S6E2: John Hammond on Security Research, Storytelling, Deception, and Getting Hired in Cybersecurity

Truth be told, and maybe this is silly, but I get to feel like my security, charlatan, fraudster imposter syndrome kick in, but I've never been a penetration tester. I've never been a a soc analyst. I've never been a detection engineer, and that is always, oh dang, that, that kind of hurts to say aloud. But I do wanna make sure that's totally transparent and known.

I've just fell into the researcher and that lets me poke and play it a little bit of everything the way I fell into that. It's no secret. Huge proponent of capture the flag and CTF, hey, being hands on, keyboard, learn and understanding different languages, different vulnerabilities, and that naturally points you a little bit more of that red team offensive security side to your point. Absolutely.

That's how, yeah, I was building out the cyber emulation course, creating some of that material and content, and that was in that direction of pen testing, but I've never. Done it. Simply Defensive brings you the industry's top practitioners, innovators, and leaders to inform, educate, and join us defensive. Hello, and welcome to the latest episode of Simply Defensive.

I'm Josh Mason and with me as always, wood Wells. Hello? And our guest today is John Hammond, researcher at Hunts YouTuber, and one of the best known educators in cybersecurity. John, welcome to the show.

Goodness gracious. Thank you so much for the warm welcome, everybody. It's super cool to be hanging out with you. Happy to be here.

Yeah. So John a lot of people know you from YouTube, from social media, from conferences how do you like to present yourself when someone's Hey, what do you do? Oh, super. Good question.

First and foremost, I feel like a lot of folks tend to just explain their day job, which may or may not be the correct answer to what do you do? Because people got passions, people got hobbies, people got stuff all out of work. But I tend. Do a lot of work.

'cause work is fun for me. Maybe that's the passion. Maybe that's the hobby. But yeah, my day job is over at Huntress.

I'm a security researcher there, which is a ton of fun to stay. Hey, chasing hackers, cutting up malware, trying to dig into what are the real world threats that are out and about in the whole land of cybersecurity. When I can I squeeze in to tell folks? Yeah.

I do have a YouTube channel. I know it sounds silly to say it out loud, but it is, it's turned into a machine of its own. It is blossomed and grown and it's very fulfilling to see what that is turned into. But sharing cybersecurity education, trying to get more, hey, hands-on, keyboard, tactical, practical stuff.

But just having a lot of fun with it. I like to showcase what's cool, what's fun, what I like. I honestly feel like security researcher is like my dream job to tell you the truth. Like you get to deal with the coolest stuff, right?

You're out there doing. Like everyone, looks at pen testers and go, oh, look at that. I'm doing all this cool stuff where the researcher like, you're ha, you're in your own playing field where yeah, you get to do these exploits and do stuff, but then you also get to detect them. You get to share your evidence with the greater community, right?

And help defend people in a, I think, a larger scale than just your organization, which is also really cool. And trust me, I know plenty of your blogs I've used in my research, thank you. Yeah, I think. I always feel maybe sometimes it's a little unfair just because security researcher is flexible.

Just as you mentioned you have your own playing field. You get to do just what's interesting and cool and what you think will bring the most value, and sometimes that. Oh, leans a little bit on the, red team, red side, maybe that leans a little bit on the blue, team defense side, maybe detection work, et cetera. Or hey, getting a chance to chat with our security operations center analysts and work with them.

But, oh, maybe it's recreating a little proof of concept. Maybe it's digging into some of the exploits and seeing how this would work and like a, pen tester sign of a house. So a lot of fun, just flexibility. I'm super grateful for.

Yeah, I'm curious about that because my introduction to you was I taught the courseware that you were the SME on back at DAA for cyber threat emulation. I'd teach buffer overflows, and I'd watch your videos to learn how to properly then teach the content in class back when we were both at DC three and at that point it seemed like you were an offensive operator, and I know you've got the OS C3 or OS C3, and were you were like one of the first people to get that off Ssec. Like special cert, right?

Yes. When they bundled them. All Yeah, for sure. For some context, maybe a lot of folks are familiar with the OSCP or like the offensive security certified professional.

There were a lot of other offerings that offensive security brings out. Some being offensive security, web exploitation some being in experienced penetration tester and more of inside of a attack and defense, active directory environments, and even more for exploit development. So when they bundled those up in a halo cert, when you have OSED, the exploit development, OSEP. Experience, pen tester, whatever, active directory.

