hacking twitch chat

Key Takeaways

Alrighty. Hi everyone. Thanks so much for tuning in. Look, I'm super excited about this conversation because I get to meet a new friend, Lethal Panda. This is hacker handle and alias. I guess panda with a four for all of the A's. But Shicada, a good friend of ours. He introduced me and Shaka is one of our instructors with just hacking training. Another great friend who's been on the channel before for Active Directory videos. But Panda, you have some super cool findings in the whole live streaming world. Is that right? >> Yeah, I do. And it's, you know, it's regarding one of the most used chat bots in all of Twitch stream elements, you know, and particularly with the findings that I've discovered. It's not crazy like SQL injection where you're going to dump an entire database to get all these things. But more remarkable part of this is demonstrating it to their support and their staff and having them say this is intended behavior, which anybody who could see what's going on could probably understand that it is indeed not intend. >> Well, before we dive in, forgive me. I didn't do a good job of hey, letting you do your intro or hey, who are you? What are you up to? If you're willing to give us any background context, what have you been doing and how did you find and stumble into this as part of what you're up to? >> Yeah, I'm Lethal Panda. I've been penetration tester for the last 5 years. Um, actually very early my career when I was first starting, I watched a lot of John Hammond videos to get me going. So, big thank you to you for all you do for the community for one. And yeah, as far as finding this, you know, I watch a lot of Twitch streams, frequent the website, have a bunch of different videos that I'll just be playing throughout the day, background noise, whatnot. And as anybody in any kind of offensive security, red team penetration testing field does, they start noticing things when you're using your everyday website, app, and whatnot. You start seeing behavior, noticing things, and that begs the question of the hacker mindset of does that do what they think it does? That's kind of how we got where we are today with this. One of the cool things I remember you had shown me was big giant infamous live streamer. I don't think there's anything wrong with me kind of saying and we can show the clip if that's all right, but Jinxy had gotten accidentally inadvertently banned because of this hiccup. Is that right? >> Yeah. And totally fine showing that clip. I think it he's great at content and that was certainly a great piece of content. >> Tell me. >> No, we have Listen, bro. We have paranormal activity in the stream, bro. Seriously, paranormal activity. You see, on my life, I did not do that. >> Someone changed my title. >> There is a ghost among us, bro. There's a ghost. >> But yeah, it was an effort to demonstrate the problem that we found. Jigsie happened to be one of the many streamers affected by this vulnerability, we'll call it, and ultimately caused a lot of confusion within the stream. There was some almost 40,000 people watching at the time. And because nobody knew what was going on and the nature of how the exploit worked, they decided the best action to do was him temporarily have him change his password and reinstate his account cuz the original thought was that he had been completely compromised, which we now know is not the case and I know was never the case. But nonetheless, that still did not add any emphasis apparently to Stream Element staff as to why this is a problem. >> Skunk works and shenanigans aside though, could you fill me in? Could you let me know how this all happens? And if you've got any show and tell or a demo, that would be phenomenal to see cuz this sounds wild. >> Yeah, absolutely. So, the basis of the problem originates from two variables that they have on the stream elements bot. So, part of stream elements is a chatbot. That's one of their biggest features where users watching a stream can interact with bot. You could set a whole bunch of custom commands to have fun interactions between the bot that you could store information there for them to retrieve so the streamer doesn't have to keep repeating it. But what I find is quite a big oversight with all of this is these two variables. So args variable you know as it says arg variable allows you to repeat that the bot will repeat uh an argument like if you say greet dollar sign one and then a user goes greet world the output would be hello world and you could figure that these are all part of the custom commands some of the default commands as well take advantage of a lot of these different variables that you can turn on or off as the streamer but it is the args being dollar sign 1 2 3 and so forth in the parenthesis or braces open and close brace works as well and much like array index indexing this function the same way. So one's going to be that first element after the command. If you put a zero there, it would repeat the command itself. And that's kind of what started sparking the interest in my head. This behavior I've seen before and I'm familiar with. And that kind of started making me question what else can it do? >> Yeah. I mean, this maps to me like basically function arguments, right? But uh I think of like a bash script or something. You're used to like a dollar sign one for command line arguments, dollar sign two for what you provide, but dollar sign zero will refer to like the script or the command that you ran. So this looks all yeah similar tracking. >> And the more common place we see this is dollar sign to user. And this is to user is really just an alias for dollar sign