|
|
sábado, 9 de maio de 2020
October 2019 Connector
sexta-feira, 8 de maio de 2020
CEH: 10 Hacking Tools For Hackers
There are a lot of hacking tools available over the internet but mostly we need some of them. In this blog you'll learn about hacking tools which are typically used in the world of hacking by penetration testers.
SmartWhois
SmartWhois is an information-gathering program that allows you to find all available information about an IP address, hostname, or domain, including country, state or province, city, name of the network provider, administrator, and technical support contact information. SmartWhois is a graphical version of the basic Whois program.SocksChain
SocksChain is a tool that gives a hacker the ability to attack through a chain of proxy servers. The main purpose of doing this is to hide the hacker's real IP address and therefore minimize the chance of detection. When a hacker works through several proxy servers in series, it's much harder to locate the hacker. Tracking the attacker's IP address through the logs of several proxy servers is complex and tedious work. If one of the proxy servers' log files is lost or incomplete, the chain is broken, and the hacker's IP address remains anonymous.NeoTrace, VisualRoute, and VisualLookout
NeoTrace, VisualRoute, and VisualLookout are all packet-tracking tools with a GUI or visual interface. They plot the path the packets travel on a map and can visually identify the locations of routers and other internet working devices. These tools operate similarly to traceroute and perform the same information gathering; however, they provide a visual representation of the results.Visualware's eMailTrackerPro
Visualware's eMailTrackerPro ( www.emailtrackerpro.com/ ) and MailTracking ( http://mailtracking.com/ ) are tools that allow an ethical hacker to track email messages. When you use these tools to send an email, forward an email, reply to an email, or modify an email, the resulting actions and tracks of the original email are logged. The sender is notified of all actions performed on the tracked email by an automatically generated email.IPEye
IPEye is a TCP port scanner that can do SYN, FIN, Null, and XMAS scans. It's a command line tool.IPEye probes the ports on a target system and responds with closed, reject, drop, or open. Closed means there is a computer on the other end, but it doesn't listen at the port. Reject means a firewall is rejecting the connection to the port (sending a reset back). Drop means a firewall is dropping everything to the port, or there is no computer on the other end. Open means some kind of service is listening at the port. These responses help a hacker identify what type of system is responding.
IPSecScan
IPSecScan is a tool that can scan either a single IP address or a range of addresses looking for systems that are IPSec enabled that means the system has IPSec enabled while disabled means that it either has IPSec disabled, the compatibility issue or the configuration issue that not reveal to you that it has IPSec enabled. Indeterminable means that the scanner isn't sure if IPSec is enabled or disabled.Icmpenum
Icmpenum uses not only ICMP Echo packets to probe networks, but also ICMP Timestamp and ICMP Information packets. Furthermore, it supports spoofing and sniffing for reply packets. Icmpenum is great for scanning networks when the firewall blocks ICMP Echo packets but fails to block Timestamp or Information packets.SNMP Scanner
SNMP Scanner allows you to scan a range or list of hosts performing ping, DNS, and Simple Network Management Protocol (SNMP) queries. This tool helps you to find out the current information about the device of SNMP nodes in the given network.hping2 tool
The hping2 tool is notable because it contains a host of other features besides OS fingerprinting such as TCP, User Datagram Protocol (UDP), ICMP, and raw-IP ping protocols, traceroute mode, and the ability to send files between the source and target system.THC-Scan, PhoneSweep, and TeleSweep
THC-Scan, PhoneSweep, and TeleSweep are tools that identify phone numbers and can dial a target to make a connection with a computer modem. These tools generally work by using a predetermined list of common usernames and passwords in an attempt to gain access to the system. Most remote-access dial-in connections aren't secured with a password or use very rudimentary security.Read moreHow To Connect Database With PHP | Cool Interface Software | Tutorial 2
Welcome to my 2nd tutorial of PHP and MYSQL. In the previous video I've discussed How to download and install a server PHP and also How to create databases and How to create tables in the databases in the form of rows and columns.
In this video I've discussed multiple ways to connect database with PHP such as by using variables etc. First of all you have need to install a cool interface software for coding. I suggested you to download any one of them such as Dreamweaver, Notepad++, Sublime Text Editor and Atom etc. I'm using sublime text editor in this series of tutorial.
Syntax of PHP
<?php
//type here the code
?>
How to save the PHP file
You should save your PHP file in the root directory of the server. In XAMPP the "htdocs" is the root directory of the server. In WAMPP "www" is the root directory. Now how to save the file?
Step 1:
Press CTRL + S button to safe the file.
Step 2:
Go to the server location where it has been installed. By default it is installed in Local Disk C. Got C drive.
Step 3:
Go to XAMPP directory.
Step 4:
Go to htdocs diretory.
Step 5:
Save a file there with extension ".php". You can create a different folders for different projects in htdocs directory. So first create the folder in htdocs and then save your files in the folder.
How to Run PHP Script
Step 1:
Open a XAMPP control panel and start Apache and Mysql services.
Step 2:
Open your web browser.
Step 3:
Type localhost/yourFolderName/yourFileName.php and hit enter. For example: localhost/myFolder/index.php.
Read more
quinta-feira, 7 de maio de 2020
Warning: Citrix ShareFile Flaw Could Let Attackers Steal Corporate Secrets
Since the past few weeks, software giant Citrix has privately been rolling out a critical software update to its enterprise customers that patches multiple security vulnerabilities affecting Citrix ShareFile content collaboration platform. The security advisory—about which The Hacker News learned from Dimitri van de Giessen, an ethical hacker and system engineer—is scheduled to be available
via The Hacker NewsMore articles
via The Hacker NewsMore articles
quarta-feira, 6 de maio de 2020
Save Your Cloud: Gain Root Access To VMs In OpenNebula 4.6.1
In this post, we show a proof-of-concept attack that gives us root access to a victim's VM in the Cloud Management Platform OpenNebula, which means that we can read and write all its data, install software, etc. The interesting thing about the attack is, that it allows an attacker to bridge the gap between the cloud's high-level web interface and the low-level shell-access to a virtual machine.
