"All In The Family"

at 4:52 AM

Update May 12, 2015

Added CVE-2015-0359 and updates for CVE-2015-0336

Exploit kit table 2014- 2015 (Sortable HTML table)

Reference table : Exploit References 2014-2015

Update March 20, 2015

Added CVE-2015-0336

------------------------

Update February 19, 2015

Added Hanjuan Exploit kit and CVE-2015-3013 for Angler

Update January 24, 2015

http://www.kahusecurity.com

Added CVE-2015-3010, CVE-2015-3011 for Agler and a few reference articles.
If you notice any errors, or some CVE that need to be removed (were retired by the pack authors), please let me know. Thank you very much!

Update December 12, 2014

Update Jan 8, 2014

This is version 20 of the exploit pack table - see the added exploit packs and vulnerabilities listed below.

Exploit Pack Table Update 20
Click to view or download from Google Apps

I want to give special thanks to Kafeine L0NGC47, Fibon and Curt Shaffer for their help and update they made. Note the new Yara rules sheet / tab for yara rules for exploit kit.
I also want to thank Kahu security, Kafeine, Malforsec and all security companies listed in References for their research.

If you wish to be a contributor (be able to update/change the exploits or add yara rules), please contact me :)
If you have additions or corrections, please email, leave post comments, or tweet (@snowfl0w) < thank you!

The Wild Wild West image was created by Kahu Security - It shows current and retired (retiring) kits.

List of changed kits

Gong Da / GonDad

Redkit 2.2

x2o (Redkit Light)

Fiesta (=Neosploit)

Cool Styxy

DotkaChef

CVE-2011-3544

CVE-2013-2551

CVE-2013-2465

CVE-2010-0188

CVE-2012-5692

CVE-2012-0507

CVE-2013-2471

CVE-2013-0074/3896

CVE-2011-3402

CVE-2013-1493

CVE-2012-1723

CVE-2013-1493

CVE-2013-0431

CVE-2013-2423

CVE-2012-1889

CVE-2013-2460

CVE-2013-0634

CVE-2013-1493

CVE-2012-4681

CVE-2013-2551

CVE-2013-2423

CVE-2012-5076

CVE-2013-0422

CVE-2013-0634

CVE-2013-2465

Angler	FlashPack = SafePack	White Lotus	Magnitude (Popads)	Nuclear 3.x	Sweet Orange
CVE-2013-0074/3896	CVE-2013-0074/3896	CVE-2011-3544	CVE-2011-3402	CVE-2010-0188	CVE-2013-2423
CVE-2013-0634	CVE-2013-2551	CVE-2013-2465	CVE-2012-0507	CVE-2012-1723	CVE-2013-2471
CVE-2013-2551		CVE-2013-2551	CVE-2013-0634	CVE-2013-0422	CVE-2013-2551
CVE-2013-5329			CVE-2013-2460	CVE-2013-2423
CVE-2013-2471 ??			CVE-2013-2471	CVE-2013-2460
			CVE-2013-2551	CVE-2013-2551

CK	HiMan	Neutrino	Blackhole (last)	Grandsoft	Private EK
CVE-2011-3544	CVE-2010-0188	CVE-2013-0431	CVE-2013-0422	CVE-2010-0188	CVE-2006-0003
CVE-2012-1889	CVE-2011-3544	CVE-2013-2460	CVE-2013-2460	CVE-2011-3544	CVE-2010-0188
CVE-2012-4681	CVE-2013-0634	CVE-2013-2463*	CVE-2013-2471	CVE-2013-0422	CVE-2011-3544
CVE-2012-4792*	CVE-2013-2465	CVE-2013-2465*	and + all or some	CVE-2013-2423	CVE-2013-1347
CVE-2013-0422	CVE-2013-2551	CVE-2013-2551	exploits	CVE-2013-2463	CVE-2013-1493
CVE-2013-0634		* switch 2463<>2465	from the previous		CVE-2013-2423
CVE-2013-3897		Possibly + exploits	version		CVE-2013-2460
* removed		from the previous
		version

Sakura 1.x	LightsOut	Glazunov	Rawin	Flimkit	Cool EK (Kore-sh)	Kore (formely Sibhost)
cve-2013-2471	CVE-2012-1723	CVE-2013-2463	CVE-2012-0507	CVE-2012-1723	CVE-2013-2460	CVE-2013-2423
CVE-2013-2460	CVE-2013-1347	cve-2013-2471	CVE-2013-1493	CVE-2013-2423	CVE-2013-2463	CVE-2013-2460
and + all or some	CVE-2013-1690		CVE-2013-2423	CVE-2013-2471		CVE-2013-2463
exploits	CVE-2013-2465					CVE-2013-2471
from the previous
version

Styx 4.0	Cool	Topic EK	Nice EK
CVE-2010-0188	CVE-2012-0755	CVE-2013-2423	CVE-2012-1723
CVE-2011-3402	CVE-2012-1876
CVE-2012-1723	CVE-2013-0634
CVE-2013-0422	CVE-2013-2465
CVE-2013-1493	cve-2013-2471
CVE-2013-2423	and + all or some
CVE-2013-2460	exploits
CVE-2013-2463	from the previous
CVE-2013-2472	version
CVE-2013-2551
Social Eng

=================================================================

The Explot Pack Table has been updated and you can view it here.

Exploit Pack Table Update 19.1 - View or Download from Google Apps

If you keep track of exploit packs and can/wish to contribute and be able to make changes, please contact me (see email in my profile)
I want to thank L0NGC47, Fibon, and Kafeine, Francois Paget, Eric Romang, and other researchers who sent information for their help.

Update April 28, 2013 - added CVE-2013-2423 (Released April 17, 2013) to several packs.
Now the following packs serve the latest Java exploit (update your Java!)