parthesy one to grab the first argument. And so this is typically the variable that we'll see in streamers stream elements instances. That's what's most commonly used and that's also what we ultimately were searching for. All the stream elements commands are largely public. You can, you know, all the URLs for every streamer who lists their commands out. You could throw in their Twitch handles into there and start crawling the pages and see if they're affected. And when we did that, we found 300 400 of the top 1,000 streamers were affected in some way, which is terrifying that again, Stream Element has no problem with this. So with the nature of the let's see I can go over to this is my instance here that I've spun up on my channel to do a whole bunch of testing. So I can go ahead and even just make a new command to demonstrate. So you make a command saying hello. And if you want to use this your response can be you know using that variable. It's say dollar sign one hi there. So that when the user goes hello and puts something after it the bot's going to reply whatever you say after hi there. activate the command and then I go over to my Twitch instance here. Exclamation mark hello, hello John. It's going to reply with John. Hi there. And so this setup right here is one of the first instances where I realized there could be more to that. There was um so originally I had found and reported this to stream elements. >> This seems so innocent as a start, right? This just looks like oh normal hello call back response kind of thing. How is this going to be taken advantage of? So specifically with this setup here of the command I just made. So when you are allowing user input to be at the very start of a response you are as we know with any kind of command injection leading yourself open to some doors and that's exactly what happens here. So for some more innocent things I wonder what happens if you make stream elements start talking. And then for sake of this demonstration actually I'm going to use a different command just so to not spoil build it up a little bit. I'll use this exclamation mark. See, I'll change this to repeat mega. And it's just going to repeat the first arcation mark. Repeat me. Hello. Should just say hello. So now if I go repeat me and I do something like clear a native Twitch command to clear the chat, it's not going to This is where I need more in there. Did a repeat me again. Repeat. Hello. SL. Of course, they're going to not work. Now, is it silently patched? >> Right. That's And that's what they did to me about two years ago because previously you could do things like slashb plus do repeat me/eote only. Did they actually patch this in the two days? That would be amazing. >> Okay. Removing slashes it seems anyway. >> Oh, they totally did cuz this 100% used to work. They did silently patch something. That is amazing. Now, I thought you'd been able to do some other tricks with like an argument that's going to represent another variable, right? Okay, I see you trying to experiment with that. >> So, that that one definitely still worked. Um, and this is the more dangerous of the two. And gosh, that was still still something fun uh fun with that. >> Yeah. What would that first one allow you to do? >> Previously, there was a bunch of different commands for/comands that you could run that are native Twitch that would allow a lot of different behavior. And things that I've done before are when I'm testing these with different streamers. You have your fun, some mod notices it, and they ban you. So, I'm just going to hop on my alt account, do the same thing, and run / unban and I can unban myself. And that's something I've done. There was emote only, obviously, turning the entire chat into an emote only where they would essentially run this command. And then everybody can only speak in emotes. What else? Announce was another good one where it would just make your your message in an announcement box, get more attention. Tons of fun slash commands that you could do with that. But stream elements will still have the permissions to be able to do that because stream elements is like by design a mod. Correct. >> Right. And that's that's the nature of the problem here is that the intended setup of stream elements is that it's a moderator on your stream so it can help perform actions and whatnot. Where I found the most damage being done and especially in this case is this ne. So, >> first one's still let you mess with the stream though cuz announce and emote only. You could still certainly cause some chaos and people just not realizing, not understanding what's going on, >> right? And this next behavior is still the most dangerous part of it, I would say, assuming they haven't patched it in the last day cuz I did test this yesterday, but I can't imagine they have. So, in most streams, there are more than one bot that they'll use. They'll use stream elements, they'll also use Nightbot, they'll use Faucet, Mubot. there. You know, there's several other out there now, but tons of popular ones, and they're all intended to be set up in the same way where they're all moderators in your stream, and you can do a lot of similar things between them. Some of them have their own differences, obviously, otherwise there wouldn't be a market for them. But when you have, you know, if you look at my channel now, I have several different bots that I've have in here just for playing with them. And so, that got gear spinning in my head asking myself, okay, I can make Stream Elements say things. I wonder if I can make Stream Elements talk to other bots by saying these things, cuz Stream Elements has its own commands. Knifebot has its own