And then we, for web exploitation, they called that OSCE three. Which is that halo yes. All of them combined in this cool triforce power. I guess that was new at the time when I was so excited to dive into.

OSED and OSWE and somehow, some way I got that email from Ning, I believe I might be getting the name wrong, but the CEO chief Executive Officer over at Offs SEC in offensive security. That said, you got there first. You were the first to get all three. And I was like, oh, this is cool.

I caught all the Pokemon, yeah, of course. Nice. Do you feel like, were you headed down the path of wanting to be a pen tester and write exploits and do all that stuff, or do you feel like you've, did you divert from a path or. Was that, are you, have you just gone with like the way the roads opened up in front of you?

Truth be told and maybe this is silly, but I, get to feel like my security charlatan fraudster imposter syndrome kick in, but I've never been a penetration tester. I've never. Been a SOC analyst. I've never been a detection engineer.

And that is always, oh dang, that, that kind of hurts to say aloud. But I do wanna make sure that's totally transparent and known. I've just fell into the researcher end that lets me poke and play it. A little bit of everything.

The way I fell into that, it's no secret I was a huge, proponent of capture the flag, CTF, hey, being hands on, keyboard, learn and understanding different languages, different vulnerabilities, and that naturally points you a little bit more of that red team offensive security side. To your point. Absolutely. That's how, yeah.

I was building out the cyber threat emulation course, creating some of that material and content. And that was in that direction of pen testing, but I've never. Done it. But all those skills lend themselves to even, oh, understanding how some malware comes to life, how some attack chains could be built out on the end points.

So it almost for industry work and for my career, that points me more blue than it does red I have an interesting one where, okay, so I know I've heard you talk about this before, but I honestly think being outspoken as you are and also. Being in cyber is always rare, right? Being able to tell a good story. Not everyone can do it.

Not everyone can hold attention. And I know, or at least I've heard you have a performance background, right? Or a little bit of one. Which I think I, I was in a couple plays and stuff like that and I was a class clown, but definitely not as bad.

But how do you think being able to tell a good story, at least from a threat research perspective, has affected your career? Oh, okay. Your question first. I'm sorry.

And then I know I'll Yeah, Go for it. Yeah. Yeah. Go for it.

All good. I totally, without a doubt, a thousand percent because you. In your work, no matter what it is, whatever role you may have, blue, red, whatever, blah, blah, blah. You are communicating with people and they're gonna be in their own different.

Walk of life with their own experiences with all that they've gone through. And they might have either just a different understanding or even interpretation of cybersecurity stuff. And I know that's super vague. I know that Oh yeah.

Big broad concepts there. But can you genuinely communicate to them? Can you hold their attention and can you tell them something that's important, that's actionable, that's very necessary for what they need to know in a way that. Relates to them or, bridges, the gap between, oh, their worldview and how they see everything going on around them compared to what and know and understand everything around you.

So the best way, usually just being able to make that for one thing good and something they can receive is a story. And then how to be able to retain that, to remember that, to do something with it. That's a story. Yeah.

One of the points in my threat intel class that I teach is like being able to tell a story. And so I always point people over, like Jason Blanchard has some really good stuff about how to tell stories, right? And I think that's like a huge differentiator that it's harder to learn too. 'cause you don't have the opportunity to tell stories.

But once you find someone who you can pay attention to a lot and can take technical terms and know how not just how to speak to them, but how to speak to them, to certain people, right? And to know, to judge the crowd too is a very rare talent. And I know it's one you have, but it's a cool one too. Yeah, flattered.

I think Jason Blanchard certainly beats me out though. He wins, he hands Yeah. He's pretty good. Yeah.

The man can tell a story that I think is one of the, real tricks in in any business. If you can get people to stop and listen to you speak and actually want to hear, stick around and hear you say the next words, that is so valuable. So crucial. And if you can speak in cybersecurity and business terms I've seen you do it.

I, both of you gentlemen be able to make that translation that that's the key. How did you make that translation from the, the mindset of an attacker. Obviously you can tear apart malware, eventually figure out what it's doing in a system, but then translating that to, okay, here's now what we should do for defenses and why you should care about it. Obviously a lot of weight.

What you teach in CTI and what a lot of defenders are doing. But how can someone start learning how to do that? How can someone practice that if they wanted to get into the like CTI field or into the Yeah, I guess threat intel Oh. Threat research.

of field Yeah. I, for one thing, good question and a tough thing to answer because I really. And maybe it sounds so boring and so basic, but I think it is the right answer of first and foremost, hey, do something that you think is fun, that you enjoy, that you like and you're willing to do more of, because it is something you enjoy and it's fun and it's passion. So that may or may not be, oh, strictly down the path of threat, intel, threat research, blue team, defense, et cetera.

