otherwise it can't put them together, right? It's like, you know what I'm like building blocks, right? You have like, like Legos, get the size two and you had a one and try to put that on there. That's not gonna work. If you had a three, that's too big. It has to be exactly the same size so that your application gets all those same results. And the crazy thing is, do they, I can't remember, did they do this in the assignment? So what's crazy is you can, so we were able to read the flag here. Why? Because we can see the output here, right? In this table, we see these results. The application may or may not give us the results here. So one, so there, but you can do really cool things. You can actually, and there's a, I guess I don't have it installed. Do we have it installed on the Dojo? No. So we can do cool things like, okay, let me see how I'm gonna do this. Some users, you can select. There are, hey, there we go. So we can actually do things like select or let's say we can't get this so all we're getting output is foo foo. But we can say where left flag, let's see, string, length, let's say one. So what I can do is I can set up a SQL query such that if it returns something, it returns the results if the first character of the flag, so the left, this left function, I just looked up from the documentations, specifies the number of characters from the list of the string, both the number and the string are supplied as arguments of the function. So this would be the string and the length. So I can iterate over this and brute force all the characters from A to Z, big A to big Z, zero through nine. And what's the difference? How do I know if I'm correct? SQL must be case and sensitive. That was not what I meant. So this is the problem when you just copy and paste random stuff. SQL case sensitive comparison, my SQL. So I know it's not A, I know it's not B, but when I get to P, so why is that? So let's say the application will give me an error if there's nothing or give me a page, like a 500 versus a 200 error. So the only thing I can see, I can't see what it returns, but I can know if my query gave zero results or non-zero results. So that's what we're doing here is by checking and taking the flag, by creating a where clause such that, by creating a where clause such that I have a condition based on part of the flag and a value that I supply, I can then test and I can make 255 of these queries for each character. I can even, let's see, my SQL function. There's a way to like turn it, yeah, there we go. Ord, just like, ah, it is, ord. So just like in what you might call it in Python, we can call ord on this to turn it into an integer and then that will not work, but if we do man ascii, let's see, P is at 70 and capital P is gonna be 50 and these are hex. There we go, so now we've found a way to determine the case of this. So if our program in the first case gives us a 500 error, we can use that. So this is the crazy thing, it's with one bit of information, whether the query returns something or doesn't return something, we can completely, we can use this to brute force this and what's even crazier, so what's faster than a linear search through zero to 255 to see which one hits? Somebody's taking 310? So what's faster than a linear search? So rather than searching zero trying everything zero to 255, a binary search, so I can do something like, because I don't have to do equality, I can do less than or equal to, right? So I can say is this less than and I would do what's in the middle of 255 and 255 divided by two, let's say 127, which it definitely will be. So this is a yes, so I got a yes response because I got something back. So okay, so I can do zero now between 275, so I can do 127 divided by two, 63. Nope, it's not less than that. So I know it's somewhere between 63 and 127, 63. This is what I'm doing with my hands, it's kind of a pain, but this is why you have computers, 96, so it's not, so it's between 96 and 127, 112. Okay, it's not bad, Connor, you're a great board call, 120. Yes, so it's between 120 and 112, 116, yes, so between 116 and 112, 118, yes, 119, yes, also yes. I'm just gonna check equality at some point, right? Something is wrong. So it's not less than 112, but it is less than 120 and less than, I see. Yeah, so we should have gotten down after 18, right? So we should have done 114, we will find it, correct, yes. Not 112, so what does that mean it is? Yeah, or so, well, you know, we are not computers, we are not computers, it's okay if we're not doing the binary search properly, yes, there we go, okay. That's octal, so it's octal, decimal, and hex. So it's P, so we figured out the first character. We can do, yes, thank you. They're much rejoicing from the audience. Oh shoot, that took a long time. Okay, so we first have to then put everything together of why is this safe? So as we talked about with JavaScript, you have basically random code that you're downloading onto your machine, and the whole point is that your browser wants to ensure that different websites and different tabs, you can think of as tabs, can't really mess with each other. So when you're accessing something and you're including images there from, let's say, red and from blue, your browser will then go and fetch those, and it can, yes. So the way this works is it gets to the, what is the same origin policy? So the origin is this three tuple of scheme, host, and port. Scheme being HTTP or HTTPS, host being the domain name, and port being the port of the connection. So anything that where those triple is the same, it exists in the same origin. So for instance, HTTPexample.com has the, I hate, this is the dreaded Google slides to PowerPoint conversion, example.com, the root site has the origin HTTPexample.com and 80, which if you're fetching cat.gif from there, it's the same HTTPexample.com 80, whereas if it's from a different origin, even if it's the exact same host and port, that is the different origin. Different port is a different, and so you can send across origin request if there are, sorry, we're at the end of time, we're gonna have to, we spent too much time on SQL injection, but we'll do this on Wednesday.