Styx
Sweet Orange
Neutrino
Sakura
Whitehole
Cool
Safe Pack
Crime Boss
CritX

Other changes
Updated:

Whitehole
Redkit
Nuclear
Sakura
Cool Pack
Blackhole
Gong Da

Added:

KaiXin
Sibhost
Popads
Alpha Pack
Safe Pack
Serenity
SPL Pack

There are 5 tabs in the bottom of the sheet

2011-2013
References
2011 and older
List of exploit kits
V. 16 with older credits

March 2013
The Explot Pack Table, which has been just updated, has migrated to Google Apps - the link is below. The new format will allow easier viewing and access for those who volunteered their time to keep it up to date.

In particular, I want to thank
L0NGC47, Fibon, and Kafeine for their help.

There are 5 tabs in the bottom of the sheet

2011-2013
References
2011 and older
List of exploit kits
V. 16 with older credits

The updates include

Neutrino - new
Cool Pack - update
Sweet Orange - update
SofosFO aka Stamp EK - new
Styx 2.0 - new
Impact - new
CritXPack - new
Gong Da - update
Redkit - update
Whitehole - new
Red Dot - new

The long overdue Exploit pack table Update 17 is finally here. It got a colorful facelift and has newer packs (Dec. 2011-today) on a separate sheet for easier reading.
Updates / new entries for the following 13 packs have been added (see exploit listing below)

Redkit
Neo Sploit
Cool Pack
Black hole 2.0
Black hole 1.2.5
Private no name
Nuclear 2.2 (Update to 2.0 - actual v. # is unknown)
Nuclear 2.1 (Update to 2.0 - actual v. # is unknown)
CrimeBoss
Grandsoft
Sweet Orange 1.1 Update to 1.0 actual v. # is unknown)
Sweet Orange 1.0
Phoenix 3.1.15
NucSoft
Sakura 1.1 (Update to 1.0 actual v. # is unknown)
AssocAID (unconfirmed)

The full table in xls format - Version 17 can be downloaded from here.

Exploit lists for the added/updated packs

AssocAID (unconfirmed)

09-'12

CVE-2011-3106

CVE-2012-1876

CVE-2012-1880

CVE-2012-3683

Unknown CVE

5

Redkit

08-'12

CVE-2010-0188

CVE-2012-0507

CVE-2012-4681

3

Neo Sploit

09-'12

CVE-2012-1723

CVE-2012-4681

2?

Cool

08-'12

CVE-2006-0003

CVE-2010-0188

CVE-2011-3402

CVE-2012-0507

CVE-2012-1723

CVE-2012-4681

5

Black hole 2.0

09-'12

CVE-2006-0003

CVE-2010-0188

CVE-2012-0507

CVE-2012-1723

CVE-2012-4681

CVE-2012-4969 promised

5

Black hole 1.2.5

08-'12

CVE-2006-0003

CVE-2007-5659 /2008-0655

CVE-2008-2992

CVE-2009-0927

CVE-2010-0188

CVE-2010-1885

CVE-2011-0559

CVE-2011-2110

CVE-2012-1723

CVE-2012-1889

CVE-2012-4681

11

Private no name

09-'12

CVE-2010-0188

CVE-2012-1723

CVE-2012-4681

3

Nuclear 2.2 (Update to 2.0 - actual v. # is unknown)

03-'12

CVE-2010-0188

CVE-2011-3544

CVE-2012-1723

CVE-2012-4681

4

Nuclear 2.1 (Update to 2.0 - actual v. # is unknown)

03-'12

CVE-2010-0188

CVE-2011-3544

CVE-2012-1723

3

CrimeBoss

09-'12

Java Signed Applet

CVE-2011-3544

CVE-2012-4681

3

Grandsoft

09-'12

CVE-2010-0188

CVE-2011-3544

2?

Sweet Orange 1.1

09-'12

CVE-2006-0003

CVE-2010-0188

CVE-2011-3544

CVE-2012-4681

4?

Sweet Orange 1.0

05-'12

CVE-2006-0003

CVE-2010-0188

CVE-2011-3544

3?

Phoenix 3.1.15

05-'12

CVE-2010-0842

CVE: 2010-0248

CVE-2011-2110

CVE-2011-2140

CVE: 2011-2371

CVE-2011-3544

CVE-2011-3659

Firefox social

CVE: 2012-0500

CVE-2012-0507

CVE-2012-0779

11

NucSoft

2012

CVE-2010-0188

CVE-2012-0507

2

Sakura 1.1

08-'12

CVE-2006-0003

CVE-2010-0806

CVE-2010-0842

CVE-2011-3544

CVE-2012-4681

5

Version 16. April 2, 2012

Thanks to Kahu security
for Wild Wild West graphic

The full table in xls format - Version 16 can be downloaded from here.

ADDITIONS AND CHANGES:

1. Blackhole Exploit Kit 1.2.3

Added:

CVE-2011-0559 - Flash memory corruption via F-Secure
CVE-2012-0507 - Java Atomic via Krebs on Security
CVE-2011-3544 - Java Rhino via Krebs on Security

2. Eleonore Exploit Kit 1.8.91 and above- via Kahu Security

Added:

CVE-2012-0507 - Java Atomic- after 1.8.91was released
CVE-2011-3544 - Java Rhino
CVE-2011-3521 - Java Upd.27 see Timo Hirvonen, Contagio, Kahu Security and Michael 'mihi' Schierl
CVE-2011-2462 - Adobe PDF U3D

Also includes
"Flash pack" (presumably the same as before)
"Quicktime" - CVE-2010-1818 ?

3. Incognito Exploit Pack v.2 and above

there are rumors that Incognito development stopped after v.2 in 2011 and it is a different pack now. If you know, please send links or files.