commands. Fossa bot has its own commands and nevertheless you can. So let me bring up my nightbot command list here. So in nightbot I have two custom commands which is again that familiar to user which does same thing that we have previously discussed and I also have this query one which takes everything after the exclamation mark Q or whatever command you set and it will repeat that. Tons of great uses for it within the stream. Obviously knowing my brain tons of malicious activity that can be potentially as well. So with this exclamation mark B if I were to get on here. So we have repeat me. Wonder what happens if I go B. So now stream elements is now running a command because it says exclamation mark B. Nightbot sees a moderator just ran the command and it replies. >> Nice. >> And so this is where the fun begins. Bots will talk to each other. And this was pretty much what I had found about two years ago with stream elements is that if you're using that two user variable and the beginning of it can talk to other bots. Similarly, obviously with Nightbot, if I were to just do and then repeat, they talk to each other. Reported this to Stream Elements two years ago and they said, "This is intended behavior. If someone's doing that, that's their own fault." Okay. I I could see the argument for that one. >> Yeah, I guess. I guess. >> And I mean, Nightbot, I believe, also puts a warning inside of the two user functions saying, "Hey, there's potential for dangerous activity here." Stream Elements does no such thing. There's nothing in their documents letting you know that there's any kind of potential for erroneous bait. And specifically with stream elements with that two user that was an arguments command that's really fun and problematic is the fact that you configure variables for bot responses and my brain started going what happens if I give it a user in of a variable and that's where we get to the dangerous stuff just like before you know that dollar sign too if this is the zeroth element this is the first element second ah >> so stream elements will actually process variables on user input which is as we will see very dangerous and problematic And this is really how I got previously with just the bots talking to each other. You had to have very specific commands for to do anything really dangerous or really damaging to a stream to any kind of video because it would only grab the first word. Whatever is after that is then what you're depending on to to run that secondary command as the as the second. >> Would you mind trying slashannounce or slashemote only via the dollar sign to sort of proxy? Did that work? I think that might have been what we did before ticket. >> Maybe they still truncate or remove the forward slash. >> Yeah. So that's what it is. They they're they're stripping the forward only >> and that's what it is. So similarly emote only. >> Well done. >> Yeah. And it's I mean again this is something I demoed to them and they said no no issues here with dollar sign repeat me with that using that two user using dollar sign one. It'll execute variables on user input. And again with this dollar sign too that's sort of getting the brain thinking that's just array indexing. So what happens if we then do the familiar array index of a colon saying take everything after the second variable second third fourth and nevertheless it is going to repeat every variable including and after that second index. And this is where the fun begins again with bots talking to each other. Dream elements lets you arbitrarily put anything in the front of it. you could start taking advantage of either custom commands or in this case default commands that exist on either any other bot besides stream elements because unfortunately stream elements won't respond to its own commands that it says so I can't trigger it from itself but as we see here with dollar sign commands obviously they both have this for nightbot exclamation mark commands is also the command that allows you to add commands to itself so if I wanted to I don't know let's see if I can add commands for myself using stream elements on nightbot So if I'm just a regular user in the stream and I discover this, I can then go commands add dollar sign panda and then using that other query variable, I can set that and Nightbot says the command panda has been added successfully and and I didn't add any restrictions. So that now this is available for any viewer who has permission to chat within the stream. >> Can I uh join your offline chat and then try and play with this right now? >> Oh, absolutely. >> If I ban you, can I unban you? Is that okay? You won't be able to ban me as a broadcaster, but I can bring up I have an alt account on here. >> No, I can like ban myself. >> Yeah, you would be able to to ban yourself as well. >> All right, so me on the side. I need to dollar exclamation point repeat me dollar sign two colon ban and then my name. I have been banned from >> I'm so sorry. That's cool. >> It's something else. And what's fun with that as well? I didn't mean to derail you. I just think this is so funny. >> Let's go ahead and log in with my alt account as well. Separate account. I'm now on Lethal Panda Alt. So now I'm just not the broadcaster. I'm a regular user. And now if I have access to that command and I go slash unbanned and you won't see it on the alt account, but on my broadcaster account. You can clearly see that it has been unbanned. And that is how I continue having my fun on regular accounts on other streams. Amazing stuff. >> Screenshots. Yeah, this is hysterical. Yeah, unfortunately some commands like /mod are broadcaster only. So, I'm not able to mod myself. I