Thursday, May 11, 2017

OK...HUM HUM...DRONES HACKING..HUM HUM

double escape sequence inside a url : The request filtering module is configured to deny a request that contains a double escape sequence


What I am wondering is that what kind of security holes I am opening with this implementation.
On my ASP.NET MVC application, I am trying to implement a URL like below :
/product/tags/for+families
When I try to run my application with default configurations, I am getting this message with 404.11 Response Code :
HTTP Error 404.11 - Not Found
The request filtering module is configured to deny a request that contains a double escape sequence.
I can get around with this error by implementing the below code inside my web.config :




So, now I am not getting any 404.11.


HUM HUM...DRONES

  1. WHAT IS ZAXNET?
  2. ZaxNet is a wireless network that runs on a user selectable 2.4 GHz RF signal. ZaxNet is used for the distribution of timecode, IFB audio and metadata. That same ZaxNet signal is also is used to control TRX wireless transmitters.
  3. ZaxNet gives you the ability to control any Zaxcom TRX wireless remotely, so there is no need to approach talent and fumble with a transmitter anymore. You can remotely change the
  4. frequency, pre-amp gain, transmitter output power and have the ability to place
  5. the transmitter’s built-in recorder into record, playback and stop modes. All TRX transmitters also receive timecode for the built-in recorder via ZaxNet.
  6. ZaxNet will also distribute audio, timecode and metadata over the same ZaxNet 2.4GHz frequency. This allows you to send timecode and audio throughout your set. An ERX-TCDwill receive Zaxnet and simultaneously output frame accurate timecode and audio. So an ERX-TCD mounted on a camera or digital slate will keep everything in perfect sync since the ERX will be constantly be re-jamming its timecode via ZaxNet. Another option is to use the ERX-TCD to simultaneously feed both timecode as well as a mono audio track to any camera (even if the camera does not have a  timecode input).
  7. An ERX body pack receiver can also be used on set for anyone to monitor audio via the same ZaxNet signal. Not only can you use an ERX for monitoring audio but it can also aid in taking script notes since the LCD on the ERX can display timecode, user bits, and scene and take information.



Mechanic: Resurrection (2016) – Official Trailer - Jason Statham, Jessic...

Wednesday, May 10, 2017

gain on hacking television broadcast; since LTE there's no more rogue modems; the MIM's its typically pivoting penetrating offensive; IT have dual horned connections; let's imagine that you attack LTE by sniffing the base station:

Subframe: 0
BCCH-BCH-Message
message
dl-Bandwidth: n50
phich-Config
phich-Duration: normal
phich-Resource: one
systemFrameNumber: {8
bits|0x17}
spare: {10 bits|0x0000|Right
Aligned}


http://www.ee.columbia.edu/~roger/ShmooCon_talk_final_01162016.pdf

and then, while you're in the midlea .

How to restart RDP without rebooting windows

WARNING: Test this process before you try it on an production system, to make sure you like the results and have the process down.
Problem:
RDP has stopped working but your server still work just users can’t connect to modify applications
The most common fix is to reboot windows, because “Remote Desktop Services” aka TermService can’t be restarted at least thats the case on 2003 as the option is grayed out. This will also create an outage just for a remote control issue and thats not always desirable.
The fix: (remotely)
from command line
  1. tasklist /s \\servername /svc /fi “imagename eq svchost.exe” (locate PID for TermService)
  2. taskkill /s \\servername /pid xxxx (may need /f to force, UAC might give problems as well)
  3. sc \\servername start TermService
The Fix: (local, using remote admin card/other remote control software/other remote command line)
From command line
  1. tasklist /svc /fi “imagename eq svchost.exe” (locate PID for TermService)
  2. taskkill /pid xxxx (may need /f to force, UAC might give problems as well)
  3. sc \\servername start TermService
more helpful RDP troubleshooting

Monday, May 8, 2017

An explosive composition comprises a porous fuel and an oxidizer. The porous fuel is a solid with a structure size measuring between about 2 nm and 1000 nm