Like the latest blogpost of this series, this is a post about an old CSRF- and XSS-vulnerability that dates back to 2014. However, the interesting part is not the vulnerability itself but rather the exploit that we were able to develop for it.
An attacker needs the following information for a successful attack.
The following sections give detailed information about each step.
When a user updates the language setting, the browser sends an XMLHttpRequest of the form
An HTML form field like
Using this trick, the attacker sets the LANG parameter for the victim's account to "onerror=[remote code]//, where [remote code] is the attacker's exploit code. The attacker can either insert the complete exploit code into this parameter (there is no length limitation) or include code from a server under the attacker's control. Once the user reloads Sunstone, the server delivers HTML code to the client that executes the attacker's exploit.
From this point on, the attacker can use the Sunstone API with the privileges of the victim. This way, the attacker can gather all required information like OpenNebula's internal VM ID and the keyboard layout of the VM's operating system from Sunstone's data-structures based on the name or the IP address of the desired VM.
Once the noVNC-iFrame has loaded, the attacker can send keystrokes to the VM using the dispatchEvent function. Keystrokes on character keys can be simulated using keypress events. Keystrokes on special keys (Enter, Tab, etc.) have to be simulated using pairs of keydown and keyup events since noVNC filters keypress events on special keys.
Even if the bootloader is unknown, it is possible to use a try-and-error approach. Since the variety of bootloaders is small, one can try for one particular bootloader and reset the machine if the attack was unsuccessful. Alternatively, one can capture a screenshot of the noVNC canvas of the VM a few seconds after resetting the VM and determine the bootloader.
A video of the attack can be seen here. The browser on the right hand side shows the victim's actions. A second browser on the left hand side shows what is happening in OpenNebula. The console window on the bottom right shows that there is no user-made keyboard input while the attack is happening.
This bug has been fixed in OpenNebula 4.6.2.
This result is a collaborative work together with Mario Heiderich. It has been published at ACM CCSW 2015. The paper can be found here.
Like the latest blogpost of this series, this is a post about an old CSRF- and XSS-vulnerability that dates back to 2014. However, the interesting part is not the vulnerability itself but rather the exploit that we were able to develop for it.
An attacker needs the following information for a successful attack.
- ID of the VM to attack
OpenNebula's VM ID is a simple global integer that is increased whenever a VM is instantiated. The attacker may simply guess the ID. Once the attacker can execute JavaScript code in the scope of Sunstone, it is possible to use OpenNebula's API and data structures to retrieve this ID based on the name of the desired VM or its IP address. - Operating system & bootloader
There are various ways to get to know a VMs OS, apart from simply guessing. For example, if the VM runs a publicly accessible web server, the OS of the VM could be leaked in the HTTP-Header Server (see RFC 2616). Another option would be to check the images or the template the VM was created from. Usually, the name and description of an image contains information about the installed OS, especially if the image was imported from a marketplace.
Since most operating systems are shipped with a default bootloader, making a correct guess about a VMs bootloader is feasible. Even if this is not possible, other approaches can be used (see below). - Keyboard layout of the VM's operating system
As with the VMs bootloader, making an educated guess about a VM's keyboard layout is not difficult. For example, it is highly likely that VMs in a company's cloud will use the keyboard layout of the country the company is located in.
Overview of the Attack
The key idea of this attack is that neither Sunstone nor noVNC check whether keyboard related events were caused by human input or if they were generated by a script. This can be exploited so that gaining root access to a VM in OpenNebula requires five steps:- Using CSRF, a persistent XSS payload is deployed.
- The XSS payload controls Sunstone's API.
- The noVNC window of the VM to attack is loaded into an iFrame.
- The VM is restarted using Sunstone's API.
- Keystroke-events are simulated in the iFrame to let the bootloader open a root shell.
 |
| Figure 1: OpenNebula's Sunstone Interface displaying the terminal of a VM in a noVNC window. |
The following sections give detailed information about each step.
Executing Remote Code in Sunstone
In Sunstone, every account can choose a display language. This choice is stored as an account parameter (e.g. for English LANG=en_US). In Sunstone, the value of the LANG parameter is used to construct a <script> tag that loads the corresponding localization script. For English, this creates the following tag:<script src="locale/en_US/en_US.js?v=4.6.1" type="text/javascript"></script>Setting the LANG parameter to a different string directly manipulates the path in the script tag. This poses an XSS vulnerability. By setting the LANG parameter to LANG="onerror=alert(1)//, the resulting script tag looks as follows:
<script src="locale/"onerror=alert(1)///"onerror=alert(1)//.js?v=4.6.1" type="text/javascript"></script>For the web browser, this is a command to fetch the script locale/ from the server. However, this URL points to a folder, not a script. Therefore, what the server returns is no JavaScript. For the browser, this is an error, so the browser executes the JavaScript in the onerror statement: alert(1). The rest of the line (including the second alert(1)) is treated as comment due to the forward slashes.
When a user updates the language setting, the browser sends an XMLHttpRequest of the form
{ "action" : { "perform" : "update", "params" : { "template_raw" : "LANG=\"en_US\"" } }}to the server (The original request contains more parameters. Since these parameters are irrelevant for the technique, we omitted them for readability.). Forging a request to Sunstone from some other web page via the victim's browser requires a trick since one cannot use an XMLHttpRequest due to restrictions enforced by the browser's Same-Origin-Policy. Nevertheless, using a self-submitting HTML form, the attacker can let the victim's browser issue a POST request that is similar enough to an XMLHttpRequest so that the server accepts it.