Added after v.2 was released:

CVE-2012-0507 - Java Atomic

See V.2 analysis via StopMalvertizing

4. Phoenix Exploit Kit v3.1 - via Malware Don't Need Coffee

Added:

CVE-2012-0507 - Java Atomic
CVE-2011-3544 - Java Rhino + Java TC (in one file)

5. Nuclear Pack v.2 - via TrustWave Spiderlabs

CVE-2011-3544 Oracle Java Rhino
CVE-2010-0840 JRE Trusted Method Chaining
CVE-2010-0188 Acrobat Reader – LibTIFF
CVE-2006-0003 MDAC

6. Sakura Exploit Pack > v.1 via DaMaGeLaB

CVE-2011-3544 - Java Rhino (It was in Exploitpack table v15, listing it to show all packs with this exploit)

7. Chinese Zhi Zhu Pack via Kahu Security and Francois Paget (McAfee)

CVE-2012-0003 - WMP MIDI
CVE-2011-1255 - IE Time Element Memory Corruption
CVE-2011-2140 - Flash 10.3.183.x
CVE-2011-2110 - Flash 10.3.181.x
CVE-2010-0806 - IEPeers

8. Gong Da Pack via Kahu Security

CVE-2011-2140 - Flash 10.3.183.x
CVE-2012-0003 - WMP MIDI
CVE-2011-3544 - Java Rhino

9. Dragon Pack - via DaMaGeLab December 2010 - it is old, listing for curiosity sake

CVE-2010-0886 - Java SMB
CVE-2010-0840 - JRE Trusted Method Chaining
CVE-2008-2463 - Snapshot
CVE-2010-0806 - IEPeers
CVE-2007-5659/2008-0655 - Collab.collectEmailInfo
CVE-2008-2992 - util.printf
CVE-2009-0927 - getIco
CVE-2009-4324 - newPlayer

Version 15. January 28, 2012

Additions - with many thanks to Kahu Security

Hierarchy Exploit Pack
=================
CVE-2006-0003
CVE-2009-0927
CVE-2010-0094
CVE-2010-0188
CVE-2010-0806
CVE-2010-0840
CVE-2010-1297
CVE-2010-1885
CVE-2011-0611
JavaSignedApplet

Siberia Private
==========
CVE-2005-0055
CVE-2006-0003
CVE-2007-5659
CVE-2008-2463
CVE-2008-2992
CVE-2009-0075
CVE-2009-0927
CVE-2009-3867
CVE-2009-4324
CVE-2010-0806

Techno XPack
===========
CVE-2008-2992
CVE-2010-0188
CVE-2010-0842
CVE-2010-1297
CVE-2010-2884
CVE-2010-3552
CVE-2010-3654
JavaSignedApplet

"Yang Pack"
=========
CVE-2010-0806
CVE-2011-2110
CVE-2011-2140
CVE-2011-354

Version 14. January 19, 2012

Version 14 Exploit Pack table additions:

Credits for the excellent Wild Wild West (October 2011 edition) go to kahusecurity.com

With many thanks to XyliBox (Xylitol - Steven), Malware Intelligence blog, and xakepy.cc for the information:

Blackhole 1.2.1 (Java Rhino added, weaker Java exploits removed)

Blackhole 1.2.1 (Java Skyline added)

Sakura Exploit Pack 1.0 (new kid on the block, private pack)

Phoenix 2.8. mini (condensed version of 2.7)

Fragus Black (weak Spanish twist on the original, black colored admin panel, a few old exploits added)

If you find any errors or CVE information for packs not featured , please send it to my email (in my profile above, thank you very much) .

The full table in xls format - Version 14 can be downloaded from here.

The exploit pack table in XLSX format
The exploit pack table in csv format

The references sheet in csv format

P.S. There are always corrections and additions thanks to your feedback after the document release, come back in a day or two to check in case v.15 is out.

Version 13. Aug 20, 2011

Kahusecurity issued an updated version of their Wild Wild West graphic that will help you learn Who is Who in the world of exploit packs. You can view the full version of their post in the link above.

Version 13 exploit pack table additions:

Bleeding Life 3.0
Merry Christmas Pack (many thanks to kahusecurity.com)+
Best Pack (many thanks to kahusecurity.com)
Sava Pack (many thanks to kahusecurity.com)
LinuQ
Eleonore 1.6.5
Zero Pack
Salo Pack (incomplete but it is also old)

List of packs in the table in alphabetical order

Best Pack
Blackhole Exploit 1.0
Blackhole Exploit 1.1
Bleeding Life 2.0
Bleeding Life 3.0
Bomba
CRIMEPACK 2.2.1
CRIMEPACK 2.2.8
CRIMEPACK 3.0
CRIMEPACK 3.1.3
Dloader
EL Fiiesta
Eleonore 1.3.2
Eleonore 1.4.1
Eleonore 1.4.4 Moded
Eleonore 1.6.3a
Eleonore 1.6.4
Eleonore 1.6.5
Fragus 1
Icepack
Impassioned Framework 1.0
Incognito
iPack
JustExploit
Katrin
Merry Christmas Pack
Liberty 1.0.7
Liberty 2.1.0*
LinuQ pack
Lupit
Mpack
Mushroom/unknown
Open Source Exploit (Metapack)
Papka
Phoenix 2.0
Phoenix 2.1
Phoenix 2.2
Phoenix 2.3
Phoenix 2.4
Phoenix 2.5
Phoenix 2.7
Robopak
Salo pack
Sava Pack
SEO Sploit pack
Siberia
T-Iframer
Unique Pack Sploit 2.1
Webattack
Yes Exploit 3.0RC
Zero Pack
Zombie Infection kit
Zopack

----------------------------------------------
Bleeding Life 3.0
New Version Ad is here

