Contándote un poco de quién soy y cómo me siento a los treinta. Libre y feliz.
Thursday, May 25, 2023
9223 hash passwords
Automating REST Security Part 2: Tool-based Analysis With REST-Attacker
Our previous blog post described the challenges in analyzing REST API implementations. Despite the lack of REST standardization, we learned that similarities between implementations exist and that we can utilize them for tool-based REST security analysis.
This blog post will now look at our own implementation. REST-Attacker is a free software analysis tool specifically built to analyze REST API implementations and their access control measures. Using REST-Attacker as an example, this blog post will discuss how a REST security tool can work and where it can improve or streamline the testing process, especially in terms of automation.
Author
Christoph Heine
Overview
- Automating REST Security Part 1: Challenges
- Automating REST Security Part 2: Tool-based Analysis with REST-Attacker
- Automating REST Security Part 3: Practical Tests for Real-World APIs
Premise
REST-Attacker was developed as part of a master's thesis at the Chair for Network & Data Security at the Ruhr University Bochum. The primary motivation behind creating REST-Attacker was to evaluate how far we could push automation for REST security analysis. Hence, REST-Attacker provides several automation features such as automated test generation, test execution, and API communication. The tool essentially takes a "lazy tester" approach that tries to minimize the necessary amount of manual interaction as much as possible.
Creating a test run requires an OpenAPI file describing the REST API. Optional configuration, such as authentication credentials, can be provided to access protected API endpoints or run advanced test cases. Based on the API description and configuration, the tool can automatically generate complete test runs and execute them automatically. For this purpose, the current release version provides 32 built-in security test cases for analyzing various security issues and best practices.
How Testing Works
REST-Attacker can be used as a stand-alone CLI tool or as a Python module for integration in your own toolchain. In this blog post, we will mainly focus on running the tool via CLI. If you want to learn more about advanced usage, we recommend you read the docs.
Starting a basic test run looks like this:
python3 -m rest_attacker openapi.json --generate openapi.json is an OpenAPI file that describes the API we want to test. The --generate flag activates load-time test generation to automatically create a test run. In practice, this means that the tool passes the OpenAPI file to a test generation function of every available test case, which then returns a list of tests for the specific API. After creating the test run, REST-Attacker executes all tests one by one and saves the results.
There's also a second option for run-time test generation using the --propose flag:
python3 -m rest_attacker openapi.json --generate --propose In comparison to --generate, which creates tests from the OpenAPI description before starting the test run, --propose generates tests during a test run by considering the results of already executed tests. This option can be useful for some test cases where we want to take the responses of the API into account and run a follow-up test based on the observed behavior.
Both test generation methods can significantly speed up testing because they allow the creation of entire test runs without manual input. However, their feasibility often heavily depends on the verbosity and accuracy of the configuration data. Remember that many definitions, such as security requirements, are optional in the OpenAPI format, i.e., services can choose to omit them. API descriptions can also be outdated or contain errors, particularly if they are unofficial user-created versions. Despite all these limitations, an automated generation often works surprisingly well.
If you don't want to use the tool's generators, test runs can also be specified manually. For this purpose, you just pass a list of tests, including their serialized input parameters, via a config file:
python3 -m rest_attacker openapi.json --run example_run.json Advanced Automation
So far, we have only covered the automation of the test generation. However, what's even more interesting is that we can also automate much of the test execution process in REST-Attacker. The challenging part here is the streamlining of API communication. If you remember our previous blog post, you know that it basically involves these three steps:
- Preparing API request parameters
- Preparing access control data (handling authentication/authorization)
- Sending the request
Since most REST APIs are HTTP-based, step 3. is relatively trivial as any standard HTTP library will do the job. For example, REST-Attacker uses the popular Python requests module for its request backend. Step 1. is part of the test generation process and can be realized by using information from the machine-readable OpenAPI file, which we've already discussed. In the final step, we have to look at the access control (step 2.), which is especially relevant for security testing. Unfortunately, it is a bit more complex.
The problem is generally not that REST APIs use different access control methods. They are either standardized (HTTP Basic Auth, OAuth2) or extremely simple (API keys). Instead, complications often arise from the API-specific configuration and requirements for how these methods should be used and how credentials are integrated into the API request. For example, implementations may decide:
- where credentials are located in the HTTP request (e.g., header, query, cookie, ...)