My name is Vedang Deshpande. Tell us your experience. I was a little bit serious when I was 11, but the quality of teaching and how personally invested the teachers are, they made me fall in love with the subject. The methods of explaining concepts are really comfortable. Is it about the assignment system? Is it effective in your progress? Some assignments take you from an easier level to a harder level. The Pentum Academy has this tagline of education with emotion. What are your comments on that? What are my comments on that? Yeah, I definitely see a lot of emotions. All the teachers, they all have passion for what they're doing and they motivate the students to study and receive passion. So there is this new ongoing program of mentorship. How do you feel about that mentorship program? Mentors are like more school guardians. They have the experience and you know how to extract what they are of students. Would you recommend Sentum to any other student? Yeah, I would definitely recommend Sentum. I have actually recommended it to a student already. Thank you so much, Vida. Thank you.


I think that's all Google have asked me if I'll do a behind-the-scenes of Chrome Dev Summit, and they've sent me this bag. I Guess it's some kind of camera. Oh, yes. Let's go to Chrome Dev Summit. Oh, I'm Timothy Jordan for the developer show here at the Chrome Dev Summit at You're a boy in the center of the arts. Timothy Jordan. Hey, Paul. Hey. Yeah, I'm good I'm doing a behind-the-scenes video for Chrome. I'm doing a top five recap video for the Chrome Dev Summit Awkward I'm running late. I'm supposed to be on stage. Do you know where the stage actually is here? No, Paul. I do not Go in


Your Living Trust Center to State Plan is a coordinated set of documents that work together to help protect you, your family, your loved ones. An essential thing that you cannot forget to do is properly titling assets to your living trust. You want to make sure that your house and other assets that should be a part of your trust are actually in the name of your trust. Just writing them down on the schedule doesn't put an asset in your trust. You've got to have the title changed, either at the bank or the brokerage house or through the title company. Remember, for your living trust to work effectively, you've got to make sure that the assets are properly added and titled to that living trust.


Once you have metadata recorded, the next step is to put it to work. There are lots of internal applications within most institutions that can benefit from this information, particularly in the use of search engines and navigation. But perhaps the greatest benefit is interoperability. Sometimes it appears that hooking your projects up to the larger network of educational content providers requires fairly regular proactive work. There are some elements of this that are that way, but when it comes to technical interoperability, if it is set up the right way at the start, relationships can happen effortlessly and organically. Let me provide an example. Members of the OCW Consortium, or content producers, who publish their courses in one of a few variations of XML-based feeds like RSS, Adam or RDFA, can share the URL to their feed with us. At this point, the content producer does not have to do anything else besides just keep those feeds in operation. We have a computer process that will look at these feeds, record all the information contained therein, and index it in a database. We then use this database to power a search engine for individuals to find OCW courses. We also publish our own feed called an OPML feed, which basically is a list of all the RSS feeds of our members. Our OPML feed is available for other tools to use to find content sources without having to find them all individually. CC Learn has a great prototype search engine called DiscoverEd, which takes this a step further. Among other resources, they are using our OPML feed as a reference to include content. DiscoverEd utilizes the same indexing technology to capture the metadata contained within those RSS feeds. After indexing the data from our feed, they also programmatically read the web page to gather more information than just what was included in our feed. We actually plan to migrate our integrated search engine to use the DiscoverEd service. These kinds of interoperating relationships will flourish as more and more providers are publishing a basic level of metadata. So what is a basic level? Well, what is considered basic or standard or best practice will vary based on the community in which you wish to participate. But for this presentation, I'll simply illustrate the current climate of the open courseware community. The OCWC supports RSS 1.0, RSS 2.0, Adam, and RDFA. A feed in any of those formats will be interpreted and stored correctly in our database. DiscoverEd recommends using a combination of RDFA and XHTML, but they are able to read somewhat comfortably those other formats as well. The following constitutes the OCW Consortium's best practice guidelines for publishing courses through an RSS feed. Channel tags represent the top level of your feed, which would be your institution. So this is not specific to a course. These are the general items that are related to the institution itself, like the title of the feed, a link to the homepage of the site, the description of the feed. Items would be all of the courses, and we'll cover that in a minute. Date, publisher, which would be the name of the institution or the OCW site, and then the