Merry Christmas Pack read analysis at kahusecurity.com	Best Pack read analysis at kahusecurity.com	Sava Pack read analysis at kahusecurity.com
Eleonore 1.6.5 [+] CVE-2011-0611 [+] CVE-2011-0559 [+] CVE-2010-4452 [-] CVE-2010-0886	Salo Pack Old (2009), added just for the collection	Zero Pack 62 exploits from various packs (mostly Open Source pack)
LinuQ pack Designed to compromise linux servers using vulnerable PHPMyAdmin. Comes with DDoS bot but any kind of code can be loaded for Linux botnet creation. LinuQ pack is PhpMyAdmin exploit pack with 4 PMA exploits based on a previous Russian version of the Romanian PMA scanner ZmEu. it is not considered to be original, unique, new, or anything special. All exploits are public and known well. It is designed to be installed on an IRC server (like UnrealIRCD). IP ranges already listed in bios.txt can be scanned, vulnerable IPs and specific PMA vulnerabilities will be listed in vuln.txt, then the corresponding exploits can be launched against the vulnerable server. It is more like a bot using PMA vulnerabilities than exploit pack. It is using CVE-2009-1148 (unconfirmed) CVE-2009-1149 (unconfirmed) CVE-2009-1150 (unconfirmed) CVE-2009-1151 (confirmed)

====================================================================

Version 12. May 26, 2011

additional changes (many thanks to kahusecurity.com)

Bomba

Papka

See the list of packs covered in the list below

The full table in xls format - Version 12 can be downloaded from here.

I want to thank everyone who sent packs and information :)

Version 11 May 26, 2011 Changes:

Phoenix2.7
"Dloader" (well, dloader is a loader but the pack is some unnamed pack http://damagelab.org/lofiversion/index.php?t=20852)
nuclear pack
Katrin
Robopak
Blackhole exploit kit 1.1.0
Mushroom/unknown
Open Source Exploit kit

====================================================================

10. May 8, 2011 Version 10 Exploit Pack Table_V10May11
First, I want to thank everyone who sent and posted comments for updates and corrections.

*** The Wild Wild West picture is from a great post about evolution of exploit packs by Kahu Security Wild Wild West Update

As usual, send your corrections and update lists.

Changes:

Eleonore 1.6.4

Eleonore 1.6.3a

Incognito

Blackhole

Go1Pack (not included) as reported as being a fake pack, here is a gui. Here is a threatpost article referencing it as it was used for an attack
Also, here is another article claiming it is not a fake http://community.websense.com/blogs/securitylabs/archive/2011/04/19/Mass-Injections-Leading-to-g01pack-Exploit-Kit.aspx
Go1 Pack CVE are reportedly
CVE-2006-0003
CVE-2009-0927
CVE-2010-1423
CVE-2010-1885
Does anyone have this pack or see it offered for sale?

Exploit kits I am planning to analyze and add (and/or find CVE listing for) are:

Open Source Exploit Kit
SALO
K0de

Legend:

Black color entries by Francois Paget

Red color entries by Gunther

Blue color entries by Mila

Also, here is a great presentation by Ratsoul (Donato Ferrante) about Java Exploits (http://www.inreverse.net/?p=1687)

--------------------------------------------------------
9. April 5, 2011 Version 9 ExploitPackTable_V9Apr11

It actually needs another update but I am posting it now and will issue version 10 as soon as I can.

Changes:
Phoenix 2.5
IFramer
Tornado
Bleeding life

Many thanks to Gunther for his contributions.
If you wish to add some, please send your info together with the reference links. Also please feel free to send corrections if you notice any mistakes

8. Update 8 Oct 22, 2010 Version 8 ExploitPackTable_V8Oct22-10

Changes:

Eleonore 1.4.4 Moded added (thanks to malwareint.blogspot.com)
Correction on CVE-2010-0746 in Phoenix 2.2 and 2.3. It is a mistake and the correct CVE is CVE-2010-0886 (thanks to
♫
etonshell for noticing)
SEO Sploit pack added (thanks to whsbehind.blogspot.com, evilcodecave.blogspot.com and blog.ahnlab.com)

7. Update 7 Oct 18, 2010 Version 7 ExploitPackTable_V7Oct18-10 released

thanks to SecNiche we have updates for Phoenix 2.4 :)

We also added shorthand/slang/abbreviated names for exploits for easy matching of exploits to CVE in the future. Please send us more information re packs, exploit names that can be added in the list. Thank you!

6. Update 6 Sept 27, 2010 Version 6 ExploitPackTable_V6Sept26-10 released

Thanks to Francois Paget (McAfee) we have updates for Phoenix 2.2 and Phoenix 2.3

5. Update 5. Sept 27, 2010 Version 5 ExploitPackTable_V5Sept26-10 released

Added updates for Phoenix 2.1 and Crimepack 3.1.3

4 Update 4 July 23, 2010 Version 4 ExploitPackTable_V4Ju23-10 released. Added a new Russian exploit kit called Zombie Infection Kit to the table. Read more at malwareview.com

Update 3 July 7, 2010. Please read more about this on the Brian Krebs' blog Pirate Bay Hack Exposes User Booty

Update 2 June 27, 2010 Sorry but Impassioned Framework is back where it belongs - blue

Update 1 June 24, 2010 Eleonore 1.4.1 columns was updated to include the correct list of the current exploits.

Francois Paget www.avertlabs.com kindly agreed to allow us to make additions to his Overview of Exploit Packs table published on Avertlabs (McAfee Blog)

Many thanks to Gunther from ARTeam for his help with the update. There are a few blanks and question marks, please do no hesitate to email me if you know the answer or if you see any errors.

Please click on the image below to expand it (it is a partial screenshot) Impassioned Framework is tentatively marked a different color because the author claims it is a security audit tool not exploit pack. However, there was no sufficient information provided yet to validate such claims. The pack is temporarily/tentatively marked a different color. We'll keep you posted.