Integrated thin film explosive micro-detonator 
US 7597046 B1
RESUMO
A method of making a thin film explosive detonator includes forming a substrate layer; depositing a metal layer in situ on the substrate layer; and reacting the metal layer to form a primary explosive layer. The method and apparatus formed thereby integrates fabrication of a micro-detonator in a monolithic MEMS structure using “in-situ” production of the explosive material within the apparatus, in sizes with linear dimensions below about 1 mm. The method is applicable to high-volume low-cost manufacturing of MEMS safety-and-arming devices. The apparatus can be initiated either electrically or mechanically at either a single point or multiple points, using energies of less than about 1 mJ.

Sunday, May 7, 2017

ALCOHOL ADDICTION SUBSTITUTE

Gamma-hydroxybutyrate (GHB)
Basic Synthesis Procedure

This piece is intended to describe the basic GHB synthesis procedure for those who are interested. It is not meant to be instructions for how to make GHB. It does not (and is not intended to) contain all the information you would need if you were actually going to attempt the procedure. Please do not contact us asking for further instructions.



Production of GHB consists simply of mixing "lactone" (short for gamma butyrlactone) and lye (sodium hydroxide) in the proper amounts. The only equipment necessary for doing this in grey and black market production are: a scale which can measure grams accurately (or premeasured chemicals such as what comes with a GHB kit, though kits are much less available now that GHB has been scheduled in the U.S.), a container for the reaction, pH papers, and some human-safe acid such as vinegar or lemon juice, and someblue food coloring. The chemicals are mixed according to simple ratios which are available on the internet.

The biggest dangers of black market GHB is that the originating chemicals are often not human-consumption grade and may contain impurities or contaminants. In practice, however, high grade lactone and sodium hydroxide have been easily accessible from online and local chemical suppliers. Neither lactone nor lye are currently controlled anywhere in the US to my knowledge (Jan '99). There are many chemical suppliers on the net and otherwise who sell these very common chemicals.

Sodium hydroxide (lye) is a powerful and dangerous base which can and will burn exposed skin. Unreacted lye which is swallowed or that contacts sensitive areas like the mouth will burn and can kill. Lye is normally stored as a dry material and when kept very dry it does not react quickly; thus the main danger is getting it wet and then leaving it. Gamma butyrlactone, on the other hand, is a relatively safe chemical to handle.

The chemical reaction between the gamma butyrlactone and the sodium hydroxide (lye) is exothermic, meaning it creates energy/heat when they are mixed. This requires that the GHB chemist have a pyrex or borosilicate glass beaker which won't crack when heated. Metal pans should not be used as the chemicals can react with the pan leaving the chemist with metal in their finished product. Pyrex or borosilicate beakers can be purchased at chemical supply stores, and some home chemists use extra large pyrex measuring cups available at home stores.

The actual process of making GHB is considered some of the simplest home chemistry possible in the grey/black market, which is one of the main reasons for GHB's popularity and wide spread use. The process consists of putting lactone into the heat-resistant container, adding a small amount of water, and then mixing NaOH slowly into the solution. This is usually done over a hot water bath to make it easier for the sodium hydroxide to go into solution. The solution of NaOH and lactone are heated for 10-30 minutes over simmering water in order to force any residual lactone and NaOH to react.

By smelling GHB liquids it is possible to tell whether there is unreacted lactone in the solution. The primary indicator used to determine if the reaction is complete and useable is pH. The pH of safe liquids are generally between pH 6 and 8. Home chemists use pH papers to test the acidity/alkalinity of their products and then use more NaOH or a little lemon juice or vinegar (acetic acid) to adjust the pH to between 7 and 8. Some chemists say that it is best to keep the acididity of their liquid GHB nearer 8 in order to keep the lactone from 'coming back out of solution'.

Because of the shift in laws, other GHB-relatives have been popular as well including 1,4 butanediol and just straight lactone (it is said to convert to GHB in the stomach). Some 'diols' are said to be heavy kidney loads, but there have been no reports yet of serious long term health problems resulting from ingestion of 1,4b.