- how credentials are encoded/formatted (e.g., Base64 encoding or use of keywords)
- whether a combination of methods is required (e.g., API key + OAuth2)
- (OAuth2) which authorization flows are supported
- (OAuth2) which access scopes are supported
- ...
Thereby, we cannot rely on an access control method, e.g., OAuth2, being used in the same way across different APIs. Furthermore, a lot of this information cannot be described in the OpenAPI format, so we have to find another solution. In REST-Attacker, we solve this problem with an additional custom configuration for access control. An example can be seen below (unfold it):
{ "schemes": { "scheme0": { "type": "header", "key_id": "authorization", "payload": "token {0}", "params": { "0": { "id": "access_token", "from": [ "token0", ] } } } }, "creds": { "client0": { "type": "oauth2_client", "description": "OAuth Client", "client_id": "aabbccddeeff123456789", "client_secret": "abcdef12345678998765431fedcba", "redirect_uri": "https://localhost:1234/test/", "authorization_endpoint": "https://example.com/login/oauth/authorize", "token_endpoint": "https://example.com/login/oauth/token", "grants": [ "code", "token" ], "scopes": [ "user" ], "flags": [] } }, "required_always": { "setting0": [ "scheme0" ] }, "required_auth": {}, "users": { "user0": { "account_id": "user", "user_id": "userXYZ", "owned_resources": {}, "allowed_resources": {}, "sessions": { "gbrowser": { "type": "browser", "exec_path": "/usr/bin/chromium", "local_port": "1234" } }, "credentials": [ "client0" ] } } } The config file contains everything required for getting access to the API. schemes define location and encoding of credentials in the HTTP request, while credentials contain login credentials for either users or OAuth2 clients. There are also definitions for the required access control schemes for general access to the API (required_always) as well as for user-protected access (required_auth). For the purpose of authorization, we can additionally provide user definitions with session information. The latter can be used to create or access an active user session to retrieve OAuth2 tokens from the service.
Starting REST-Attacker with an access control config is similar as before. Instead of only passing the OpenAPI file, we use a folder that contains all configuration files:
python3 -m rest_attacker cfg/example --generate REST-Attacker completely handles all access control requirements in the background. Manual intervention is sometimes necessary, e.g., when there's a confirmation page for OAuth2 authorization. However, most of the steps, from selecting the proper access control schemes to retrieving OAuth2 tokens and creating the request payload, are all handled by REST-Attacker.
Interpreting Results
After a test run, REST-Attacker exports the test results to a report file. Every report gives a short summary of the test run and the results for each executed test case. Here you can see an example of a report file (unfold it):
{ "type": "report", "stats": { "start": "2022-07-16T14-27-20Z", "end": "2022-07-16T14-27-25Z", "planned": 1, "finished": 1, "skipped": 0, "aborted": 0, "errors": 0, "analytical_checks": 0, "security_checks": 1 }, "reports": [ { "check_id": 0, "test_type": "security", "test_case": "https.TestHTTPAvailable", "status": "finished", "issue": "security_flaw", "value": { "status_code": 200 }, "curl": "curl -X GET http://api.example.com/user", "config": { "request_info": { "url": "http://api.example.com", "path": "/user", "operation": "get", "kwargs": { "allow_redirects": false } }, "auth_info": { "scheme_ids": null, "scopes": null, "policy": "DEFAULT" } } } ] } Individual test reports contain a basic classification of the detected behavior in the issue parameter and the detailed reasons for this interpretation in the value object. The meaning of the classification depends on the test case ID, which is stored in the test_case parameter. In the example above, the https.TestHTTPAvailable checks if an API endpoint is accessible via plain HTTP without transport security (which is generally considered unsafe). The API response is an HTTP message with status code 200, so REST-Attacker classifies the behavior as a flaw.
By default, reports also contain every test's configuration parameters and can be supplied back to the tool as a manual test run configuration. This is very useful if we want to reproduce a run to see if detected issues have been fixed.
python3 -m rest_attacker openapi.json --run report.json Conclusion
By now, you should know what REST API tools like REST-Attacker are capable of and how they can automate the testing process. In our next and final blog post, we will take a deeper look at practical testing with the REST-Attacker. To do this, we will present security test categories that are well-suited for tool-based analysis and investigate how we can apply them to test several real-world API implementations.
Acknowledgement
The REST-Attacker project was developed as part of a master's thesis at the Chair of Network & Data Security of the Ruhr University Bochum. I would like to thank my supervisors Louis Jannett, Christian Mainka, Vladislav Mladenov, and Jörg Schwenk for their continued support during the development and review of the project.