Related news

at 8:21 PM

In part 1 and 2 we covered re-entrancy and authorization attack scenarios within the Ethereum smart contract environment. In this blog we will cover integer attacks against blockchain decentralized applications (DAPs) coded in Solidity.

Integer Attack Explanation:

An integer overflow and underflow happens when a check on a value is used with an unsigned integer, which either adds or subtracts beyond the limits the variable can hold. If you remember back to your computer science class each variable type can hold up to a certain value length. You will also remember some variable types only hold positive numbers while others hold positive and negative numbers.

If you go outside of the constraints of the number type you are using it may handle things in different ways such as an error condition or perhaps cutting the number off at the maximum or minimum value.

In the Solidity language for Ethereum when we reach values past what our variable can hold it in turn wraps back around to a number it understands. So for example if we have a variable that can only hold a 2 digit number when we hit 99 and go past it, we will end up with 00. Inversely if we had 00 and we subtracted 1 we would end up with 99.

Normally in your math class the following would be true:

99 + 1 = 100
00 - 1 = -1

In solidity with unsigned numbers the following is true:

99 + 1 = 00
00 - 1 = 99

So the issue lies with the assumption that a number will fail or provide a correct value in mathematical calculations when indeed it does not. So comparing a variable with a require statement is not sufficiently accurate after performing a mathematical operation that does not check for safe values.

That comparison may very well be comparing the output of an over/under flowed value and be completely meaningless. The Require statement may return true, but not based on the actual intended mathematical value. This in turn will lead to an action performed which is beneficial to the attacker for example checking a low value required for a funds validation but then receiving a very high value sent to the attacker after the initial check. Lets go through a few examples.

Simple Example:

Lets say we have the following Require check as an example:
require(balance - withdraw_amount > 0) ;

Now the above statement seems reasonable, if the users balance minus the withdrawal amount is less than 0 then obviously they don't have the money for this transaction correct?

This transaction should fail and produce an error because not enough funds are held within the account for the transaction. But what if we have 5 dollars and we withdraw 6 dollars using the scenario above where we can hold 2 digits with an unsigned integer?

Let's do some math.
5 - 6 = 99

Last I checked 99 is greater than 0 which poses an interesting problem. Our check says we are good to go, but our account balance isn't large enough to cover the transaction. The check will pass because the underflow creates the wrong value which is greater than 0 and more funds then the user has will be transferred out of the account.

Because the following math returns true:
require(99 > 0)

Withdraw Function Vulnerable to an UnderFlow:

The below example snippet of code illustrates a withdraw function with an underflow vulnerability:

function withdraw(uint _amount){

    require(balances[msg.sender] - _amount > 0);
    msg.sender.transfer(_amount);
    balances[msg.sender] -= _amount;

}

In this example the require line checks that the balance is greater then 0 after subtracting the _amount but if the _amount is greater than the balance it will underflow to a value above 0 even though it should fail with a negative number as its true value.

require(balances[msg.sender] - _amount > 0);

It will then send the value of the _amount variable to the recipient without any further checks:

msg.sender.transfer(_amount);

Followed by possibly increasing the value of the senders account with an underflow condition even though it should have been reduced:

balances[msg.sender] -= _amount;

Depending how the Require check and transfer functions are coded the attacker may not lose any funds at all but be able to transfer out large sums of money to other accounts under his control simply by underflowing the require statements which checks the account balance before transferring funds each time.

Transfer Function Vulnerable to a Batch Overflow:

Overflow conditions often happen in situations where you are sending a batched amount of values to recipients. If you are doing an airdrop and have 200 users who are each receiving a large sum of tokens but you check the total sum of all users tokens against the total funds it may trigger an overflow. The logic would compare a smaller value to the total tokens and think you have enough to cover the transaction for example if your integer can only hold 5 digits in length or 00,000 what would happen in the below scenario?

You have 10,000 tokens in your account
You are sending 200 users 499 tokens each
Your total sent is 200*499 or 99,800

The above scenario would fail as it should since we have 10,000 tokens and want to send a total of 99,800. But what if we send 500 tokens each? Lets do some more math and see how that changes the outcome.

You have 10,000 tokens in your account
You are sending 200 users 500 tokens each
Your total sent is 200*500 or 100,000
New total is actually 0

This new scenario produces a total that is actually 0 even though each users amount is 500 tokens which may cause issues if a require statement is not handled with safe functions which stop an overflow of a require statement.

Lets take our new numbers and plug them into the below code and see what happens:

1. uint total = _users.length * _tokens;
2. require(balances[msg.sender] >= total);
3. balances[msg.sender] = balances[msg.sender] -total;

4. for(uint i=0; i < users.length; i++){
5. balances[_users[i]] = balances[_users[i]] + _value;

Same statements substituting the variables for our scenarios values:

1. uint total = _200 * 500;
2. require(10,000 >= 0);
3. balances[msg.sender] = 10,000 - 0;

4. for(uint i=0; i < 500; i++){
5. balances[_recievers[i]] = balances[_recievers[i]] + 500;

Batch Overflow Code Explanation:

1: The total variable is 100,000 which becomes 0 due to the 5 digit limit overflow when a 6th digit is hit at 99,999 + 1 = 0. So total now becomes 0.

2: This line checks if the users balance is high enough to cover the total value to be sent which in this case is 0 so 10,000 is more then enough to cover a 0 total and this check passes due to the overflow.

3: This line deducts the total from the senders balance which does nothing since the total of 10,000 - 0 is 10,000. The sender has lost no funds.