If it. It if it's just more fun to Oh, kinda learn a little bit more of how these hacks work, how these vulnerabilities come together, exploits and that attack chain. The attack chain, I think is the most interesting aspect to it. Because if you didn't, if you then wanted to bring that to the other flare or to something, be a little bit more aligned with Sure.

Threat, intel, threat research, whatever bucket and name tag you wanna put on it, then. Think about how did the attack chain come to life? Literally, I know people keep, oh, they use the cyber kill chain as a cool analogy in all these different words, but genuinely think of a chain because each of those little links, each of those components are things that you would now have an opportunity to break the chain. Put a mitigation, put some remediation in place, stop or block one aspect of what happened and when.

And then the more knowledge you have on all those different parts, the better you're gonna be at, oh, I know. This is gonna drop a file in this location, but if there were a file already there maybe we could cut a little like countermeasure vaccine, clever little stop gap. Oh. Actually, the permissions on that directory are probably what's ruined this whole thing.

Let's lock that down. Let's know our access controls, blah, blah, blah. You can extrapolate that and however many different ways that you want, but it is just exactly that. Understand kind of piece by piece.

You build out the chain, and is where you can get creative and innovative and think more on that front. For the people who are trying to get to that point, how can they, how do you get started? Like how do you show I know how to do this, hire me. Is it like, I think a lot of us were able to see why you got hired onto Hunts being able to watch you, I don't know.

There were a lot of us who watched you dissect things on multiple terminals at speed live streaming some in some cases and we're like. This guy knows what he's doing. Probably let's put him on some like real malware and see what he does. How do other people get into this sort of thing?

And get hired onto teams to yeah, be researchers full-time. Yeah, you get into, obviously I know kind of the chicken and the egg problem of, oh, I need experience to get a job and I need a job to get experience. And I'm sure thousands of folks gonna tell you that. I'm sure you've heard that time and time again.

So when you are learning, when you're practicing, when you're getting a chance to play, whether that's in Blue Team Labs, online, hack the box, try hack me, et cetera. The list could go on and on. I don't want to sound like, Hey do something similar to what I did, but I do think that when you build out your own portfolio. Or your own sort of, hey, notes, your write-ups, your solutions, everything that you've been learning.

You build up an awesome catalog, a whole archive of look at all this that I can do because I've already done it and I can show you, and I've got this to point to. That is. Invaluable. And I know so many folks will tell you, you probably hear it time and time again, so maybe folks are bored of that answer.

Oh, have a website, have a GitHub, build out your portfolio. But it is really just a help. A foot in the door. Definitely I, one thing, one thing I don't hear a lot of people talk about, which is something I always wanted to do but never did, was also like, throw out some like honeypots and stuff like that, right?

You don't need to work for a big security program to do security research at the end of the day, right? You get theoretically infect yourself completely and screw yourself, but you're gonna have fun doing it. You're gonna learn a lot. To tell you the truth I'm not gonna lie, I've done stuff like that where I accidentally ran malware on a host and I'm like, all right, just gotta re-image that.

But it's something that can be done too in as a pastime. There's a bunch of different honeypot open source stuff out there. And frankly there's the ability to pull down a lot of stuff and follow along with what you're doing on any run with the latest win. It's a bit much for me.

There's a reason I do sales and for pen testing company rather than doing pen testing. I've realized what I like to do with my day. But for other people, like if you enjoy really that stuff, excellent. There's ways of like really doing it and being able to follow along and love it.

Absolutely. If someone else makes the same video, ma or makes a video of their approach to the same like malware, that's not a bad thing. Yeah can I, actually, this is super cool. It's a little bit tactical and current, if I may.

There are incredible, phenomenal, and fantastic content creators out there. And I am just one of a few I hope, I'm in that cool sweet group. But there are so many that I adore and look up to. And a good friend of mine, genuinely from college days while I was at the Coast Guard Academy, he was at the military academy at West Point.

Ed or low level, some might fo, some might know his online handle. It used to be low level learning. I think now he shortened it to be cool hip low level. But he had just gotten out a video on Docker, the containerization kind of capability for, running a little kind of, not really a virtual machine, but a container to, to run more code and applications in this sort of sandbox area.