can't make myself a VIP, but there is a handful of things that you do have access to that would potentially disrupt the stream. And again, demoed all of this stream elements and they decided this is not a problem. >> Are there more fireworks to see in chat while we play with this or can I ask about that or should I wait a little bit later? >> So, with this adding commands to other ones, that one's kind of where a lot more fun begins as well. So I added that nightbot command right for exclamation mark panda that's going to repeat whatever I say as a moderator which means I can now make stream elements commands as well. So I can go panda and it's just going to repeat what I say. So I believe cmd for stream elements add and two and this is where we can really start taking advantage of other stream elements variables that are there. So for example what we saw with jinxy is this set title variable. Yeah, >> set title starts with that takes a space and then you can put whatever title you'd like there. So, if I then go back to the chat actually do this from >> Yeah. Alt account, right? Dark theme here. I could stop uh everyone in the in the comments. Yeah. So, we have the panda command and I'm going to make knifbot repeat command add panda 2. And if I go set title and then again take we'll use one the the one colon so that I can really grab anything I want as for the title. Yep. Says stream elements acknowledges Nightbot saying successfully added the command panda 2. So if I then go Panda 2, this should be a new title. And it's going to take a second for the interface to actually register the change. But there we go. This should be a new title. >> There's a ghost in the chat. >> There there there is. That's exactly what happened to our friend Jinxy there. >> That was the craziest part of the clip that I saw. It's like, oh, there's a there's a ghost in the live stream. >> You know, obviously that did disrupt the stream, but I did immediately report it to his mods as well. And he is now all patched. is no longer affected by this. They took care of it quite quickly as you would expect with someone with such a big following and obviously there is monetary value with how long you were streaming and that big of an audience. You would think Stream Elements also recognizes that, but evidently they're leaving it up to the streamers themselves. With this functionality, all you really need is two bots, stream elements being one of them, and Nightbot. And having any Stream Elements command that starts with that two user, that dollar sign one, and you can essentially run any command from the other bots as a moderator. And obviously you don't want regular users running commands as moderator. If you wanted that, you would make all the users moderators, but amazing stuff. Obviously, not that you can make your own commands. You have all of these different variables to work with. >> Oh yeah. Then you just open the floodgates. Can you do crazy weird wild things? Like obviously you can make Nightbot look like it's talking to another viewer. What is the opportunity for other Twitch viewers making stuff crazy, wild, and weird? Yeah, I mean especially with this setup here where I can make any command using any variable of stream elements and that's available to any user then on the stream. So we also did see this as a problem is especially in the bigger streams. People start saying what's this guy doing? They start trying it out realizing what happened and they start doing it. Obviously they don't have the context that we have that we tested this previously but they start trying their own things mimicking the commands and they figure out how they can change titles. They can do all this stuff and it becomes chaotic very quickly. There is one more interesting thing that you know I'm not >> not sure if >> I've tested this left and right. My ideal way to go about this would be to properly throw it into the likes of Burpswuite or something and fuzz it. But given how it stream elements interface, it's in a chat. It's globally rate limited to about one response every roughly half a second. Any kind of larger lists take a long time and it is very slow. And in order to actually identify the response that I'm looking for, I also need to write a script to grab each of the stream elements responses and associate that with what I'm sending within Alexa. But specifically with this dream elements variable dollar sign time. So you're meant to do stuff like dollar sign time zone. Let's go back to my regular user here. Go repeat me. dollar sign time.Uutc. Obviously it's going to relay UTC time. There's also obviously America Chicago. Did I spell something wrong? This is their their hot patch. Now it doesn't uh well that was a bit of a spoiler but that's the interesting part of that is a directory >> that's sketching me out >> right like that as soon as I saw that I was like wait a minute I've seen that before and it's never been good believe they patched it right before we got on but >> previously obviously you could do tons of you know America/ Chicago I saw that and I'm like okay that's interesting I started fuzzing it and then I saw this is a directory response now that it's stripping it. Obviously, it's not going to do it, but there is a different response. It would say if you did something like >> are there any time zones that don't have a forward slash in the name when we look at the documentation or >> don't believe so. And the other instance of like, oh, this isn't a fluke was using that forward slash. So, if you did do slash or do slash and then something there, the other response that it would have is is not a directory. That kind of confirmed behavior