4-5: This loop iterates over the 200 users who each get 500 tokens and updates the balances of each user individually using the real value of 500 as this does not trigger an overflow condition. Thus sending out 100,000 tokens without reducing the senders balance or triggering an error due to lack of funds. Essentially creating tokens out of thin air.

In this scenario the user retained all of their tokens but was able to distribute 100k tokens across 200 users regardless if they had the proper funds to do so.

Lab Follow Along Time:

We went through what might have been an overwhelming amount of concepts in this chapter regarding over/underflow scenarios now lets do an example lab in the video below to illustrate this point and get a little hands on experience reviewing, writing and exploiting smart contracts. Also note in the blockchain youtube playlist we cover the same concepts from above if you need to hear them rather then read them.

For this lab we will use the Remix browser environment with the current solidity version as of this writing 0.5.12. You can easily adjust the compiler version on Remix to this version as versions update and change frequently.
https://remix.ethereum.org/

Below is a video going through coding your own vulnerable smart contract, the video following that goes through exploiting the code you create and the videos prior to that cover the concepts we covered above:

Download Video Lab Example Code:

Download Sample Code:

CC Labs GitHub

//Underflow Example Code:

//Can you bypass the restriction?

//--------------------------------------------

pragma solidity ^0.5.12;

contract Underflow{
   mapping (address =>uint) balances;

   function contribute() public payable{
        balances[msg.sender] = msg.value;
   }

   function getBalance() view public returns (uint){
return balances[msg.sender];
   }

   function transfer(address _reciever, uint _value) public payable{
   require(balances[msg.sender] - _value >= 5);
   balances[msg.sender] = balances[msg.sender] - _value;

       balances[_reciever] = balances[_reciever] + _value;
   }

}

This next video walks through exploiting the code above, preferably hand coded by you into the remix environment. As the best way to learn is to code it yourself and understand each piece:

Conclusion:

We covered a lot of information at this point and the video series playlist associated with this blog series has additional information and walk throughs. Also other videos as always will be added to this playlist including fixing integer overflows in the code and attacking an actual live Decentralized Blockchain Application. So check out those videos as they are dropped and the current ones, sit back and watch and re-enforce the concepts you learned in this blog and in the previous lab. This is an example from a full set of labs as part of a more comprehensive exploitation course we have been working on.

Link building is the process of acquiring hyperlinks from other websites to your own website. It's a crucial aspect of search engine optimization (SEO) because search engines like Google use links as a signal of a website's authority and relevance. When authoritative websites link to your content, it sends a signal to search engines that your content is valuable and trustworthy, which can boost your website's rankings in search results.

According to a study by Ahrefs, websites with a high number of backlinks tend to rank higher in search results than those with fewer backlinks.

Link building remains a critical component of SEO strategies in 2024. A recent survey of SEO professionals by Moz found that 95% of respondents consider link building to be a "very important" or "somewhat important" factor for ranking websites. Here are a Linkedin post on how to hire a link building specialist.

Link Building Strategies

Here are some of the most effective link building strategies:

Content Marketing: Create high-quality content that other websites will naturally want to link to. This could include blog posts, infographics, videos, or other types of informative content.

Case Study: A software company increased organic traffic by 25% by publishing a series of in-depth blog posts on industry topics.

Guest Blogging: Write guest posts for other websites in your industry with links back to your own website.

Statistic: A study by Backlinko found that guest blogging can increase website traffic by an average of 20%.

Broken Link Building: Find broken links on other websites in your industry and reach out to the website owners to suggest replacing the broken link with a link to your own relevant content.
Public Relations: Generate positive press coverage and backlinks from reputable news websites and blogs.
Social Media Promotion: Share your content on social media to attract links from other users and websites.
Email Outreach: Reach out to website owners and bloggers directly to ask for links to your content.

Link Building Tools

Several link building tools can help you research backlink opportunities, track your progress, and analyze your backlink profile. Some popular options include:

Ahrefs
SEMrush
Moz
Majestic
BuzzSumo

Benefits of Link Building

Link building can provide several benefits for your website, including:

Increased search rankings
Increased website traffic
Increased brand awareness
Improved credibility and authority
Stronger relationships with other websites in your industry

Challenges of Link Building

Link building can be a challenging and time-consuming process. Some of the common challenges include:

Building high-quality links requires effort and expertise.
It can be difficult to secure links from high-authority websites.
There's a risk of being penalized by search engines for using unethical link building tactics.

Best Practices for Link Building

Here are some best practices for link building:

Focus on quality over quantity. It's better to have a few high-quality links from reputable websites than many low-quality links.
Build relationships with other website owners in your industry.
Diversify your link profile with links from a variety of websites.
Monitor your backlinks regularly for spam or low-quality links.
Avoid spammy or unethical link building tactics.
Always follow Google's Webmaster Guidelines.

Conclusion

Link building is a crucial aspect of SEO and can significantly impact your website's visibility and success in search results. By implementing a strategic and ethical link building plan, you can improve your website's rankings, drive more traffic, and boost your brand awareness.

--
You received this message because you are subscribed to the Google Groups "Broadcaster" group.
To unsubscribe from this group and stop receiving emails from it, send an email to broadcaster-news+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/broadcaster-news/c9e2ad9e-7ea5-4f29-8c62-4ae5f497c582n%40googlegroups.com.

at 3:56 AM

What Is Agility Writer?

Agility Writer is an AI-powered writing assistant that helps writers improve their productivity and the quality of their work. Launched in 2020, Agility Writer quickly gained popularity among content writers, bloggers, copywriters, and students. With its user-friendly interface and advanced features, Agility Writer is a valuable tool that can help writers create high-quality content faster and more efficiently.