primary language of the feed. Items would represent courses or resources that you're publishing. And so obviously we have some mandatory fields like the course title, a link to the URL. We use that link in order to refer people back to your site when they find it in our search engine. A description is useful so that people have a brief abstract. The general idea would be to do something along the lines of a course catalog that you might use in print if you're trying to decide whether or not you wanted to take that course. You need to read something about the topic that it covers. A subject would be topics or keywords. You could do multiple entries of this, so as many keywords as you find appropriate that are, you know, subjects that are covered in that course, the better it will be, the more effective it will be. Creator would be, typically we'd be looking for the creator to be represented, either creator or author, represented as the person who created the course. And that would be usually your professor. Publishers, again the name of the OCW site and the date it was published. There are other optional fields that can be useful too, but the mandatory fields are what we're primarily concerned with as a basic level. The most software platforms that are currently being used to publish open courseware are supportive of these recommendations without modification. They will produce RSS feeds that will be as good as the information you capture as you produce the courses. Beyond these basic elements, recording and publishing more metadata will create even more possibilities. More advanced and coordinated efforts could enable many exciting applications. So we're just hoping that we can have more people kind of adopt these standards and start publishing that metadata. Summary metadata is a crucial element of leveraging technology to improve our ability to maintain, find, use and share educational content. It begins with the basic level of standardization to tap into existing tools and resources and then creating new opportunities through increased richness as we add on some of those optional things. We offer some additional resources for those who are looking to learn more information about metadata as it applies to open courseware and we encourage you to visit these resources at your leisure. Thank you.


Hi there. My name is Steve Smith, aka Ardellis. I'm a Microsoft MVP and one of the maintainers of the eShop On-Web reference application. In this short video, I'm going to show you how to add some additional features to the eShop On-Web app using Visual Studio for Mac. Let's get started. If you haven't already, you're going to want to download the eShop On-Web reference application from its location here on GitHub. Once you've done so, go ahead and open it up in Visual Studio for Mac. It should look something like this. The feature that we're going to add is an enhancement to an existing feature. Currently, if you use the application, you'll typically log in with this demo user account, then you can add items to your basket and check out. Once you've done that, you can view your orders and you can see the status is pending. Likewise, when you click on the detail page, the status is shown as pending there as well. This is hard coded into the system. Our new feature that we're going to add is an improved order status that will take into account three different options, pending, out for delivery, and delivered. When it shows out for delivery on the details page, this page here, it should also show an estimate of when the delivery should take place. And if it's been delivered, it should show the time at which it was delivered. Since this is just a demo app, we're not going to actually integrate with any shipping providers. We're just going to hard code some of these values using a formula that's based on when the order was created. Now, there are a few different ways that we could get started to build this in our application. As you may recall, this solution is broken up into three different layers. There's the web project that represents the user interface, the application core, which has our business logic, and any infrastructure project, which handles some of the ways that we communicate with other services like databases or websites or sending emails or things like that. I'm going to go ahead and start with the user interface, but you would be just as correct if you wanted to start adding this feature by looking at the business model first. The first thing we need to do is identify the pages where we're going to need to make this change. In this case, we're talking about things that affect the order. The order controller has two action methods that it uses, one that lists all the orders called my orders, and another that displays the order details called detail. This is following the MVC pattern and the views that correspond to these action methods on this controller are found in the views folder. You'll see the two of them here. The first one we're going to look at is the detail view. The detail view displays the order status here on line 23. It just takes the view model and displays the model.status property. Likewise, if we look at the my orders list, it displays the status as well on line 24. Again, it's simply taking the item that's found in the view model for this view and displays its status property. What that means is we don't actually need to make any change to these UI views at all. As long as we do the proper logic somewhere else to set the correct information in