Consuming any GHB salt should be combined with consuming excess water as it is a very heavy salt load -- normal dosages of Na-GHB or K-GHB are in the 1-3 gram range, sometimes taken multiple times per day. Each gram of GHB contains a large amount of either Potassium (K) or Sodium (Na) salt. A high salt diet can be hard on the kidneys as well as causing other health problems. Making sure to drink plenty of water with GHB might help reduce kidney problems.

Once the GHB has been adjusted to the correct pH it should be cooled (either at room temperature, or in the refrigerator). When it is cool, add a little blue food coloring to the GHB. GHB is a clear liquid which visually can be easily mistaken for water. Despite it's relatively strong taste there have been quite a few cases of accidental ingestion of GHB where an individual takes a drink of what they think is water...only realizing after they've swallowed that it obviously was something else. Making sure to color GHB blue can help prevent this (Blue was chosen as a good color to try to set as the standard. Red, yellow, and orange could all possibly be mistaken for some sort of juice, while green is traditionally the color of absinthe.) Erowid strongly recommends that people color their GHB blue; simply add a couple of drops of food coloring and mix it in.

Saturday, May 6, 2017

PHP script for SMS sending

Description

Simple and easy for modification, PHP script for SMS text messages sending API. SMS Gateway (Australia, United Kingdom, United States, Brazil, Türkiye, España, Suomi, México, Italia, India, France, Malaysia, Argentina, Colombia, Canada, Indonesia, Deutschland, Nigeria, Kenya, Ethiopia, Egypt, Philippines and Worldwide coverage!) through HTTP with your Virtual mobile number and delivery reports. You just have to type your account information ( https://www.proovl.com  ) and upload file on server. 

https://www.youtube.com/watch?v=dfPh7Qs_twk 
https://www.youtube.com/channel/UCYuMRNb_SRZ4FMsZjnHRZUA 


https://www.proovl.com/websms 

Numbers for SMS => https://www.proovl.com 
One-day SMS numbers => https://www.groovl.com 

receive sms online script
https://sourceforge.net/projects/sms-number/
Bulk SMS script
https://sourceforge.net/projects/bulk-sms-script/
http://aaronsmith-tech.blogspot.com/2017/04/send-text-messages-from-website-using.html 

THE "SYSTEM" ISN'T THAT STUPID, OR IT WOULD BE ALREADY DEAD

Hardware-backed Keystore

The availability of a trusted execution environment in a system on a chip (SoC) offers an opportunity for Android devices to provide hardware-backed, strong security services to the Android OS, to platform services, and even to third-party apps. Developers seeking the Android-specific extensions should go to android.security.keystore .
Keystore has been significantly enhanced in Android 6.0 with the addition of symmetric cryptographic primitives, AES and HMAC, and the addition of an access control system for hardware-backed keys. Access controls are specified during key generation and enforced for the lifetime of the key. Keys can be restricted to be usable only after the user has authenticated, and only for specified purposes or with specified cryptographic parameters. For more information, please see the Implementer's Reference .
Before Android 6.0, Android already had a simple, hardware-backed crypto services API, provided by versions 0.2 and 0.3 of the Keymaster Hardware Abstraction Layer (HAL). Keystore provided digital signing and verification operations, plus generation and import of asymmetric signing key pairs. This is already implemented on many devices, but there are many security goals that cannot easily be achieved with only a signature API. Keystore in Android 6.0 extends the Keystore API to provide a broader range of capabilities.