Read more
- Hacking Tools 2020
- Hacker Tools Mac
- Hacking Tools For Games
- Hacker Tools 2020
- Pentest Tools Free
- Hacking Tools 2020
- Nsa Hack Tools
- Pentest Tools Android
- Hak5 Tools
- Pentest Tools For Windows
- Pentest Tools Windows
- Ethical Hacker Tools
- Hack Rom Tools
- Pentest Tools Github
- Pentest Tools Apk
- Hacking Tools Mac
- Hacker Tools 2020
- Hacker Tools For Windows
- Pentest Reporting Tools
- Hack Tools 2019
- Hacking Tools Name
- Kik Hack Tools
- Hack Apps
- Hacking Tools For Windows 7
- Hacking Tools For Windows Free Download
- Hacking Tools Name
- Pentest Tools Windows
- Hacking Tools 2019
- Beginner Hacker Tools
- How To Install Pentest Tools In Ubuntu
- Hacking Tools For Beginners
- Hacking Tools For Windows
- Nsa Hack Tools Download
- Hacking Tools For Kali Linux
- Termux Hacking Tools 2019
- Hacker Tools Mac
- Hacker Tools List
- Hacking App
- Hacker Tools Online
- Termux Hacking Tools 2019
- Hacking Tools And Software
- Hacker Tools Linux
- How To Make Hacking Tools
- Physical Pentest Tools
- Hack Tools 2019
- Pentest Tools Windows
- Hacker Tools Linux
- Hacker Tools 2020
- Pentest Tools Subdomain
- Pentest Tools Online
- Underground Hacker Sites
- Pentest Tools List
- Hacker Tools Hardware
- Hacking Apps
- Hacking Tools 2019
- Hacking Tools Hardware
- Hacker Tools Mac
- What Is Hacking Tools
- Hack And Tools
- Pentest Tools Website
- Pentest Tools For Ubuntu
- Hacking Tools For Mac
- Hacking Tools For Windows
- Pentest Tools Port Scanner
- How To Install Pentest Tools In Ubuntu
- Hacking Tools Github
- How To Hack
- Pentest Tools
- Hacker Security Tools
- Hacker Hardware Tools
- Hacking Tools For Mac
- What Is Hacking Tools
- Hack Tools For Ubuntu
- New Hacker Tools
- How To Install Pentest Tools In Ubuntu
- Hack Tools Online
- Hack Apps
- Pentest Tools Review
- Hacker Tools Windows
- Hacking Tools 2020
- Pentest Tools Nmap
- Pentest Tools Android
- Hacks And Tools
- Hack Tools For Games
- Hacker Tools 2020
- Hack Tools For Ubuntu
- Pentest Tools Website Vulnerability
- Hack Tools
- What Are Hacking Tools
- Hacking Tools Windows 10
- Hack Tools
- Hacker Hardware Tools
- Hacker Tools List
- Hack Tools For Pc
- Hacking Tools For Pc
- Usb Pentest Tools
- Install Pentest Tools Ubuntu
- Hack Tools For Windows
- Pentest Tools Apk
- Hack Tools For Mac
- Pentest Tools Subdomain
- Pentest Tools For Ubuntu
- Hack Tools For Pc
- Pentest Tools Linux
- Hack Tool Apk No Root
- Hacking Tools Usb
- Hacking App
- Hacking Tools Windows 10
- Hacking Tools For Windows 7
- Pentest Tools Find Subdomains
- Pentest Tools Find Subdomains
- Pentest Tools Github
- Hack Tools
- What Are Hacking Tools
- What Is Hacking Tools
- Hacking Tools Usb
- Hacking Tools Github
- Hack And Tools
- Github Hacking Tools
- Pentest Tools Android
- Free Pentest Tools For Windows
- Pentest Tools Framework
- Pentest Tools For Android
- Hacking Tools Kit
- Pentest Recon Tools
- Hacking Tools Name
- Hack Tools
- Hacker Tools Apk Download
- Kik Hack Tools
- Hacking Tools For Mac
- Hacking Tools For Beginners
- Hacking Tools Usb
Day Of The Tentacle - Obvious Solutions And Waiting Around
Written by Morpheus Kitami
Right, the future. The grand philosophical musings of Tim Schaffer and Dave Grossman on the direction our country will take in the future if we elect a tentacle president. Can't help but feel like that's a silly thing to base your musings on. People are pets of the tentacles...and not in the direction some of us were expecting. People performing in silly talent shows with bizarre criteria for victory. And Elvis museums. Eh, not the worst the future could be.