An HTML form field like
<input name='deliver' value='attacker' />is translated to a request in the form of deliver=attacker. To create a request changing the user's language setting to en_US, the HTML form has to look like
<input name='{"action":{"perform":"update","params":{"template_raw":"LANG' value='\"en_US\""}}}' />Notice that the equals sign in LANG=\"en_US\" is inserted by the browser because of the name=value format.
 |
| Figure 2: OpenNebula's Sunstone Interface displaying a user's attributes with the malicious payload in the LANG attribute. |
Using this trick, the attacker sets the LANG parameter for the victim's account to "onerror=[remote code]//, where [remote code] is the attacker's exploit code. The attacker can either insert the complete exploit code into this parameter (there is no length limitation) or include code from a server under the attacker's control. Once the user reloads Sunstone, the server delivers HTML code to the client that executes the attacker's exploit.
Prepare Attack on VM
Due to the overwritten language parameter, the victim's browser does not load the localization script that is required for Sunstone to work. Therefore, the attacker achieved code execution, but Sunstone breaks and does not work anymore. For this reason, the attacker needs to set the language back to a working value (e.g. en_US) and reload the page in an iFrame. This way Sunstone is working again in the iFrame, but the attacker can control the iFrame from the outside. In addition, the attack code needs to disable a watchdog timer outside the iFrame that checks whether Sunstone is correctly initialized.From this point on, the attacker can use the Sunstone API with the privileges of the victim. This way, the attacker can gather all required information like OpenNebula's internal VM ID and the keyboard layout of the VM's operating system from Sunstone's data-structures based on the name or the IP address of the desired VM.
Compromising a VM
Using the Sunstone API the attacker can issue a command to open a VNC connection. However, this command calls window.open, which opens a new browser window that the attacker cannot control. To circumvent this restriction, the attacker can overwrite window.open with a function that creates an iFrame under the attacker's control.Once the noVNC-iFrame has loaded, the attacker can send keystrokes to the VM using the dispatchEvent function. Keystrokes on character keys can be simulated using keypress events. Keystrokes on special keys (Enter, Tab, etc.) have to be simulated using pairs of keydown and keyup events since noVNC filters keypress events on special keys.
Getting Root Access to VM
To get root access to a VM the attacker can reboot a victim's VM using the Sunstone API and then control the VM's bootloader by interrupting it with keystrokes. Once the attacker can inject commands into the bootloader, it is possible to use recovery options or the single user mode of Linux based operating systems to get a shell with root privileges. The hardest part with this attack is to get the timing right. Usually, one only has a few seconds to interrupt a bootloader. However, if the attacker uses the hard reboot feature, which instantly resets the VM without shutting it down gracefully, the time between the reboot command and the interrupting keystroke can be roughly estimated.Even if the bootloader is unknown, it is possible to use a try-and-error approach. Since the variety of bootloaders is small, one can try for one particular bootloader and reset the machine if the attack was unsuccessful. Alternatively, one can capture a screenshot of the noVNC canvas of the VM a few seconds after resetting the VM and determine the bootloader.
A video of the attack can be seen here. The browser on the right hand side shows the victim's actions. A second browser on the left hand side shows what is happening in OpenNebula. The console window on the bottom right shows that there is no user-made keyboard input while the attack is happening.
This bug has been fixed in OpenNebula 4.6.2.
This result is a collaborative work together with Mario Heiderich. It has been published at ACM CCSW 2015. The paper can be found here.
More information
WiFi Hacking On Tablets
Disclaimer: Don't hack anything where you don't have the authorization to do so. Stay legal.
Ever since I bought my first Android device, I wanted to use the device for WEP cracking. Not because I need it, but I want it :) After some googling, I read that you can't use your WiFi chipset for packet injection, and I forgot the whole topic.
After a while, I read about hacking on tablets (this was around a year ago), and my first opinion was:
Ever since I bought my first Android device, I wanted to use the device for WEP cracking. Not because I need it, but I want it :) After some googling, I read that you can't use your WiFi chipset for packet injection, and I forgot the whole topic.
After a while, I read about hacking on tablets (this was around a year ago), and my first opinion was:
"This is stupid, lame, and the usage of that can be very limited".
After playing one day with it, my opinion just changed:
"This is stupid, lame, the usage is limited, but when it works, it is really funny :-)"
At the beginning I looked at the Pwn Pad as a device that can replace a pentest workstation, working at the attacker side. Boy was I wrong. Pwn Pad should be used as a pentest device deployed at the victim's side!
At the beginning I looked at the Pwn Pad as a device that can replace a pentest workstation, working at the attacker side. Boy was I wrong. Pwn Pad should be used as a pentest device deployed at the victim's side!
You have the following options:
- You have 1095 USD + VAT + shipping to buy this Pwn Pad
- You have around 200 USD to buy an old Nexus 7 tablet, a USB OTG cable, a USB WiFi dongle (e.g. TP-Link Wireless TL-WN722N USB adapter works).
In my example, I bought a used, old 2012 Nexus WiFi. Originally I bought this to play with different custom Android ROMs, and play with rooted applications. After a while, I found this Pwn Pad hype again and gave it a shot.
The Pwn Pad community edition has an easy-to-use installer, with a proper installation description. Don't forget to backup everything from your tablet before installing Pwn Pad on it!
I don't want to repeat the install guide, it is as easy as ABC. I booted a Ubuntu Live CD, installed adb and fastboot, and it was ready-to-roll. I have not measured the time, but the whole process was around 20 minutes.
The internal WiFi chipset can be used to sniff traffic or even ARP poisoning for active MiTM. But in my case, I was not able to use the internal chipset for packet injection, which means you can't use it for WEP cracking, WPA disauth, etc. This is where the external USB WiFi comes handy. And this is why we need the Pwn Pad Android ROM, and can't use an average ROM.