Goals

The goal of the Android 6.0 Keystore API and the underlying Keymaster 1.0 HAL is to provide a basic but adequate set of cryptographic primitives to allow the implementation of protocols using access-controlled, hardware-backed keys.
In addition to expanding the range of cryptographic primitives, Keystore in Android 6.0 adds the following:
  • A usage control scheme to allow key usage to be limited, to mitigate the risk of security compromise due to misuse of keys
  • An access control scheme to enable restriction of keys to specified users, clients, and a defined time range

Architecture

The Keymaster HAL is an OEM-provided, dynamically-loadable library used by the Keystore service to provide hardware-backed cryptographic services. HAL implementations must not perform any sensitive operations in user space, or even in kernel space. Sensitive operations are delegated to a secure processor reached through some kernel interface. The resulting architecture looks like the following:
Access to Keymaster
Figure 1. Access to Keymaster
Within an Android device, the "client" of the Keymaster HAL consists of multiple layers (eg app, framework, Keystore daemon), but that can be ignored for the purposes of this document. This means that the described Keymaster HAL API is low-level, used by platform-internal components, and not exposed to app developers. The higher-level API, for API level 23, is described on the Android Developer site .
The purpose of the Keymaster HAL is not to implement the security-sensitive algorithms but only to marshal and unmarshal requests to the secure world. The wire format is implementation-defined.

Compatibility with previous versions

The Keymaster v1.0 HAL is completely incompatible with the previously-released HALs, eg Keymaster v0.2 and v0.3. To facilitate interoperability on pre-Marshmallow devices that launched with the older Keymaster HALs, Keystore provides an adapter that implements the 1.0 HAL with calls to the existing hardware library. The result cannot provide the full range of functionality in the 1.0 HAL. In particular, it will only support RSA and ECDSA algorithms, and all of the key authorization enforcement will be performed by the adapter, in the non-secure world.

BINGO!

Settings.Secure

public static final class Settings.Secure 
extends Settings.NameValueTable 
java.lang.Object
   ↳android.provider.Settings.NameValueTable
    ↳android.provider.Settings.Secure


Secure system settings, containing system preferences that applications can read but are not allowed to write. These are for preferences that the user must explicitly modify through the system UI or specialized APIs for those values, not modified directly by applications.