Also befitting the future, I've switched back to the MT-32. I was already done with the last entry by the time I was convinced to change my mind. I'm going to get a better idea of the sound of this game than anyone back in the day did.
![]() |
| You ever get the feeling that someone's run out of good ideas? |
I guess my first course of action after attempting to murder everyone and everything is to talk to my compatriots in jail. The old man is Zed Edison and because Laverne confused him for Dr. Fred, he helpfully tells us that Fred is not a very beloved man today. In the future, man is the servant and pet of the tentacles, and people are stuck in degrading talent competitions where they're put in ugly costumes and perform ridiculous talent acts. Yeah, what a dark and depressing future which bares absolutely no resemblance to anything you could watch on TV today. No siree...
I can't talk to Zed's wife and child...so that leaves the guard. I'm really liking Laverne's way of talking to people. I'm given two options to get Laverne out of here. Firstly, I try saying she doesn't feel well. This results in Laverne being taken to a doctor...er...veterinarian? Who of course, sees right through Laverne's attempts, or questionable sanity, but also doesn't really care and just walks off to see the human show. Leaving me alone in here...to steal medicine! MUAHAHA! No, all I can do is steal a tentacle medical chart from here.
I'm trying not to just endlessly repeat the jokes the game has, but I'm really wishing I used a tentacle PETA joke last time, because one of the doctor's licenses says he can kill humans. Ah...
![]() |
| Humanity has certainly gone downhill in the past few centuries... |
Outside is the much hyped up human talent show. Well, at least cartoonists can make slightly more depressing shows than reality can. For now. If I try going anywhere, Laverne gets nabbed by a tentacle guard and says "IF ONLY I HAD A TENTACLE DISGUISE" as subtly as someone driving a semi truck through your living room at 3:30 AM.
The other choice is to say Laverne needs to go to the bathroom. This is one crappy kennel if it doesn't have a toilet. It doesn't, so it is, and the tentacle says we're a human and its silly for humans to go to the bathroom. So now Laverne is outside...and can reach the Chron-a-John. Fat lot of good that does me. Looking at my items list, nothing helps me. Nothing at all. I do note from looking around that I can see Dr. Fred's old lab...and that means I have to plug the Chron-a-John into there somehow, this is another puzzle, and then drown the hamster to power it. Sigh...
Looking over the items Hoagie and Bernard have, I don't see anything that seems helpful in this situation. I'm going to bore the guard to death with the textbook...or something. Or I could put the disappearing ink on the cards, ticking off Laverne's cellmates for no reason, possibly getting myself a deck of cards for no reason. Or trick the tentacle into smoking the exploding cigar. None of which actually offers me any kind of solution. Hoagie's stuff is straight up out.
It does occur to me that the Tentacle anatomy chart could be used as the flag design...and that's true. Sigh...we're starting off this entry being annoying, I see. That doesn't actually help me though, at least for now. The flag design in the future, I guess, changes to that of a tentacle. Not sure why the tentacles had the original flag design here, but whatever. I guess I need to find something else in the past/present before I can make any real progress in the future.
So I think about the things I've seen and what might genuinely help. I think it might be a good idea to wash the car in the present, only I can't send the bucket through time. Ah...small inanimate objects. Wait, doesn't that mean I don't have to drown the hamster? Hmm. I try a bit of using random things with random things, given that I don't have any idea what to do next. At least B-man's stuff in the present. The flyer sounds like something useless, let's try using it around in the past.
![]() |
| Funnily enough, Washington didn't have much to do with the constitution, preferring to let people like John Adams and Thomas Jefferson on it, but there's no cherry tree puzzle with them |
This turns out to be a decent idea, because I can put it in the suggestion box. George says every man should have a vacuum cleaner in his home. This shows a change in the future and a vacuum cleaner is added to the house. But that still doesn't fix anything for me now. Since I had the thought, I might as well try the dime with Franklin's kite.
![]() |
| In response to some of the dumber things Dr. Fred has done. Who would indeed? |
This is apparently a very annoying task to perform, because trying to use the dime with the kite before it goes in the air causes Hoagie to drop the kite like a little girl. I can't even use it in the inventory or the pocket directly. I guess this isn't the answer. Oh, well, it was a vain hope anyway.