There are two things where Pwn Pad really rocks. The first one is the integrated drivers for the external WiFi with monitor mode and packet injection capabilities. The second cool thing is the chroot wrapper around the Linux hacking tools. Every hacking tool has a start icon, so it feels like it is a native Android application, although it is running in a chroot Kali environment.
Wifite
The first recommended app is Wifite. Think of it as a wrapper around the aircrack - airmon - airodump suite. My biggest problem with WEP cracking was that I had to remember a bunch of commands, or have the WEP cracking manual with me every time I have to crack it. It was overcomplicated. But thanks to Wifite, that is past.
In order to crack a WEP key, you have to:
- Start the Wifite app
- Choose your adapter (the USB WiFi)
- Choose the target network (wep_lan in the next example)
- Wait for a minute
- PROFIT!
SSH reverse shell
This is one of the key functionalities of the Pwn Pad. You deploy the tablet at the Victim side, and let the tablet connect to your server via (tunneled) SSH.The basic concept of the reverse shells are that an SSH tunnel is established between the Pwn Pad tablet (client) and your external SSH server (either directly or encapsulated in other tunneling protocol), and remote port forward is set up, which means on your SSH server you connect to a localport which is forwarded to the Pwn Pad and handled by the Pwn Pad SSH server.
I believe the best option would be to use the reverse shell over 3G, and let the tablet connect to the victim network through Ethernet or WiFi. But your preference might vary. The steps for reverse shells are again well documented in the documentation, except that by default you also have to start the SSH server on the Pwn Pad. It is not hard, there is an app for that ;-) On your external SSH server you might need to install stunnel and ptunnel if you are not using Kali. The following output shows what you can see on your external SSH server after successful reverse shell.
root@myserver:/home/ubuntu# ssh -p 3333 pwnie@localhost
The authenticity of host '[localhost]:3333 ([127.0.0.1]:3333)' can't be established.
ECDSA key fingerprint is 14:d4:67:04:90:30:18:a4:7a:f6:82:04:e0:3c:c6:dc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '[localhost]:3333' (ECDSA) to the list of known hosts.
pwnie@localhost's password:
_____ ___ _ ___ ___ _____ _____ ___ ___ ___ ___
| _ \ \ / / \| |_ _| __| | __\ \/ / _ \ _ \ __/ __/ __|
| _/\ \/\/ /| .` || || _| | _| > <| _/ / _|\__ \__ \
|_| \_/\_/ |_|\_|___|___| |___/_/\_\_| |_|_\___|___/___/
Release Version: 1.5.5
Release Date: 2014-01-30
Copyright 2014 Pwnie Express. All rights reserved.
By using this product you agree to the terms of the Rapid Focus
Security EULA: http://pwnieexpress.com/pdfs/RFSEULA.pdf
This product contains both open source and proprietary software.
Proprietary software is distributed under the terms of the EULA.
Open source software is distributed under the GNU GPL:
http://www.gnu.org/licenses/gpl.html
pwnie@localhost:~$
Now you have a shell on a machine that is connected to the victim network. Sweet :) Now Metasploit really makes sense on the tablet, and all other command-line tools.
EvilAP and DSniff
Start EvilAP (it is again a wrapper around airobase), choose interface (for me the Internal Nexus Wifi worked), enter an SSID (e.g freewifi), enter channel, choose whether force all clients to connect to you or just those who really want to connect to you, and start.
The next step is to start DSniff, choose interface at0, and wait :) In this example, I used a popular Hungarian webmail, which has a checkbox option for "secure" login (with default off). There are sooo many problems with this approach, e.g. you can't check the certificate before connecting, and the login page is delivered over HTTP, so one can disable the secure login checkbox seamlessly in the background, etc. In this case, I left the "secure" option on default off.
In the next tutorial, I'm going to show my next favorite app, DSploit ;)
Lessons learned
Hacking has been never so easy beforeIn a home environment, only use WPA2 PSK
Choose a long, nondictionary passphrase as the password for WPA2
Don't share your WiFi passwords with people you don't trust, or change it when they don't need it anymore
Don't let your client device auto-connect to WiFi stations, even if the SSID looks familiar
I believe during an engagement a Pwn Plug has better "physical cloaking" possibilities, but playing with the Pwn Pad Community Edition really gave me fun moments.
And last but not least I would like to thank to the Pwn Pad developers for releasing the Community Edition!
Related articlesAnd last but not least I would like to thank to the Pwn Pad developers for releasing the Community Edition!
terça-feira, 5 de maio de 2020
HiddenWasp Linux Malware Backdoor Samples
Here are Hidden Wasp Linux backdoor samples.