Key Features of Agility Writer

Agility Writer offers a wide range of features designed to help writers create better content, including:

Real-time Feedback: Get instant feedback on your writing, including suggestions for grammar, spelling, and style.
One-Click Rewrite: Quickly rewrite sentences or paragraphs to improve clarity, conciseness, and tone.
Tone of Voice Suggestions: Choose from a variety of tone of voice suggestions to match your writing to the intended audience.
Plagiarism Checker: Scan your text for plagiarism and get suggestions for how to avoid it.
Collaboration Tools: Collaborate with other writers and editors on shared documents.
Integrations with Other Tools: Easily integrate Agility Writer with your favorite writing tools and platforms.

Benefits of Using Agility Writer

Agility Writer offers several benefits to writers, including:

Improved Writing Quality: Agility Writer's real-time feedback and one-click rewrite features help writers improve the quality and clarity of their writing.
Increased Productivity: Agility Writer's collaboration tools and integrations with other writing tools help writers save time and increase their productivity.
Reduced Errors: Agility Writer's grammar and plagiarism checkers help writers avoid errors and improve the accuracy of their writing.
Enhanced Creativity: Agility Writer's tone of voice suggestions and other creative features help writers explore new ways to express themselves and engage with their audience.

Pricing

Agility Writer offers a variety of pricing plans to suit different needs and budgets:

Free Plan: The free plan includes basic features like grammar and spell checking, as well as a limited number of rewrites and plagiarism checks.
Standard Plan: The standard plan costs $29 per month and includes all the features of the free plan, plus unlimited rewrites, plagiarism checks, and collaboration tools.
Premium Plan: The premium plan costs $49 per month and includes all the features of the standard plan, plus additional features like priority support and access to a team of writing experts.

User Reviews

Agility Writer has received positive reviews from users, with many praising its ease of use, powerful features, and ability to improve writing quality.

"Agility Writer has been a game-changer for me. It's helped me improve my writing skills and save time on editing." - John Smith, Content Writer
"I love Agility Writer's real-time feedback feature. It's like having a writing coach at my fingertips." - Mary Johnson, Blogger
"Agility Writer is the best AI writing assistant I've used. It's helped me write better copy and improve my marketing results." - Tom Brown, Copywriter

How to Use Agility Writer to Improve Your Writing

Getting started with Agility Writer is easy. Simply create an account and start using the web-based editor or download the desktop app. Once you're logged in, you can start writing or upload a document to get feedback.

Agility Writer's real-time feedback feature will highlight errors and suggest improvements as you type. You can also click the "Rewrite" button to quickly generate different versions of your text.

To use Agility Writer's collaboration tools, simply invite other users to join your document. You can then work together in real time, leaving comments and suggestions for each other.

Conclusion

Agility Writer is a powerful AI-powered writing assistant that can help writers improve their productivity and the quality of their work. With its user-friendly interface, advanced features, and affordable pricing, Agility Writer is a valuable tool for writers of all levels.

Whether you're a content writer, blogger, copywriter, or student, Agility Writer can help you write better content faster and more efficiently. Try it today and see the difference it can make in your writing.

--
You received this message because you are subscribed to the Google Groups "Broadcaster" group.
To unsubscribe from this group and stop receiving emails from it, send an email to broadcaster-news+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/broadcaster-news/d742458a-c78f-435d-bccd-39ce51dd5c7fn%40googlegroups.com.

at 3:17 AM

Water hardness can make everyday tasks a hassle. It leaves soap scum on your shower walls, creates stubborn stains on your dishes, and dries out your skin and hair. The solution? A water softener. But with so many options available, figuring out the right size for your home can be tricky.

Grains of Hardness and Grain Capacity: Breaking Down the Essentials

Water hardness is measured in grains per gallon (GPG). The higher the GPG, the harder your water.

Typical hardness levels:
- Soft: 0-3 GPG
- Slightly hard: 3-6 GPG
- Moderately hard: 6-12 GPG
- Hard: 12-18 GPG
- Very hard: 18+ GPG

Water softeners have a grain capacity, which indicates how many grains of hardness they can remove before needing to regenerate.

Factors Affecting Water Softener Size

Several factors influence the size of water softener you need:

Number of people in your household: More people mean more water usage.
Average daily water consumption: This includes showering, laundry, dishwashing, and other water-related activities.
Water hardness level: The higher the hardness, the larger the softener you'll need.

How to Calculate Grain Capacity

Here's a general formula to estimate the grain capacity you need:

Number of people in household x Average daily water usage (gallons) x Water hardness (GPG) x 7 = Grain capacity

Example: A family of four uses 80 gallons of water per day, with a water hardness of 15 GPG.

4 x 80 x 15 x 7 = 33,600 grains

They would need a softener with a grain capacity of at least 33,600.

Common Size Recommendations:

1-2 people: 20,000-30,000 grains
3-4 people: 30,000-40,000 grains
5+ people: 40,000+ grains

Additional Considerations:

Iron content: If your water has high iron levels, you may need a larger softener.
Water usage patterns: If you have periods of high water usage (e.g., frequent guests, laundry days), consider a larger softener.
Space constraints: Ensure you have adequate space for the softener and its brine tank.

Consulting a Professional for Accurate Recommendations

For the most accurate sizing recommendations, consult a water treatment professional. They can test your water hardness and assess your specific needs.

Remember, choosing the right size water softener is essential for ensuring its effectiveness and efficiency. By understanding the factors involved and following these guidelines, you can select the perfect fit for your home.

Sources:

--
You received this message because you are subscribed to the Google Groups "Broadcaster" group.
To unsubscribe from this group and stop receiving emails from it, send an email to broadcaster-news+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/broadcaster-news/f54e144d-faa7-4607-9df3-428af0a33eb4n%40googlegroups.com.

at 8:35 AM

Biodynamic gardening goes beyond organic principles to create a truly holistic approach to cultivating life. It blends science and spirituality, recognizing the interconnectedness of all elements within a garden ecosystem. By aligning with cosmic cycles and fostering a deep understanding of nature's rhythms, biodynamic gardeners strive to produce nutrient-rich food, vibrant plants, and a harmonious relationship with the environment.