I'm getting really stuck here, so I start dumping B-man's stuff into the toilet so Laverne can take it. I don't know why Laverne might need the textbook, either of the two fluid things or the light + cigar combo, but you never know. None of this stuff works in the cell, so I convince the guard to let Laverne into the medical office again. Sure am glad there's no limit on that. And the doctor is still gone, and I can't use it on the human anatomy chart, so its all been pointless and I haven't a clue how to progress...
...he says before walking out and into the door that previously led to the convention hall. Where the tentacle guard doesn't yell at me. Huzzah! To the kitchen. This time we have a microwave, some kind of weird device and a recyclotron. The microwave might be used later, but I note that the settings it has "cook", "jet defrost" and "mutilate beyond recognition" are fairly appropriate jokes considering how awful microwaves can be. Or American microwaves if for some strange reason microwaves are vastly different in different lands. I presume the recyclotron is going to be needed to remake something into something more useful later.
The weird device I'm not sure about, its a monitor with a bunch of buttons whose purpose isn't clear right now and probably need some kind of notes to allow me to figure it out.
Finally, the laundry room is the same, except its in worse condition and has absolutely nothing. I can also climb up the chimney for no present benefit, as I can't get the flag which is now a tentacle, nor can I use the pulley that's up there or enter the windows. The pole the flag is on apparently can't be raised or lowered now because the crank is missing.
![]() |
| I don't think that's proper Greek, oh, like anyone here knew Greek |
I get a meanwhile on the way back down where who I presume is Purple Tentacle is talking to a green tentacle soldier about human sympathizers and then a plan before the scene trails off. Interesting, I guess that means I'm not entirely in a bad way here.
The actual last thing I can interact with right now is a blue tentacle. How shocking! He's apparently a tentacle fashion designer, and thinks Laverne is quite ugly, insulting her. I can try to enter Laverne into the competition, but should I do so he says that humans can't do anything. Right, well, let's see around time some more.
While wandering around back in colonial times, I check Red's lab again. Oh, ho! A left-handed hammer! I know what this is for. To the twin Edisons! I pick up the right handed hammer at the most opportune time and switch it with the left handed one...and after a short cutscene, the statue in the present changes which hand is holding a sword. Huh. This seems like it wasn't really helpful. Although I'm sure at some point the distinction is probably going to solve a puzzle.
I move some stuff around to Hoagie now, figuring that if nothing else, I'll get a few yucks out of peoples reactions to the disappearing ink and B-man's textbook. I've been glossing over it, but people tend to have amusing reactions to getting either of these items used on them. What I wasn't expecting was to be able to use the cigar on George Washington. AHA! To get his dentures. Only his dentures completely disappear after the explosion. Now I have to find the dentures somehow.
![]() |
| He actually says that, I'm impressed |
Well, it turns out I really did have to bring Washington the horse's teeth, because the textbook actually works on the horse! The horse nods off, puts his dentures in his little cup, and then falls asleep. I can take it and bring it to Washington...only for him to say he can't wear them. Drat. Now what? I step away for a while. I often do that, but this turns out a bit differently.
I know I need to find a costume to sneak past the various tentacle guards. I know that the flag is a tentacle design, and I assumed at some point that I needed purple paint, but given that there's a blue one, I don't foresee this being a problem. Ergo, I just need to find a way to get the flag. But how? I don't know why I'm trying to build up tension, you all know I need to just pick up the crank in the present then drop it in the toilet. Sigh...more walking around. From where I was, I have to get Laverne back to the kennel, talk to Tentacle Guy again, go back to the Chron-a-John, have B-man walk through the convention hall up to the roof, then back down. Finally, Laverne has to talk to Tentacle guy twice, go back upstairs and then I can figure out if my idea is right. I feel like a game with brutal dead ends would usually have less busywork than this...
Now...does it work? Yes, and I didn't even need to use the red paint. Wow. Now the whole future is my oyster. The tentacles all think tentacle Laverne is a cutie, which makes things very easy. Now I need to find a human to enter into the pet show for some reason. I presume...Guess I'll get Zed to do it, but right now I want to see what's going on in the rest of the house.