Enjoy
Reference
Intezer HiddenWasp Malware Stings Targeted Linux Systems
Download
File informatio
8914fd1cfade5059e626be90f18972ec963bbed75101c7fbf4a88a6da2bc671b
8f1c51c4963c0bad6cf04444feb411d7
shell
f321685342fa373c33eb9479176a086a1c56c90a1826a0aef3450809ffc01e5d
52137157fdf019145d7f524d1da884d7
elf
f38ab11c28e944536e00ca14954df5f4d08c1222811fef49baded5009bbbc9a2
ba02a964d08c2afe41963bf897d385e7
shell
e9e2e84ed423bfc8e82eb434cede5c9568ab44e7af410a85e5d5eb24b1e622e3
cbcda5c0dba07faced5f4641aab1e2cd
elf shared-lib
d66bbbccd19587e67632585d0ac944e34e4d5fa2b9f3bb3f900f517c7bbf518b
2b13e6f7d9fafd2eca809bba4b5ea9a6
64bits elf shared-lib
2ea291aeb0905c31716fe5e39ff111724a3c461e3029830d2bfa77c1b3656fc0
568d1ebd8b6fb17744d3c70837e801b9
shell
8e3b92e49447a67ed32b3afadbc24c51975ff22acbd0cf8090b078c0a4a7b53d
33c3f807caea64293add29719596f156
shell
609bbf4ccc2cb0fcbe0d5891eea7d97a05a0b29431c468bf3badd83fc4414578
71d78c97eb0735ec6152a6ff6725b9b2
tar-bundle gzip contains-elf
d596acc70426a16760a2b2cc78ca2cc65c5a23bb79316627c0b2e16489bf86c0
6d1cd68384de9839357a8be27894182b
tar-bundle gzip
0fe1248ecab199bee383cef69f2de77d33b269ad1664127b366a4e745b1199c8
5b134e0a1a89a6c85f13e08e82ea35c3
64bits elf
Amnesia / Radiation Linux Botnet Targeting Remote Code Execution In CCTV DVR Samples
2016-08-11 CyberX Radiation IoT Cybersecurity campaign
Download
Hashes
| MD5 | SHA256 | SHA1 |
|---|---|---|
| 74bf554c4bc30d172cf1d73ac553d766 | 06d30ba7c96dcaa87ac584c59748708205e813a4dffa7568c1befa52ae5f0374 | 3c40221177383da576b11a0b3f6b35d68a9cde74 |
| 5dd9056e5ab6a92e61822b6c04afd346 | 10aa7b3863f34d340f960b89e64319186b6ffb5d2f86bf0da3f05e7dbc5d9653 | c865dd67853a24fd86ef74b05140827c1d5fd0bd |
| 2b486466f4d3e30f7b22d0bc76cb68f9 | 175fe89bbc8e44d45f4d86e0d96288e1e868524efa260ff07cb63194d04ea575 | ed62f6d1588bea33c20ababb42c02662d93d6015 |
| 3411bb2965f4c3d52c650aff04f48e52 | 1d8bc81acbba0fc56605f60f5a47743491d48dab43b97a40d4a7f6c21caca12a | 1e0281178b4a9d8dec74f50a7850867c87837435 |
| 34f915ac414e9aad2859217169f9a3aa | 2f9cd1d07c535aae41d5eed1f8851855b95b5b38fb6fe139b5f1ce43ed22df22 | d66f1e47c983a8d30ad7fd30cd08db8cd29a92b0 |
| 59e08f2ce1c3e55e2493baf36c1ad3c6 | 327f24121d25ca818cf8414c1cc704c3004ae63a65a9128e283d64be03cdd42e | 90d45b81e9a97ddcc9911122f4e8fd439ccc8fa9 |
| f4bc173bf80d922da4e755896af0db61 | 37b2b33a8e344efcaca0abe56c6163ae64026ccef65278b232a9170ada1972af | fab32f8c3ce3a837e80a1d98ada41a5bf39b01e7 |
| a253273e922ce93e2746a9791798e3fe | 3a595e7cc8e32071781e36bbbb680d8578ea307404ec07e3a78a030574da8f96 | 99cfdec405f6a9f43d58b1856fce7ca3445395d3 |
| 335e322c56278e258e4d7b5e17ad98e6 | 4313af898c5e15a68616f8c40e8c7408f39e0996a9e4cc3e22e27e7aeb2f8d54 | 504022707609a0fec9cbb21005cb0875be2a4726 |
| 93522e5f361a051f568bd1d74d901d30 | 46ea20e3cf34d1d4cdfd797632c47396d9bdc568a75d550d208b91caa7d43a9b | e7fc96b2a92888572de2539f227c9a6625449f83 |
| c86af536d87c1e5745e7d8c9f44fd25d | 4b0feb1dd459ade96297b361c69690ff69e97ca6ee5710c3dc6a030261ba69e0 | 6ef69a683913ae650634aedc40af8d595c45cb4f |
| 90c7c5e257c95047dbf52bbfbe011fd6 | 4db9924decd3e578a6b7ed7476e499f8ed792202499b360204d6f5b807f881b8 | 1c3a9be6ae9300aaad00fb87d5407ed6e84ec80b |
| 7c0528e54b086e5455ef92218ea23d03 | 5e6896b39c57d9609dc1285929b746b06e070886809692a4ac37f9e1b53b250c | 868abc912ff2fdcd733ff1da87e48e7d4c288a73 |
| 6405b42d2c7e42244ac73695bb7bfe6b | 64f03fff3ed6206337332a05ab9a84282f85a105432a3792e20711b920124707 | 173aca65181c8da84e062c803a43a404ad49302d |
| 6441157813de77d9849da5db9987d0bb | 6b2885a4f8c9d84e5dc49830abf7b1edbf1b458d8b9d2bafb680370106f93bc3 | 92dff9bdb31d3b9480d9e5f72a307715859dd094 |
| 614ea66b907314398cc14b3d2fdebe79 | 6b29b65c3886b6734df788cfc6628fbee4ce8921e3c0e8fc017e4dea2da0fd0b | c7e71c42d391f9c69375505dbf3767ba967f9103 |
| 00fe3120a666a85b84500ded1af8fb61 | 885dce73237c4d7b4d481460baffbd5694ab671197e8c285d53b551f893d6c09 | 342ed67e08d16ab982a4012fcecdca060a5da46b |
| 5477de039f7838dea20d3be1ae249fcb | 886136558ec806da5e70369ee22631bfb7fa06c27d16c987b6f6680423bc84b0 | 5b19202b45e5a58cadec8c2efa40fd924b64177d |