Summary


Constants

StringACCESSIBILITY_DISPLAY_INVERSION_ENABLEDSetting that specifies whether display color inversion is enabled.
StringACCESSIBILITY_ENABLEDIf accessibility is enabled.
StringACCESSIBILITY_SPEAK_PASSWORDThis constant was deprecated in API level O. The speaking of passwords is controlled by individual accessibility services. Apps should ignore this setting and provide complete information to accessibility at all times, which was the behavior when this value was true.
StringADB_ENABLEDThis constant was deprecated in API level 17. Use ADB_ENABLED instead
StringALLOWED_GEOLOCATION_ORIGINSOrigins for which browsers should allow geolocation by default.
StringALLOW_MOCK_LOCATIONThis constant was deprecated in API level 23. This settings is not used anymore.
StringANDROID_IDA 64-bit number (as a hex string) that is randomly generated when the user first sets up the device and should remain constant for the lifetime of the user's device.
StringBACKGROUND_DATAThis constant was deprecated in API level 14. As of ICE_CREAM_SANDWICH, availability of background data depends on several combined factors. When background data is unavailable, getActiveNetworkInfo() will now appear disconnected.
StringBLUETOOTH_ONThis constant was deprecated in API level 17. Use BLUETOOTH_ON instead
StringDATA_ROAMINGThis constant was deprecated in API level 17. Use DATA_ROAMING instead
StringDEFAULT_INPUT_METHODSetting to record the input method used by default, holding the ID of the desired method.
StringDEVELOPMENT_SETTINGS_ENABLEDThis constant was deprecated in API level 17. Use DEVELOPMENT_SETTINGS_ENABLED instead
StringDEVICE_PROVISIONEDThis constant was deprecated in API level 17. Use DEVICE_PROVISIONED instead
StringENABLED_ACCESSIBILITY_SERVICESList of the enabled accessibility providers.
StringENABLED_INPUT_METHODSList of input methods that are currently enabled.
StringHTTP_PROXYThis constant was deprecated in API level 17. Use HTTP_PROXY
StringINPUT_METHOD_SELECTOR_VISIBILITYSetting to record the visibility of input method selector
StringINSTALL_NON_MARKET_APPSThis constant was deprecated in API level 17. Starting from O, apps should use canRequestPackageInstalls()
StringLOCATION_MODEThe degree of location access enabled by the user.
intLOCATION_MODE_BATTERY_SAVINGReduced power usage, such as limiting the number of GPS updates per hour.
intLOCATION_MODE_HIGH_ACCURACYBest-effort location computation allowed.
intLOCATION_MODE_OFFLocation access disabled.
intLOCATION_MODE_SENSORS_ONLYNetwork Location Provider disabled, but GPS and other sensors enabled.
StringLOCATION_PROVIDERS_ALLOWEDThis constant was deprecated in API level 19. use LOCATION_MODE and MODE_CHANGED_ACTION (or PROVIDERS_CHANGED_ACTION)
StringLOCK_PATTERN_ENABLEDThis constant was deprecated in API level 23. Use KeyguardManager to determine the state and security level of the keyguard. Accessing this setting from an app that is targeting M or later throws a SecurityException.
StringLOCK_PATTERN_TACTILE_FEEDBACK_ENABLEDThis constant was deprecated in API level 17. Starting in JELLY_BEAN_MR1 the lockscreen uses HAPTIC_FEEDBACK_ENABLED. Accessing this setting from an app that is targeting M or later throws a SecurityException.
StringLOCK_PATTERN_VISIBLEThis constant was deprecated in API level 23. Accessing this setting from an app that is targeting M or later throws a SecurityException.
StringLOGGING_IDThis constant was deprecated in API level 3. This identifier is poorly initialized and has many collisions. It should not be used.
StringNETWORK_PREFERENCEThis constant was deprecated in API level 17. Use NETWORK_PREFERENCE instead
StringPARENTAL_CONTROL_ENABLEDNo longer supported.
StringPARENTAL_CONTROL_LAST_UPDATENo longer supported.
StringPARENTAL_CONTROL_REDIRECT_URLNo longer supported.
StringSELECTED_INPUT_METHOD_SUBTYPESetting to record the input method subtype used by default, holding the ID of the desired method.
StringSETTINGS_CLASSNAMESettings classname to launch when Settings is clicked from All Applications.
StringSKIP_FIRST_USE_HINTSIf enabled, apps should try to skip any introductory hints on first launch.
StringTOUCH_EXPLORATION_ENABLEDIf touch exploration is enabled.
StringTTS_DEFAULT_COUNTRYThis constant was deprecated in API level 14. this setting is no longer in use, as of the Ice Cream Sandwich release. Apps should never need to read this setting directly, instead can query the TextToSpeech framework classes for the default locale. getLanguage().
StringTTS_DEFAULT_LANGThis constant was deprecated in API level 14. this setting is no longer in use, as of the Ice Cream Sandwich release. Apps should never need to read this setting directly, instead can query the TextToSpeech framework classes for the default locale. getLanguage().
StringTTS_DEFAULT_PITCHDefault text-to-speech engine pitch.
StringTTS_DEFAULT_RATEDefault text-to-speech engine speech rate.
StringTTS_DEFAULT_SYNTHDefault text-to-speech engine.
StringTTS_DEFAULT_VARIANTThis constant was deprecated in API level 14. this setting is no longer in use, as of the Ice Cream Sandwich release. Apps should never need to read this setting directly, instead can query the TextToSpeech framework classes for the locale that is in use getLanguage().
StringTTS_ENABLED_PLUGINSSpace delimited list of plugin packages that are enabled.
StringTTS_USE_DEFAULTSThis constant was deprecated in API level 14. The value of this setting is no longer respected by the framework text to speech APIs as of the Ice Cream Sandwich release.
StringUSB_MASS_STORAGE_ENABLEDThis constant was deprecated in API level 17. Use USB_MASS_STORAGE_ENABLED instead
StringUSE_GOOGLE_MAILThis constant was deprecated in API level 17. Use USE_GOOGLE_MAIL instead
StringWIFI_MAX_DHCP_RETRY_COUNTThis constant was deprecated in API level 17. Use WIFI_MAX_DHCP_RETRY_COUNT instead
StringWIFI_MOBILE_DATA_TRANSITION_WAKELOCK_TIMEOUT_MSThis constant was deprecated in API level 17. Use WIFI_MOBILE_DATA_TRANSITION_WAKELOCK_TIMEOUT_MS instead
StringWIFI_NETWORKS_AVAILABLE_NOTIFICATION_ONThis constant was deprecated in API level 17. Use WIFI_NETWORKS_AVAILABLE_NOTIFICATION_ON instead.
StringWIFI_NETWORKS_AVAILABLE_REPEAT_DELAYThis constant was deprecated in API level 17. Use WIFI_NETWORKS_AVAILABLE_REPEAT_DELAY instead.
StringWIFI_NUM_OPEN_NETWORKS_KEPTThis constant was deprecated in API level 17. Use WIFI_NUM_OPEN_NETWORKS_KEPT instead.
StringWIFI_ONThis constant was deprecated in API level 17. Use WIFI_ON instead.
StringWIFI_WATCHDOG_ACCEPTABLE_PACKET_LOSS_PERCENTAGEThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_AP_COUNTThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_BACKGROUND_CHECK_DELAY_MSThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_BACKGROUND_CHECK_ENABLEDThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_BACKGROUND_CHECK_TIMEOUT_MSThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_INITIAL_IGNORED_PING_COUNTThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_MAX_AP_CHECKSThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_ONThis constant was deprecated in API level 17. Use WIFI_WATCHDOG_ON instead
StringWIFI_WATCHDOG_PING_COUNTThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_PING_DELAY_MSThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_PING_TIMEOUT_MSThis constant was deprecated in API level 14. This setting is not used.
StringWIFI_WATCHDOG_WATCH_LISTThis constant was deprecated in API level 14. This setting is not used.