![]() |
| I feel like this date for the past raises a lot of questions that the game obviously doesn't want to answer |
The second floor now contains museum artifacts. A room done up to look like one out of colonial times, containing the unopened time capsule. A little while later I figured that the can opener can be used here, netting me vinegar. Now I only need gold. Room number two contains the mummy and some very Elvis-inspired stuff. Yeah, I can see people thinking we all loved the guy considering how often his devotees were depicted in fiction around this time. Seriously, we used to love the guy. We in the sense of "Americans", I couldn't care less. I get a pair of roller skates here for some reason. On a later trip I pick up an extension cord, which was a bit hidden.
Room number three has Purple Tentacle...didn't expect him here. Even he's fooled. He's working on a shrink ray, because even though he's conquered the Earth, he still wants humans out of his sight. I'm guessing I'll need to get it sooner or later. And that's actually all I can do here. The final room upstairs is just an area where the prizes for the human contest are. Including a reservation at a fancy restaurant. Guess I'm going to have to win that for some reason.
Now, let's talk to that guard and the pet humans. The guard is some kind of super tracker and is supposed to be guarding the grandfather clock. Which means I can't enter it, so I have to distract him. He keeps mentioning the show and the reservation prize. I suspect this is supposed to be another subtle clue. The pet humans, well, two can't be talked to, and the other one looks like the game's George Washington. He's very spoiled and is surefire to win the contest. I guess I need to trip him up somehow. The categories, if I remember, are best hair, best teeth...and something else. I'll figure it out then. Unfortunately, I can't get any of the Edisons to become pets, because the tentacle guard won't let me and I can't enter the jail now.
While going to the Chron-a-John during this time, I notice that there's now a cat outside. Clearly where I need to use the cat toy, but that still leaves me with the question of how to get it.
At this point, I come back and forth throughout the game not making much progress. Every time I try to use an item on something it fails or I'm apparently on the wrong track. I'm clearly still missing something in the past or present, because nothing I seem to try in the future works. But eventually I make progress on two fronts I really wouldn't have considered.
In the past, I just sort of stumble upon the idea to use one mattress on the other mattress. After trying to pick it up. I don't like this puzzle. I feel like its only luck you would ever figure this one out. Its the only time you move a bed. But at least it gives me a funny cutscene and I can get the cat toy now. Fat lot of good it does me, the cat in the future isn't fazed by it at all.
In the present, I eventually hit on the idea of putting the hamster in the icebox. Sigh...In the future Laverne defrosts the frozen hamster in the microwave, with an obvious tongue-in-cheek gag about the hamster from last time. I wonder if someone actually did that because of the original? You know, who wasn't a psychopath...Anyway, he's not much help until I can enter the basement, and I still need to warm/dry him through non-lethal methods. But that still doesn't help me...then it hits me. What if I give the scapel to someone else?
![]() |
| I guess we know who microwaved the hamster last time |
Like Bernard? Who has a hatred of a certain bouncy clown? I also try the mouse toy on the sentient teeth, also in vain. I have a new item now, with which I can annoy everyone with, or not because as of now its completely useless. I also search through the rooms more thoroughly to mixed success. I find one of those bed shaking things in the room with the sleeping dude, and a dime moves him, but I need the other one. Somehow I can't use the scalpel on the gummed dime. I can see a mousehole in the middle room and last room, but nothing I have helps. I also pick up a video tape in Green Tentacle's room, not that it's very helpful until I can get rid of Edna. Or even if I can get rid of Edna.
It's at this point I notice that talking to Dead Ted feels like a subtle hint system. "Where can I get gold?", "How can I get a human?", "Where can I get a hat?"...wait, hat? Like the one Ned and Jed have? I guess that's what I need for the time capsule, but getting it is a bigger question. Plus now that Ned and Jed have changed places I can't do anything here, even what I did previously. Okay, let's think about what I can do and how I can possibly get it done. I need something to distract the model, giving me a chance to steal the hat. I think...the teeth that keep moving around in the present. That's the only thing left that could work.
Okay then...how do I deal with the teeth then? Hmm...I've got nothing. Something that can be thrown on top of it, but I've seen nothing like that. Violence doesn't work and neither does anything else. Back to the drawing board.
Then we have the future. My real roadblock is not being able to convince Zed I'm friendly and to enter the human contest. I can't talk to him and I can't hand anything to him. The guard implies I can bribe him whenever I try giving him something, but nothing I have seems to work. Also, while examining the right-handed hammer as Laverne there's a serious case of off-voice acting. Laverne suddenly switches to a more breathy femme fatale light kind of voice. As I'm giving the rest of the items to Laverne, I realize something regarding the stamp. I've been holding onto it with the impression that I need it as a stamp...but why couldn't I give it to Jefferson? Because I can't. Sigh...