| 91bf10249c5d98ea6ae11f17b6ef0970 | 8f57ec9dfba8cf181a723a6ac2f5a7f50b4550dd33a34637cf0f302c43fd0243 | 682dab9ec3ff0b629cce4e16c9c74171dd2551d4 |
| fb0a7e12d2861e8512a38a6cdef3ddf0 | 9351ee0364bdbb5b2ff7825699e1b1ee319b600ea0726fd9bb56d0bd6c6670cb | c077c490bb22df9886475dc5bedfc6c032061024 |
| 9b7f5a1228fa66cbd35e75fb774fdc8e | 9c7a5239601a361b67b1aa3f19b462fd894402846f635550a1d63bee75eab0a2 | ae89bc6c5cc1818b3136a40961462327c3dececc |
| 5b97d54dc5001eb7cf238292405070a6 | a010bf82e2c32cba896e04ec8dbff58e32eee9391f6986ab22c612165dad36a0 | 96d2194f5f3927de75605f6ca6110fe683383a01 |
| 642f523bb46c2e901416047dca1c5d4e | ad65c9937a376d9a53168e197d142eb27f04409432c387920c2ecfd7a0b941c8 | bbf667213a446bc9bc4a5a2e54e7391752e3a9b8 |
| c617655312c573ecb01d292b320fff2e | aeb480cf01696b7563580b77605558f9474c34d323b05e5e47bf43ff16b67d6a | de102a6f35e08f18aa0c58358f5b22871eb0a45f |
| c8835a3d385162ae02bd4cb6c5ebac87 | b113ec41cc2fd9be9ac712410b9fd3854d7d5ad2dcaac33af2701102382d5815 | 831eb9cf0dcd57a879c04830e54a3b85fe5d6229 |
| 1497740fa8920e4af6aa981a5b405937 | b13014435108b34bb7cbcef75c4ef00429b440a2adf22976c31a1645af531252 | 8d6b90f0b88b1ad5dcc87d377e6a82dc6ac64211 |
| 5e925e315ff7a69c2f2cf1556423d5af | b3d0d0e2144bd1ddd27843ef65a2fce382f6d590a8fee286fda49f8074711545 | 64fe900b3a2b030c28211404afa45703c6869dea |
| 951ec487fb3fece58234677d7fe3e4dc | bdefa773e3f09cdc409f03a09a3982f917a0cc656b306f0ece3dd1a2564a8772 | 0b03d9471522590530dd90ad30b2d235ec98b578 |
| 3e84998197fc25cbac57870e3cdeb2de | c03b403d5de9778a2ec5949d869281f13976c2fc5b071e0f5f54277680c80902 | 0b9eb6d931dc6b226a913e89bb422f58228de0d0 |
| c3a73d24df62057e299b6af183889e6b | cb2382b818993ef6b8c738618cc74a39ecab243302e13fdddb02943d5ba79483 | 6a683ef6f7653e5ee64969cbbbe4403601ae9ded |
| d428f50a0f8cd57b0d8fe818ace6af20 | ce61dcfc3419ddef25e61b6d30da643a1213aa725d579221f7c2edef40ca2db3 | 9bd832256b94e43546dfb77532f6d70fcd1ce874 |
| e1d6d4564b35bb19d2b85ca620d7b8f2 | d0bda184dfa31018fe999dfd9e1f99ca0ef502296c2cccf454dde30e5d3a9df9 | c1af00d3263893b5d23dbf38015fe3c6a92cefaf |
| e9502ae7b0048b9ea25dd7537818904c | e7d6b3e1fba8cdf2f490031e8eb24cd515a30808cdd4aa15c2a41aa0016f8082 | 0e080ac0130ab3f7265df01b8397e4abd13c38cb |
| 8eb34e1fb7dd9d9f0e1fef2803812759 | eb54dc959b3cc03fbd285cef9300c3cd2b7fe86b4adeb5ca7b098f90abb55b8a | 5310a99f0f8c92bfa2f8da87e60c645f2cae305a |
| ca0fc25ce066498031dc4ca3f72de4b8 | f23fecbb7386a2aa096819d857a48b853095a86c011d454da1fb8e862f2b4583 | 7f4d97eea294fc567b058b09cc915be56c2a80e1 |
| 5a2fcfff8d6aab9a0abe9ca97f6093ed | f6af2fa4f987df773d37d9bb44841a720817ce3817dbf1e983650b5af9295a16 | f4ddf49fbf23edb23f50be62637a4a688e352057 |
| ed98e8fa385b39ca274e0de17b1007e6 | f7a737cb73802d54f7758afe4f9d0a7d2ea7fda4240904c0a79abae732605729 | a69d4c2b88bfe3a06245f8fbfb8abe5e9a894cec |
| 320db5f1230fcfe0672c8515eb9ddcfc | f7cf1e0d7756d1874630d0d697c3b0f3df0632500cff1845b6308b11059deb07 | 8d40dbf34a02dd43a81e5cdc58a0b11bfa9f5663 |
| 18d6af9211d0477f9251cf9524f898f3 | f97848514b63e9d655a5d554e62f9e102eb477c5767638eeec9efd5c6ad443d8 | b0e76be186fd609d5a8a33d59d16ffa3bdab1573 |
Related articles
sexta-feira, 1 de maio de 2020
2018-2019: A Playtesting Retrospective
Back in late 2017 I started formally tracking my weekly playtest sessions in a google doc. One up-side of this is that I can go back now and review what was played each week, by whom, and what aspect I was looking to test that day. It's also interesting to see how much time we dedicated to each game, or how much time passed in between playtests of a game.
I'd like to use this post as a sort of retrospective on the last two years (or 28 months) of playtesting. Let's take a little trip down memory lane...
2017
Late August 2017 was the first session I'd logged, and that day we were evaluating 3 games I'd brought home from GenCon for TMG: Margrave, by Stan Kordonskiy, which turned into Old West Empresario, Rolled West, by Daniel Newman, and Embark, by Philip duBarry. Not only did we end up signing each of these, but all three are on store shelves now!