the view model, the views will do what we need them to as they stand. It's generally a good idea to minimize how much logic goes into your view. So in this case, we're not going to add any logic at all. We're going to perform the work inside the controller. Let's return to the order controller and figure out what we need to do to change how we're going to display some additional information when we're on the order detail page. Remember, we want to show both when the delivery is estimated, if the status is out for delivery, as well as when it was actually delivered, if the status is delivered. To do that, we need to change this line right here where we're currently hard coding the status to be pending in the detail action. I'm going to go ahead and introduce a new helper method to take care of this for us. Right now we don't have anything in our business model that corresponds to status, so we're going to do all the work right here in the controller and then test it out to see if it works. I'm going to create a new private method that's going to take in the full string of the status and then return a different more detailed status message when appropriate. In the case where it's pending, we're not going to make any change at all. So when that pending status comes in, we just return it as is. In the case where the status is out for delivery, we're going to add an ETA, an estimated time of arrival, and use one hour from the current time. Yes, this means it'll never actually be delivered, but that's okay. Again, it's just a demo. Notice that datetime is underscored. Visual Studio for Mac is smart and knows that we have not yet imported this using statement for system.datetime. So we can right click on this and choose a quick fix and it'll let us know that we can add the using system namespace here. That's just gone and added this line up here on line 6 for us without us having to go and do it by hand. It's also telling us that this method doesn't yet compile. It's warning us that not all code paths return a value. That's okay because we're not done yet. We need to repeat this step for when the order has been delivered. I'm going to use the line numbers to select all four of these lines so I can duplicate it easily and not have any issues with the line wrapping. Now in the case where it's delivered, we're going to specify the status and instead of giving it an ETA, we're going to say it was delivered at, we'll say an hour ago. So no matter what, when you look at this, if the status is delivered, it will tell you that it was delivered an hour ago. Now we still have not all code paths returning a value. In this case, we've used all the different statuses we expect to have. So in the event that something else is happening here, we're going to just return unknown. Okay, now the last thing to do is to call our method. So we're going to wrap this pending string here with our get detailed status call and pass it in pending for now. And that will let us verify that it still works the way it should in the basic case. So now let's go ahead and build our application and we can test that it works just as it did before. We can also modify this by hard coding it and test it with out for delivery and delivered. In the interest of time, I'm going to jump ahead and just start updating our business model so that we can support this feature and have it actually save the values. Let's close the web project and go to the application core, drill down into the entity's order aggregate folder and in there open up order. The order entity currently has a couple of properties and it sets most of its state through its constructor here. For the status, we're going to have the status just automatically default to pending. So we're going to add a new string similar to address. It's going to look like this. Now whenever we create a new order using the new keyword, its status will automatically be set to pending. And since we used a private set, there's no way for any other part of the application to modify the status of an order once it's been created. Now we want to go and set these values somewhere when that order is created. So in order to do that, we'll need to expose a couple of methods that will allow us to modify the status. Let's do that down here at the bottom. These can just be void return methods and literally all they're doing is exposing ways to set the status to particular values. Now you may wonder why it's worthwhile for us to use methods like these to set these values instead of just providing a public setter on status. This gives us a couple of different benefits. One, it preserves encapsulation so that only the order class has control over how and when that status property gets set. It might be that when that status changes, the order needs to do some additional actions. Maybe it needs to raise a domain event or do something else to let other parts of the system know that its status just changed. Maybe it can only move between certain statuses in certain ways. Maybe it doesn't make sense for something to go from delivered to pending, or from any version of pending directly to delivered without going to out for delivery first, for example. So we can control which status changes are valid and which ones aren't if we use methods like these instead of just allowing anyone to set the value. Also, this ensures that we know exactly what values can be set because there's only one place in the system where the order status is being specified. It can't just be set to some arbitrary string. As a