![]() |
| Pretty sure this guy would run away if he thought you puked on him |
Right, well, I'm out of ideas. So I just walk around for the umpteenth time. I eventually find another thing I was missing. By complete chance. I make my way to the tentacles room again, and push the speaker over, not really expecting anything to happen. I was more seeing what I could give to Green Tentacle, nothing, apparently. At first I think I can now cut the wires to the speaker, but then I remember what happened when I used it before. AHA! Now I have the fake barf and I can annoy many people. Or not. ARGH! "That's one of the FEW places fake barf isn't useful." We're already into what Heroes of Might and Magic would call a lot, buddy boy! I have tried using this fake barf with such vigor and gusto you'd swear I had picked up the fake stomach flu from the fake buffet.
It takes me a good long time to finally come up with what I have to do next. A long, long time. A long amount of time moving items between different people. And then finally reading the tiny bit of the manual where the game mentions "oh, by the way, you can use items on the icons of the other characters". That isn't annoying at all...But it's while moving the name tag around time, I realize what the answer to it is.
Who said that the contestants had to be alive? Like a dog entering a football game, nobody said they couldn't, so they can. And so, I place the tag on Dead Cousin Ted, then put the roller skates on him, since obviously that's how I have to move him, and with a crash into the other contestants. Now the human show can begin.
![]() |
| What a charming and very much not creepy group of people |
Right away I know part of what to do. Give the mummy the teeth. Now what? Well, he needs hair, so I guess the spaghetti works. The voice box is probably needed in case he needs to say something in response to something. Obviously, I need to get rid of Harold somehow...maybe the fake barf. Laverne drops it, Harold sees it and says he's going to be sick...and then doctor tentacle walks in and Harold is history. Now I can win.
Because of Lucasarts "you can't ever lose" policy, this works weird. I have to walk up to the judges, a large group of tentacles in which only three ever talk, ask them to judge whatever category, and they do so. Ted wins the teeth competition...somehow, and the laugh competition by being the only one who laughs. The hair competition though, that doesn't work. I'd have thought 2 out of 3 would work in my favor but apparently I need to come back later.
Right, another long session of being able to do nothing...and then I walk into the kitchen again. There are certain rooms I've been ignoring on the basis that they aren't very important yet. You know, the laundromat because I have nothing that would work there, certain rooms on the second floor because there's nothing left to be done or nothing I can do yet...and it's in the kitchen that I realize I missed the fork. I wondered where that went. And I realize what I'm supposed to do with it. On the hair.
![]() |
| From my nightmares to yours |
With that done, Ted wins the show, he gets the prize and the dinner for two at Club Tentacle. Laverne has a tearful goodbye with Ted, calling him the best Edison. Well, he's certainly caused the least amount of trouble so far. I give the ticket to the tentacle guard, and now I can let the Edisons free...they're too afraid of the guy with the net. Maybe Ted is the best Edison. So...now I need to get rid of the tracker somehow, so the Edisons will escape so I can get rid of the tracker so I can reach the basement. There's nothing I can do, really, to ruin their day either.
Okay, let's try to connect the threads I have left and how they might be solved.
Here in the future there are a lot of things around that seem like red herrings or are completely useless. The recyclotron has accepted nothing, and the other thing in that room is useless barring some discovery in the basement. There are a lot of named things in the two rooms on the second floor, but none that I can do anything with as of yet. I don't know what the game expects me to do with the cat either.
The game implies I can move the birdbath Dead Ted is holding, and I'm guessing I should use the crowbar to do so. I need to get the crowbar off the obvious criminal somehow. Violence isn't an option and giving him a better tool isn't either. So...I guess I need to solve his problem by getting the car open. So...car keys? They're either lost, in the vent in the convention hall, the mouse holes, or they're in the room with the guy I have to move to get the sweater. I'm discounting that it's the Edisons because I would have found them in that case.
I think it's pretty clear what I have to do with the sweater. I need to get the other dime, put the sleeping dude off the bed, take the sweater, find a quarter then put it in the dryer...for some reason. Maybe even dunk it in the Chron-a-John like the spaghetti had to be. The problem is...how the heck do I get that dime? It's just not funny anymore trying to get it out. B-man won't try cutting it free with the scalpel because he's afraid he'll cut himself. I can understand that, but at the same time if you point the thing away from you the worst you'll actually accomplish is damaging the floor. BLARG!