In September of that year we continued evaluating games: Pixel Factory was a neat one, but ultimately TMG did not sign it. Back to Earth was also neat, and we did sign it, but due to unrelated circumstances we ended up releasing it later. Railways is a game by some British designer friends of mine, and I liked it, but it needed some work. We did suggest the new title: Railblazers. My understanding is that at this point it has improved greatly, but the main mechanism which I was interested in (like the Mancala-rondel in Crusaders) has changed completely.
October saw us switch gears a bit. We spent a lot of time playing my games: Eminent Domain Origins (a Terra Prime reboot) and Eminent Domain: Chaos Theory (a dice game version of EmDo -- I should add those to the BGG database). This went on into November as well.
December was spent almost entirely on a dozen games of Embark, which had been signed by that point. I also see a lone play of Eminent Domain Origins at about Christmas time.
2018
We started off the new year with 2 more games of EDO, but then spent the rest of January, February, March, and half of April playing about 3 dozen (!) games of Old West Empresario, working on game balance and player powers. The only other playtests in those months were a few games of Harvest to test some potential expansion characters (unfortunately, we never did do an expansion to Harvest).
Late April through mid-May we tested the Crusaders: Divine Influence expansion, which was in pretty good shape to begin with, but we hammered out a few details. That one has now been printed, and is about to ship from the manufacturer in China and should be out later this year.
My son was born at the end of May, and my playtest sessions went on hiatus. The only other testing that happened in 2018 was at Rincon -- Michael was in town and we played a game of Deities & Demigods (now Olympus on the Serengeti), and several games of Imminent Domain (now Sails & Sorcery, but that title might not be final either), which is the game Michael designed based on the deck learning of Eminent Domain and the area control of El Grande.
2019
After an extended hiatus, I finally got back to regular playtest sessions in February of 2019, and we spent that first month back playing Eminent Domain Origins some more, fine tuning some last details.
March was spent on Emperor's Choice. TMG is doing a Deluxified version of that game, and we developed a 2 player variant which went over well with Richard Ham of Rahdo Runs Through, who famously only plays games with his wife.
April and May were dedicated almost entirely to developing Sails & Sorcery, changing up the format so it would play better, but keeping the core ideas of the game.
June was spent working on a new design of mine, Apotheosis. We iterated through several big changes as we quickly honed in on what worked and what didn't.
We started out July with a quick couple tests of a 5/6 player expansion to Crusaders. This worked out well, and we've got art done, but this won't come out until October. Then it was back to Sails & Sorcery through August. Most of the game was pretty solid by that point, but we were trying to fix this one niggling dynamic that just didn't work right.
We switched gears again and spent September and half of October playing Alter Ego, my co-operative deck learning game. We played quite a few games considering that one of my main testers doesn't like co-op games!
We ended October and spent most of November working on expansion content for Pioneer Days that we got from the designers.
We revisited Alter Ego once in November and once in December, and spent the rest of December testing Eminent Domain: Chaos Theory, and another one of my games: Riders of the Pony Express. Riders was in pretty good shape, but was a bit fiddly. We fixed a couple of small issues, and brainstormed how to remove some of the process a little bit.
In addition, we played a few non-playtest games including Tapestry (which did not go over well), In the Year of the Dragon (my favorite Feld game), and we tested a game for one of my playtesters (we actually did this a couple of other times, but I hadn't recorded those). Also, I took my players out for an annual Playtester Appreciation Day to see the new Star Wars movie (we saw Solo last year, and Episode VIII the year before that) -- only one of them could make it though.
Finally, we capped off the year reviving my oldest game design that was any good: All For One! I initially got involved in that co-design 17 years ago, and it had been so long since the last playtest (2012?) that I didn't try any changes, we played straight from the rulebook. It was great to revive this old classic, and we started off 2020 with some significant changes to All For One, which worked well and felt great!
I'd like to use this post as a sort of retrospective on the last two years (or 28 months) of playtesting. Let's take a little trip down memory lane...
2017
Late August 2017 was the first session I'd logged, and that day we were evaluating 3 games I'd brought home from GenCon for TMG: Margrave, by Stan Kordonskiy, which turned into Old West Empresario, Rolled West, by Daniel Newman, and Embark, by Philip duBarry. Not only did we end up signing each of these, but all three are on store shelves now!
In September of that year we continued evaluating games: Pixel Factory was a neat one, but ultimately TMG did not sign it. Back to Earth was also neat, and we did sign it, but due to unrelated circumstances we ended up releasing it later. Railways is a game by some British designer friends of mine, and I liked it, but it needed some work. We did suggest the new title: Railblazers. My understanding is that at this point it has improved greatly, but the main mechanism which I was interested in (like the Mancala-rondel in Crusaders) has changed completely.
October saw us switch gears a bit. We spent a lot of time playing my games: Eminent Domain Origins (a Terra Prime reboot) and Eminent Domain: Chaos Theory (a dice game version of EmDo -- I should add those to the BGG database). This went on into November as well.
December was spent almost entirely on a dozen games of Embark, which had been signed by that point. I also see a lone play of Eminent Domain Origins at about Christmas time.
2018
We started off the new year with 2 more games of EDO, but then spent the rest of January, February, March, and half of April playing about 3 dozen (!) games of Old West Empresario, working on game balance and player powers. The only other playtests in those months were a few games of Harvest to test some potential expansion characters (unfortunately, we never did do an expansion to Harvest).
Late April through mid-May we tested the Crusaders: Divine Influence expansion, which was in pretty good shape to begin with, but we hammered out a few details. That one has now been printed, and is about to ship from the manufacturer in China and should be out later this year.
My son was born at the end of May, and my playtest sessions went on hiatus. The only other testing that happened in 2018 was at Rincon -- Michael was in town and we played a game of Deities & Demigods (now Olympus on the Serengeti), and several games of Imminent Domain (now Sails & Sorcery, but that title might not be final either), which is the game Michael designed based on the deck learning of Eminent Domain and the area control of El Grande.