for me. And I'm like, is this files? Is this a file system? Is it looking for time zones inside of some kind of environment there? And I've done a lot of testing on it. At this point, it doesn't seem like there's really any way to escape whatever container environment that they've put in there from my knowledge. Obviously, there's a lot of people out there that are better than me at this as well. And I encourage you to play with it cuz again, this is intended behavior. This is not exploiting or any type of vulnerability. Crazy stuff. And this is what I would like ideally like to fuzz to try to see what files on whatever container or environment stream elements is running from. It's going to be very slow process. and I just haven't gone on and written the script to grab the responses needed and whatnot. Maybe more to come. But yeah, that super interesting as far as those responses with that time specifically. >> Was time the only one you saw that in and all of the other options for different variables you can run? Yeah. >> So there's obviously several different variables here and some of them do have like channel has other dots like channel doviewers and some of these because of what it's trying to grab when you give it to stream elements for whatever reason they don't. stream elements doesn't know what to do with it and it won't respond. So for example, even just channel viewers saying it's it's just not going to know what to grab and just leave it blank. Also in a similar vein is obviously one of the things that I thought is there's tons of variables there like why can't I just do set title like that and you know it's executing user input as variables but what happens is because repeat me is using two user it's seeing the space cutting it off and it won't do anything. The other thing is is it's not recursively grabbing any of these inputs. So if I do dollar sign zero, which should be this, it's just going to spit back dollar sign zero. I guess for them, thankfully that's the case cuz otherwise there would be much more impact that you could very easily do. And specifically that set title, I mean that doesn't even need to if you could run variables like that, you don't even need it in the front of the command. You could just put anywhere in the command, right? >> Be able to set the title of the stream to whatever you want it. There are some limiting factors. Obviously, there are certain conditions that need to be true in order for a streamer's environment to be vulnerable, but over 300 of the top 1,000 streamers do have some kind of impact from this, which is crazy. >> Can I ask how without, you know, uhoh, accidentally by any means unintentionally putting anything in the crosshairs, but is there a way to see that? I know you mentioned you said, "Oh, the the commands are public," but can you see what each command does for different streamers or >> I don't have that script actually on me. was working with this, figuring all these things out with a couple of my friends also on Discord. Shout out Stickyspot. That's our little group. And one of the guys there is who wrote this wrote the Python scraper to go check Stream Elements commands. Again, this is a tab where I'm not logged in at all. And anybody who has a Stream Elements chatbot, this is what their interface looks like. You know, streamlements.com/lethal_pand you can go and see all of their commands that they have enabled on their stream, >> including the variables and like how that's all defined. So obviously you can see all my testing previously, but one we've been using repeat me dollar sign to user. So yeah, we wrote a script to essentially just go on Twitter, look for a bunch of different streamers names, grab them, and start throwing them into the URL, scraping the page and seeing where the response started with two user dollar sign one, anything of that sort. And that is how we got our list of 300 out of a thousand. >> Does it always need to be two user dollar sign one or is it just any instance of one? >> So I mean it could be any number, right? It could be dollar sign 1 2 3 up to I assume infinity but I mean there is a character limit on Twitch for chat. So I assume up to that. The other thing is is that braces also work. Dollar sign open parenthesy or open brace close brace bracket. No warning from stream elements whatsoever as to the potential impact. >> That is wild. >> Yeah. Yeah. This is the second time I found this. The first time it was just seeing two user there and I reported that. Obviously I can understand how that's somewhat of user error on that part. They gave me the okay to go warn streamers. So, of course, all the streamers that I do end up watching every day, I'd reach out to the mods, say, "Probably fix this." But then here we are 2 years later, and that's when I found it actually process our variables from user input, which is much more problematic. And that is why it surprised me that they gave me the same response that this is intended behavior. >> Are you willing to tell me a little bit about that disclosure process? Is it like, hey, you showed them a video, you sent them like they see the clips? Like, I am just in disbelief. >> Yeah, I went on their Discord. That's that's how they handle most of their support is they have a Discord bot that handles support requests um issues and whatnot. And so I went on their discord. I made a ticket and I was talking to a support person who just this is uh obviously it's not the beginning of the report but this is deeper after I've already been told hey the two user variable is intended to use whatever the user who activates the command inputs. We recommend using this variable and if you wish