I recommend that you read this Biodynamic Gardening Book - https://www.amazon.com/Biodynamic-Gardening-Composting-Preparations-Agricultural/dp/B0CLDKZ2GR

Unlocking the Secrets of Biodynamics Through Expert Guidance

Whether you're a seasoned gardener seeking a deeper connection with nature or a beginner eager to explore this sustainable practice, biodynamic gardening courses offer invaluable insights and hands-on experiences. These courses delve into:

Key Principles and Practices:

Understanding the foundations of biodynamic philosophy, developed by Rudolf Steiner in the early 20th century.
Preparing and applying biodynamic preparations, unique compost and herbal remedies that enhance soil health and plant vitality.
Working with the lunar and astrological cycles to guide planting, harvesting, and other gardening activities.
Integrating composting, cover cropping, and other regenerative techniques to build healthy soil ecosystems.
Fostering biodiversity through companion planting and pollinator habitats.
Creating a closed-loop system that minimizes waste and maximizes resource utilization.

Finding the Right Course for Your Needs

Course formats vary to accommodate different learning styles and preferences:

Online Courses:

Biodynamic Association: Online Introduction to Biodynamics
Biodynamic Agricultural College: Online Course in Biodynamic Principles and Practice

In-Person Workshops and Certification Programs:

Pfeiffer Center: Biodynamic Gardening Apprenticeship
Demeter Association: Biodynamic Farmer Training
Local farms and gardening organizations (explore options in your area)

Key Considerations When Selecting a Course:

Instructor experience and expertise in biodynamic methods
Course curriculum and alignment with your learning goals
Format and duration of the course
Location and accessibility
Cost and potential financial assistance

Benefits of Biodynamic Gardening Education:

Deepen your understanding of sustainable agriculture practices
Learn to create a thriving, self-sustaining garden ecosystem
Produce healthier, more nutritious food
Connect with a community of like-minded individuals
Enhance your connection to nature and the cosmos
Contribute to a more sustainable and regenerative food system

Ready to Embark on Your Biodynamic Journey?

Explore the courses mentioned above and connect with biodynamic organizations in your area to discover the perfect learning path. As you delve into this transformative approach to gardening, you'll not only cultivate healthier plants and ecosystems but also nourish a deeper connection with the rhythms of nature and the interconnectedness of all life.

--
You received this message because you are subscribed to the Google Groups "Broadcaster" group.
To unsubscribe from this group and stop receiving emails from it, send an email to broadcaster-news+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/broadcaster-news/9dca31d5-3a15-4765-9630-72866c6fc0ccn%40googlegroups.com.

at 8:26 AM

Biodynamic gardening is an agricultural approach that transcends conventional organic methods. It embraces a holistic philosophy that views the farm or garden as a living organism, interconnected with the cosmos and its rhythms. By working in harmony with these natural cycles, biodynamic practitioners aim to create vibrant, resilient ecosystems that produce nutrient-rich, flavorful food.

Here is the best Biodynamic Gardening book - https://www.amazon.com/Biodynamic-Gardening-Composting-Preparations-Agricultural/dp/B0CLDKZ2GR

Unlocking the Wisdom of Biodynamic Gardening Books

If you're intrigued by this transformative approach to gardening, a wealth of knowledge awaits you in biodynamic gardening books. These books offer comprehensive guidance on:

The Principles of Biodynamic Agriculture: Delve into the foundations of biodynamic philosophy, including the concept of the farm organism, the importance of soil health, and the role of cosmic influences.
Practical Techniques and Preparations: Discover hands-on methods for composting, planting, and harvesting according to biodynamic principles. Learn how to create and apply biodynamic preparations, which are unique herbal and mineral remedies used to enhance soil fertility and plant vitality.
Seasonal Rhythms and Astrological Influences: Explore how to align your gardening practices with the rhythms of the seasons and the cycles of the moon and planets.
Case Studies and Inspirational Stories: Gain insights from experienced biodynamic farmers and gardeners, and find inspiration in their successes and challenges.

Essential Reads for Your Biodynamic Journey

Here are five books that stand out as exceptional resources for aspiring biodynamic gardeners:

Biodynamic Gardening by Monty Waldin (DK Publishing) - This comprehensive guide offers a clear and practical introduction to biodynamic gardening, covering everything from soil preparation to pest control.
Gardening for Life: The Biodynamic Way by Maria Thun (Floris Books) - Thun's classic text delves into the astrological influences on gardening and provides detailed planting calendars based on moon phases.
The Biodynamic Orchard by Ehrenfried Pfeiffer and Michael Maltas (Acres USA) - Learn how to apply biodynamic principles to fruit trees in this in-depth guide.
Moon Gardening by Matt Jackson (Chelsea Green Publishing) - Discover how to harness the power of the moon to enhance your gardening efforts.
What Is Biodynamics?: A Way to Heal and Revitalize the Earth by Rudolf Steiner (SteinerBooks) - Explore the origins of biodynamic agriculture in this foundational work by its founder.

Embarking on Your Biodynamic Journey

Whether you're a seasoned gardener seeking a deeper connection to nature or a newcomer eager to explore a more sustainable approach, biodynamic gardening books offer a path to a fulfilling and transformative gardening experience. Through their pages, you'll discover a world where gardening becomes a practice of reverence for the interconnectedness of all life.

--
You received this message because you are subscribed to the Google Groups "Broadcaster" group.
To unsubscribe from this group and stop receiving emails from it, send an email to broadcaster-news+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/broadcaster-news/e9eb615a-8dc4-407e-bc67-8ed33c5256ban%40googlegroups.com.