But there was some silly shenanigans of vulnerability for Docker on Windows, where that. API or like the control plane that could handle and spawn off and spin up new containers was exposed and there was no authentication. There was no access control in the middle of it. So even from inside of a guest container, you could create and spawn and mount the host computer file system and then get, oh, remote code execution, critical damage, 9.

8 cv, blah, blah, blah. And Ed put out this video. And I put out. The same video, basically covering and showing the same thing.

And I feel I, feel humanly the certain amount of guilt and shame oh dang, someone beat me to the punch. And it's the same stuff. But the way that you tell a story, the way that you explain what the CSRF or SSRF vulnerability might be. That could totally relate to more folks in a different way than another content creator.

So I know I'm seeing the I'm, having the shame of Hey, someone already talked about this a couple days ago. It's look, I'm not trying to announce this thing. This isn't some breaking news. This is, I hope, an educational vessel that will live and permeate throughout.

Time. Someone's gonna find this video however many years on from now, and I hope that'll bring value to them, maybe some way, somehow down the line. So still do it. Still get it out there.

Even if oh, someone else already has your presentation, your way, your story is still gonna resonate with folks. I think huge. I watched your, video. It's really, it was really old on alternative data streams and Windows file system.

I watched that pro, yeah, it was an old one. But the thing is I built a detection for it and of course, what do you do? You gotta run the de detect, you got an attack and I was able watching your videos to able to follow along and there was like countless other videos, but it was. A lit like that attack is actually pretty old, right?

Yes. it's not a new thing, but once again, like you said, you coming, you creating it even though there's plenty of other ones. And honestly, you're already a trusted source. So I knew that was a, slam dunk person to go to.

Yeah, it was a while. It was probably like two years ago. It was a cool detection too. Was that the one, and I'm gonna nerd out here.

Forgive me, I'm so sorry because the. No, you're all Cool thing about the cool thing about alternate data streams. 'cause we saw some, like some ransomware gang doing this however many months or times ago. If you put an alternate data stream, which is a little, I don't know, Easter egg of the N Ntfs or Windows file system, if you put it at the absolute root of the drive, like C colon Yep.

then you can't. them. You'll never be able to list them out or even know that they existed. You just had to know exactly the name that you chose, and it's like a certain kind of secret you could hide away.

yeah, that was the exact video, and so writing a detection for it, I saw the same report. And then had to do like a quick little writeup for ir, right? Hey, if you guys like see something like this hey, you have to go to this exact location, Sweet. what we're gonna have to do.

Or at the end of the day, we just nuke the system. are those small, fun things, though I hope, again, they all add up. They compound over time. The parts of the attack chain, all those links in the chain where All right.

just get a little bit more understanding, more of the context, more of the knowhow, Hey you're, you got a sword and shield there. For sure. I remember, yeah, four or five years ago especially during the pandemic. A lot of videos about Tri Hack Me Hack the Box CTFs.

Now I know you still are doing CTFs, but you're building them and hosting them and teaching them. Are you still participating? Are you on a CTF team anymore or are you more on the teach create and. Yeah.

Let me say this breaks my heart. I wish I were doing more pure capture the flag and playing CTF and participating in a lot of the war games as I am these days. I, that has faded away a lot and it breaks my heart. I'm super sad.

But it's I, think outside looking in, if I were to zoom way out, I think in my own growth, like in my own trajectory, that's getting older, getting married hey, trying to get in the industry, do more for work and stuff, and life, that takes up time. So your priorities just shift a little bit. And I think everyone goes through that. I don't know if you all Yeah.

Yep. Exactly the same way. I don't do CTFs at all, and I wish I could. I know it.

Yeah. students, all of our young guns listening, do it while you can. Yeah, it's definitely a young man's game, right? Going to a conference nowadays and sitting down to A CTF.

There's no way I want to do it just because it's more fun going off for me and talking to people where I've done most of the CTFs. I feel like the other interesting part for me is half the time I feel like it's just learning whatever tool the F is in. That's the real struggle. I know the attack chain, but yeah.

Yeah. Now we're coordinating conferences, not Trying to beat the CTF. If we upgraded from CTFs. Seriously.

What, would you love to see be the new trend? So now that you said it, not me. I, consider myself old, but now if you're willing to put yourself in the same old person bucket as the rest of us. 'cause Wade's definitely old like me.

What would you like to see out of the next generations, John Hammond? And do you know of them if so, yeah, who are they and who should we point the should we be pointing 'em out to folks? Very sweet, very flattering. I, don't think I could give any.