Presumably, I have to use the VHS tape I have in the VCR to get the combination to the safe...but whatever I do, I cannot get Edna gone. I have no idea how to do this, beyond vague hints relating to screwing around with the two sculptors in the past. You'd think I could use the ink on her posters or something, but no. I figure that once I can get into the safe, I can use the correctional fluid and the stamp with whatever I find in there to mail the contract, get the Edisons their millions of dollars, and then get the diamond. I note from screwing around that I have to mail it in the past.
There are also various places the game sees fit as important I haven't quite figured out anything about. The aforementioned mouse holes in two rooms on the second floor; A bell in the lobby; A vent in the convention hall; The river the waste was in; A bed in the attic that is the only thing in all two rooms there. I've tried some stuff over the course of the game and nothing does anything.
I have vague ideas of events in the past. I know that the golden quill is the only thing gold I've seen. Hancock mentions that he has a coat. I figure that whenever I finally find the item that Jefferson wants to replace the log, Hancock will let me take his coat. Then I can use that coat on the walking teeth in the present...for some reason. I don't know what use that would be just yet. There's also the matter of Washington's teeth, where did they go? I presume there was a reason for me to do that. Further, I can't find anything to do with the canary/smoke alarm in the convention hall, or the mirror in Franklin's room.
Finally, the three items I have that I haven't identified a possible use for yet, the funnel, the hammer and the mouse toy. Well, when I say I haven't, I have, it's just that when I tried using them I couldn't. I don't have anything that needs a funnel's actual use, but I did try giving it to the sculptors as a hat replacement. Didn't work, obviously. The hammer doesn't work on anything that it could obviously work on. And I can't use the mouse toy on the mouseholes so I have no idea left. The manual hints that items can be combined, but I don't see any options here.
This isn't a request for assistance because by the time you've read this I will have won the game. I won the game by the time you saw the third entry. Do my thoughts on possible solutions match the real ones? Find out next time on The Adventurer Guild Z Episode 1452 "Morpheus Was Wrong About Everything!". Anything could happen!
At this point I'm not entirely certain who holds what. Just know that someone holds everything here.
Bernard's inventory: Textbook, correctional fluid, bank book, disappearing ink, funnel, coffee, decaf, stamp, lighter, right handed hammer, VHS tape
Hoagie's inventory: Can opener, brush, bucket with soapy water,
Laverne's inventory: Scalpel, red paint, cold wet hamster, mouse toy
This Session: 3 hours 00 minutes
Total Time: 5 hours 45 minutes
Note Regarding Spoilers and Companion Assist Points: There's a set of rules regarding spoilers and companion assist points. Please read it here before making any comments that could be considered a spoiler in any way. The short of it is that no points will be given for hints or spoilers given in advance of me requiring one. Please...try not to spoil any part of the game for me...unless I really obviously need the help...or I specifically request assistance. In this instance, I've not made any requests for assistance. Thanks!
Friday, August 5, 2022
Top 12 Websites to Learn How to Hack Like a Pro
- KitPloit: Leading source of Security Tools, Hacking Tools, CyberSecurity and Network Security.
- Metasploit: Find security issues, verify vulnerability mitigations & manage security assessments with Metasploit. Get the worlds best penetration testing software now.
- Exploit DB: An archive of exploits and vulnerable software by Offensive Security. The site collects exploits from submissions and mailing lists and concentrates them in a single database.
- SecTools.Org: List of 75 security tools based on a 2003 vote by hackers.
- Packet Storm: Information Security Services, News, Files, Tools, Exploits, Advisories and Whitepapers.
- SecurityFocus: Provides security information to all members of the security community, from end users, security hobbyists and network administrators to security consultants, IT Managers, CIOs and CSOs.
- Hacked Gadgets: A resource for DIY project documentation as well as general gadget and technology news.
- NFOHump: Offers up-to-date .NFO files and reviews on the latest pirate software releases.
- HackRead: HackRead is a News Platform that centers on InfoSec, Cyber Crime, Privacy, Surveillance, and Hacking News with full-scale reviews on Social Media Platforms.
- Phrack Magazine: Digital hacking magazine.
- The Hacker News: The Hacker News — most trusted and widely-acknowledged online cyber security news magazine with in-depth technical coverage for cybersecurity.
- Hakin9: E-magazine offering in-depth looks at both attack and defense techniques and concentrates on difficult technical issues.