2019
After an extended hiatus, I finally got back to regular playtest sessions in February of 2019, and we spent that first month back playing Eminent Domain Origins some more, fine tuning some last details.
March was spent on Emperor's Choice. TMG is doing a Deluxified version of that game, and we developed a 2 player variant which went over well with Richard Ham of Rahdo Runs Through, who famously only plays games with his wife.
April and May were dedicated almost entirely to developing Sails & Sorcery, changing up the format so it would play better, but keeping the core ideas of the game.
June was spent working on a new design of mine, Apotheosis. We iterated through several big changes as we quickly honed in on what worked and what didn't.
We started out July with a quick couple tests of a 5/6 player expansion to Crusaders. This worked out well, and we've got art done, but this won't come out until October. Then it was back to Sails & Sorcery through August. Most of the game was pretty solid by that point, but we were trying to fix this one niggling dynamic that just didn't work right.
We switched gears again and spent September and half of October playing Alter Ego, my co-operative deck learning game. We played quite a few games considering that one of my main testers doesn't like co-op games!
We ended October and spent most of November working on expansion content for Pioneer Days that we got from the designers.
We revisited Alter Ego once in November and once in December, and spent the rest of December testing Eminent Domain: Chaos Theory, and another one of my games: Riders of the Pony Express. Riders was in pretty good shape, but was a bit fiddly. We fixed a couple of small issues, and brainstormed how to remove some of the process a little bit.
In addition, we played a few non-playtest games including Tapestry (which did not go over well), In the Year of the Dragon (my favorite Feld game), and we tested a game for one of my playtesters (we actually did this a couple of other times, but I hadn't recorded those). Also, I took my players out for an annual Playtester Appreciation Day to see the new Star Wars movie (we saw Solo last year, and Episode VIII the year before that) -- only one of them could make it though.
Finally, we capped off the year reviving my oldest game design that was any good: All For One! I initially got involved in that co-design 17 years ago, and it had been so long since the last playtest (2012?) that I didn't try any changes, we played straight from the rulebook. It was great to revive this old classic, and we started off 2020 with some significant changes to All For One, which worked well and felt great!
Here's To Lookin' At You, Bugs!
 |
| Image used for criticism under "Fair Use." All rights belong to Warner Brothers. |
"What's up, Doc?"
Bugs Bunny was one of the great idols of my childhood. Looney Tunes used to regularly come on Cartoon Network, and Bugs was the one I always wanted most to see. In fact, Cartoon Network used to dedicate the entire month of June to playing Bugs Bunny cartoons nonstop. Such a bold move could hardly be imagined today. Even more inconceivable were his appearances at that time beside Michael Jordan in Space Jam, and Mickey Mouse in Who Framed Roger Rabbit. The latter more productive than the former.
I speak of Bugs since he just turned seventy-five this year. In the few moments I've spent with him, eyes glued to the TV set, so many are fond. Who wouldn't adore his arguments with Daffy over whether it was "Rabbit Season" or "Duck Season"? We all know the routine. Bugs would concede that it's "Rabbit Season", but Daffy, not one to agree with Bugs, thoughtlessly insists that its "Duck Season", only to get his bill shot off by Elmer. Though Bugs hardly ever got on Elmer's good side, either. As much as he tried to be very, very quiet in his hunting for rabbits, Bugs usually got the upper-hand. Sometimes he did it by cross-dressing as a woman, most famously in What's Opera, Doc? Now remembered as one of Bugs and Elmer's finest, What's Opera, Doc? is a fanciful adaptation of Wagner's Der Ring des Nibelungen, with the "Tannhauser Chorus" and "Ride of the Valkyries" included. The short was produced in the 1950's, when the Chuck Jones cartoons acquired a more modernist art style. We see this on point when Elmer's fury to command the weather gets the background into more clashing hues and greys. What stands out about this particular episode is that Elmer actually succeeds in killing Bugs, to which he weeps. I was shocked upon first seeing this. Tom never caught Jerry. Sylvester never caught Tweety. Wile E. Coyote never caught Road Runner. Yet here we were. Though Bugs slipped in a final comment to berate my surprise, "What did you expect from an opera, a happy ending?"
Even when Bugs was shamelessly ripping off Tom and Jerry's Cat Concerto in Rhapsody Rabbit, he managed to get a good laugh or two in. I mean hell, he literally pulls out a gun to shoot a coughing audience member. I suppose a bullet does better to silence than cough drops.
Bugs had wit. I'd argue that's part of his draw. With so many one-liners, Bugs comes across as an animated Groucho Marx. (Bugs has even put on a Groucho disguise). The rabbit always used his brains to get the upper-hand over his opponents, and being a cartoon, he resolves matters in ways that may surprise the viewer. Compare this to Popeye the Sailor, whom while being entertaining in his own right, always ended his conflicts in the same way: with spinach and muscle. Though the type of character Bugs is comes from the Trickster archetype. NPR compared him favorably to Puck, Anansi, and the Monkey King. Further, the radio station quoted Robert Thompson, who directs a pop-culture studies program at Syracuse University. Thompson remarked of Bugs that, "He defies authority. He goes against the rules. But he does it in a way that's often lovable, and that often results in good things for the culture at large," (Sutherland). Chuck Jones, always made sure that Bugs only acted when provoked. His trickery was a matter of defending his dignity.
And to my recollection, he always won.
 |
| Image used for criticism under "Fair Use." All rights belong to Warner Bros. |
Bibliography
Sutherland, J.J. "Bugs Bunny: The Trickster, American Style." NPR, January 6, 2008. Web. http://www.npr.org/templates/story/story.php?storyId=17874931
Assinar:
Postagens (Atom)