Oh, names or, just shooting from the hip. Pull a name outta the hat for Cool and incredible. There are so many phenomenal folks. A lot of them are doing some sweet stuff with the US cyber team or some of the US cyber games.

A lot of those kids are geniuses. They're absolute wizards. What I hope we do both as more Yeah. Even the practitioners, the people that are working in, the trenches and as an industry, I.

This is totally just a John opinion, but I think it's so cool when we now know this blue and red team side, and especially on the defensive end. 'cause I know that's the focus of our podcast and conversation here. We can put these together when you start to get a little bit of trickery for the adversaries and defend it in that way. What I mean by that.

May or may not be a hot topic for folks, but I'm a huge proponent of like deception. Yes. Yes. Ah.

And folks are always, yeah, let me throw out a honeypot. Let me get some network device that, oh, ha, I can, if you end map it, the ports go away bonkers. Sure. But I want on the end points, 'cause these attack chains this trade craft all these living off the land tricks and all that hey, freak out and scare the attackers by putting a couple landmines there.

Those I think will be really awesome. When you put that together with detection engineering, when you put that together with deception engineering in a sweet, wild way. that I think is the coolest, perfect blend for both red and blue, and I hope that gets much more love and is embraced by, yeah, the new generation, if I may say I love it. it.

That is literally deception is one of my favorites. Frustrated, like coming from John Strand, right? With the deception engineering courses and me, I've deployed several deception technologies at a couple companies and it's always literally been my favorite because you just, you hear the red team cry, you win. It wins all the time.

It's easy wins. Yeah. All day. As a solutions architect, like sales engineer type.

If I turn in a old report to someone on their external and they're like, haha, those are all my honeypots. I'm like, excellent. Great. Perfect.

Good. Let's get some people looking at the stuff and get past that. At the real stuff. AKA, he hates deception is what he is saying No, that.

That shows me someone's at a, great level of maturity in their cyber program. That's the So as a sales dude that's There, is, this could be about that though. People think you have to be super mature to do deception. I don't think you have to be that mature.

You just have to have good notes, right? Like it to deploy deception and at least in an internal network is fairly easy, fairly cheap, thanks to Thinkest, right? And is not, it is definitely like free if you think about it correctly. That's the one thing like fake I'm talking to though.

Oh yeah. The people you're talking to a lot different. Yeah. Setting up some like fake ad records of a Windows 2003 box on your network with an IP address.

Boom. Dude, that's gonna catch people all day, Nice. I will sprinkle in some, of that sugar though, just as you mentioned. Yeah.

Usually this is, that is. Normally a ladder end of you bolstering and building your security posture. Get all the fundamentals, get the bare bone basics, get all that stuff locked in first, do the two factor education, blah, blah, blah. Hey, make sure we've got the training in place, yada, yada, yada.

Checklists, asset application inventory, everyone knows, but we need to get everyone to get that right first. Yeah. That. If I start seeing that and they start talking about it, I'm hoping I'm, assuming that they've, they're along the same lines as what you just mentioned, that they've done all those basics and that we're having a, mature conversation about yeah, like we're, we've done all these things and now we're having fun okay, cool.

Now let's like have some real great Oh yeah. Yeah. You probably understand it as well, I'm sure. Yeah.

Hunter's customers are also in that similar vein. I wanna have one goofy question. If reverse engineering malware were a video game, what's been your hardest boss fight so far? Been like the one thing where you've been like, this sucked.

Can I maybe level set it in a cool way? I'll be the first to admit I am not all that sharp inside of a. I can't read assembly fluent by any means. I've gotta jump around.

I hope I can find a decompiler if that works well. So raw op codes and machine codes, I struggle with it. Maybe not reversing, but analysis. Maybe a, yeah.

Was there a. A a malware, oh. Or is that the thing that, like the part that is, has been the hardest for you? Is the using like a Gira or an ipro.

Yeah, so it's neat because I think in the real world a lot of times you don't always get to that hardcore compiled flat binary. You'll see folks using PowerShell. You'll see them using silly cutesy like Visual Basic Script or JS Script or Python or silly scripting languages that still get them to the place where they're. Doing damage running info dealer, doing drop in ransomware, and those can be much more easily signatured and oh, figured out, analyzed in a dynamic sandbox.

So those are always the hard bosses for me as to okay, I gotta have to crack open Gira, Ida binary, ninja, and then just drone through however many lines of assembly op codes and instructions. Gotcha. it's tough. I'll be the first to admit.