to allow viewers to input their own bot responses to the command. And this is where my mind was first blown. Sadly, there is no way to disallow certain variables from being input. And my problem with that is that none of the other bots have this problem. The other bots are Nightbot, Bosaot, anything that I have found to this point will execute variables from user input. It only a bot response that is configured by a moderator or a streamer as intended where that gets executed. This is unique to stream elements. That's where my response comes from saying, I'm very confused how there's no way to disallow certain variables being input. I give the typical response on how to disallow command injection, sanitize it, trip it, do something besides just echoing a user variable and executing it. And you know, I told them this is what led to Jinxy getting banned yesterday. One of the largest streamers on this platform, nothing. They're saying we do not have a way to block certain inputs out of the box. You know, I wanted to be very explicit with them. My next one, so your stance is that users being able to execute variables in chat via two-user command response is expected and that functionality is intended and indeed not a bug or an exploit. Yeah. Well done. I'm glad we got that in the video. >> Right. I'm not exploiting. I have permission. This is permission for anyone to this with obviously the caveat. Twitch has their own set of terms of service up to them to decide whether or not this is breaking that violating that any sense. But my take on this is you don't blame the consumer for the problem created by the vendor. And it's it's just remarkable that to me what seems like such an easy fix. I mean as we saw recently they removed the forward slashes from the beginning of those inputs. Why are they allowing this all of a sudden? It should be just as simple as that filtering. >> Remove a dollar sign at least. >> Remove a dollar sign or recognized that there's a command being processed and not executed on user input. >> Okay. >> Just remarkable. >> This is this is weird. This is a weird video. But I mean, they have already established, hey, this is fine. But I know a lot of people are going to be like, whoa, wow. Okay, that explains the the Jinxy thing for one thing. But goodness gracious. Thank you so much for showing this to me, Amanda. Wow. Yeah, of course. So, you know, I hope that someone at Stream Elements sees this and realizes this isn't uh this maybe isn't what we intended for them to be able to do. Um because ultimately that's the goal. >> You notifying of them two years ago and I guess July I think we're safely in the 90 days disclosure thing. No matter what, no matter what, >> we're in the clear. >> Yeah. I mean I I really don't understand why this is a very common thing that we see with a lot of companies as well especially in the in the bug bounty world is for whatever reason people are very hesitant to admit there's a problem and bigger question mark is to go fix that problem >> I mean it's so funny with just the array indexing it just looks like a CTF challenge >> right and and that's what it felt like I mean I spent many hours after work for several days just playing with this thing so what can it do and I found that it can do quite a lot on a lot of different streams a lot of fun to play with and see. You know, it's always fun to find these types of things, especially on >> Oh, I forgot my dollar sign. I forgot my dollar sign. That's what it was, >> right? And I mean, with the slash commands as well, there's another one that we found that does work and is very impactful to a streamer would be there's SL commercial. Obviously, I'm not a >> run ad. I'm not an affiliate on Twitch and I'm not live, so it's not actually going to work on my stream. But we may or may not have seen this behavior work on other streamers where you can do/commercial 180 and run a 3minute commercial in the middle of their stream >> or ban everyone in chat. There's just so it's just again like you said, hey, every user now gets to be a mod, >> right? >> Funny and wild. >> Well done, Stream Elements. I mean, that's that's a lot of fun for me. >> Cool. Thank you so much, Panda. This is wild. a neat story. It's crazy to see the impact, right? Again, the jinxy clip is just bonkers. I hope that this is addressed the right way and I hope it's not too much egg on our face for trying to make us think about it and scream and shout after it's been all the time that you have already tried to get the attention for this. So, thank you for letting me help spread the word. >> Yeah, of course. I appreciate you having me on. >> Do you stream? Are you on uh are you on Twitch usually on Lethal Panda live streaming stuff that you're up to? I haven't streamed gosh four or five years and then when I did it was just playing games with Fred. So not really big on streaming. I'm a big watcher. So there's a good chance if you're also on Twitch you might see me in the chat somewhere. >> I'm looking at my stream elements profile and thankfully I do not have any commands. I am my head is in the sand. Well thank you again and again Panda. If folks are curious or interested how else could they chat with you or contact or if there's any other more call to action you'd like to to end us off here. >> Yeah. Uh feel free to send me an email. I can same one I contacted you with at P4ND4en.dev but again that's P4nda D3N.dev cuz this >> yeah feel free to throw that at somewhere if this does end up as a video and description whatever happy to interact with anyone who does have questions or wants to see some more cuz I'm sure there is more. >> Excellent. Thanks again and again.