future update, we might choose to use an enum value instead of these hard-coded strings, or we could use something like the smart enum NuGet package, which would allow us to use something similar to an enum, but with a little more flexibility and power. Now, with this, we're ready to go ahead and change how the order gets created. That happens inside of a domain service called the order service. Let's open that up and let's see where order is instantiated. It's right here. So we create the new order as part of creating the order from the basket. And it's at this point that we want to go ahead and specify some kind of status so we can test out our UI. Since this is just a demo app, we're going to just randomly set the status to something based on the current seconds on the date time. So we'll create a variable for that. And once we have that variable, we'll make sure we have the appropriate namespace. And then we'll add a couple of if conditions. We're going to modulo on the value of second and change it from pending to out for delivery or delivered based on what that value is. Once we're done, we're going to go ahead and save that order just like we were before using the order repository. All right, now we're almost ready to test the application. The last thing we need to do is we need to actually update how we set the view model. So instead of using a hard coded value, it uses the new status property on order. Let's go back to our order controller in the web project. Here in the my orders list, you can see status is being set to pending hard coded. The O in our lambda expression here represents our order. So we can specify instead of this hard coded pending value, O dot status. And then we'll do the same thing inside of the detail action, where instead of using pending here in a hard coded fashion, we'll again say order in this case, dot status. Now that we've made those two changes, we're ready to test the application. Now we're ready to test the application. We're going to add a few different orders and see if we get different status values. So we're just going to keep checking out, continue shopping. And once we have a few orders, let's view the orders. You can see we have a few different statuses here. We have delivered, we have pending, we have out for delivery. When they're delivered, we can see it was delivered at 1350, which happens to be an hour ago. And if we go back and view orders again, out for delivery, it's at 1550, about an hour from now. All right. So what would be our good next step? Now that we've updated our system with this behavior, something that we could do that would ensure that continues to work even as we make future changes is make some updates to our tests. We could easily add some unit tests to order that would verify that when we create a new order, its status defaults to being set to pending and that when we call set status out for delivery or set status delivered, it sets the status property appropriately. In addition, we could write integration tests that will verify that when we create and save an order and then retrieve it back from the database, that these status values are set and are round tripped properly to and from the data store. Finally, we could add some functional tests that would verify that after we create an order through the web application that that order is displayed correctly with the additional data on the my orders page and on the order detail page. This would ensure that rather than us having to manually test the application by logging in, adding items to my cart, checking out, repeating that multiple times, and then finally viewing the orders, we could have all of that done automatically using some tests that we could run with the click of a button. That's it for this video on how to work with the eShop on web reference application. I hope you've enjoyed this and that you'll take an opportunity to download the sample app yourself and play around with it to get a better idea for how to work with ASP.NET Core. Thanks!


Welcome to the first unit of Sailor.org's course on word processing. Here we'll give you an overview of where to find some common commands in Microsoft Word. The 2010 version uses what's called a file dropdown menu. The file menu is where you will find commands like save, print, open, and exit. If you're using an older version of Word like 2007, you'll notice that instead of a dropdown menu, you have a button with some colorful boxes on it. This button called the office button confused many people who wanted to see the word file on the top left of their word processing program. So the folks at Microsoft switched it back to the latest version. This unit will also look at using the save and the print commands from the menu. When you are saving something for the first time, there is always three things to remember. Where to save it, what to name it, and what type of file to save it as. We will also do a quick review on printing as well as a review of how to add or delete commands from the quick access toolbar. The quick access toolbar is a small toolbar that sits up in the top far right corner of the new versions of MS Word. This toolbar places common commands in one place and it is easy to customize it to your needs. Remember, if you have a different kind of word processor, it's a good idea to take notes as to where these commands are located in your program. That way you can easily find them again when you need to use them. Well, good luck working through this unit and we'll see you in the next one.