So I do like when, oh, we get to play with some of those script-based malware while they stage and prepare all these droppers and lures and all that. All to eventually get to what is the end of the attack chain. But the whole rest of it is neat and fun and cool. I don't know if I answered your question.

No, you did. I got it. I get that. Yeah.

Assembly and messy, non flat. Binary stuff in like a disassembler being the pain in the butt. Yeah. that's relatable thing for a lot of folks tuning in.

'cause you might be in the same boat. Hey man, it's tough getting feel that. I felt that but blue teams are never gonna deal with exactly. right?

You're gonna hire some type of IR company and they're gonna come in. Some dude who's specialized been doing that for 20 years. No one ever like this, like exactly what you said. The scripts are what we all look at because we can easily read them and understand and pull out those atomic IOCs out of them and follow the chain.

But that last piece, that EXE, I don't think I've ever actually taken apart one. Just drop it in a sandbox, then see what it does. It's easier to do. Yeah, folks will use virus, total folks will use vm, right?

Folks will use any, run, whatever to see the dynamic analysis. So I hope that doesn't spook or scare anyone when they're thinking about, oh, malware analysis, researcher, reverse engineering. There is Much more to it than flat. Compiled hardcore XE or, any of that.

So I hope you know that helps even just set expectations and levels set for the folks tuning in. You don't have to fight those hard bosses and dragons all the time. I usually don't. Yeah.

Yeah. Wade, do Yeah, usually we end on one question. What is your one piece of advice for a blue teamer? It can be any level, can be any grade, any person, anywhere.

Just straight blue teamer. General advice. Huh Yeah, it's a hard one. I think I've got it.

Okay. Maybe everyone says the same thing. I don't know, but. Surprisingly, no one has really said the same thing.

almost. Yeah. I'm sure someone will maybe I'm duplicating someone now. I think we've already ran all over the map to talk about, Hey, make sure it's fun, make sure it's a passion, make sure it's something that you enjoy and you can show your work kind of thing.

But what I would give is my best advice, especially for blue teamers or the folks doing defense work. Take notes, document, documentation, the worst, the thing that everyone hates. But seriously put it in a place that other folks can see and read and can refer back to so that something doesn't live and die in a slack thread. You know what I mean?

Put it in a wiki. left an organization and then two weeks later I got hit up, but Hey this canary just went off. Like, why? And I'm like, whoa, I don't remember.

Write it down. Yep, No, it was great. It was a good one. That's fresh.

notion, obsidian what's your note? Taking platform of choice. I am an obsidian junkie. I'll be the Okay.

All right. Still use a little bit of notion just for like organization work, but for Off the cuff, I need to just jot something down. Obsidian makes it the most easy, thing. Agree.

But if I may, realistically, that should be like for an org for organizations. Confluence. A Wiki, something to Atlassian, the yeah, it's like the the graveyard of all blue teams is Atlassian, just all of their products together. Confluence in Jira.

A SharePoint, a OneNote, a something, that lasts that most, a Google Doc that multiple people have access to. Something word. John, guys. I feel like I've been rambling for too long.

Sorry we ran so late. Yeah, you're all good ahead. having a guest is you talk. If they wanted us to talk, they'd invite us.

Yeah. Dude. So John, if people wanna find more about you, where would they go? Oh totally.

Hey, you can track me down out on the internet you'll see my ugly mug just looking around for that redhead kiddo. But just my name, John Hammonds on YouTube, on Twitter, on LinkedIn. Please don't hesitate. Don't be a stranger.

Would love to chat anytime. Reach out. It might take me a little bit to get to you, but I will absolutely do want to hear from you. So see me on out online.

Awesome. if people wanted just tacking training? Is there a place that they could Thank you so much. Totally.

Yeah Some fun extra venture that we've been up to is getting some other curriculum, material training out the door. That is just hacking training or JHT. If folks wanted to dive in, any of that fun stuff, whether it's free name, your price, or any pay what you want, shenanigans just hacking.com.

So thank you. Appreciate the shout out. of course. Big fan.

Thank you John for joining us. This has been a lot of fun as always. See you in a couple months in Deadwood. don't know if I'll make it out, but I'm trying my darnedest without a doubt.

Okay? understand. Good stuff. Alright folks, if you enjoyed this episode subscribe all of that fun stuff.

Thank you to our sponsors and we'll see you next week See, bye.