Inherited constants

From class android.provider.Settings.NameValueTable
From interface android.provider.BaseColumns

Fields

public static finalUriCONTENT_URIThe content:// style URL for this table

Public constructors

Settings.Secure()

Public methods

static floatgetFloat(ContentResolver cr, String name, float def)Convenience function for retrieving a single secure settings value as a floating point number.
static floatgetFloat(ContentResolver cr, String name)Convenience function for retrieving a single secure settings value as a float.
static intgetInt(ContentResolver cr, String name, int def)Convenience function for retrieving a single secure settings value as an integer.
static intgetInt(ContentResolver cr, String name)Convenience function for retrieving a single secure settings value as an integer.
static longgetLong(ContentResolver cr, String name)Convenience function for retrieving a single secure settings value as a long.
static longgetLong(ContentResolver cr, String name, long def)Convenience function for retrieving a single secure settings value as a long.
staticStringgetString(ContentResolver resolver, String name)Look up a name in the database.
staticUrigetUriFor(String name)Construct the content URI for a particular name/value pair, useful for monitoring changes with a ContentObserver.
static final booleanisLocationProviderEnabled(ContentResolver cr, String provider)This method was deprecated in API level 19. use LOCATION_MODE or isProviderEnabled(String)
static booleanputFloat(ContentResolver cr, String name, float value)Convenience function for updating a single settings value as a floating point number.
static booleanputInt(ContentResolver cr, String name, int value)Convenience function for updating a single settings value as an integer.
static booleanputLong(ContentResolver cr, String name, long value)Convenience function for updating a secure settings value as a long integer.
static booleanputString(ContentResolver resolver, String name, String value)Store a name/value pair into the database.
static final voidsetLocationProviderEnabled(ContentResolver cr, String provider, boolean enabled)This method was deprecated in API level 19. use putInt(ContentResolver, String, int) and LOCATION_MODE

Inherited methods

From class android.provider.Settings.NameValueTable
From class java.lang.Object

Constants


ACCESSIBILITY_DISPLAY_INVERSION_ENABLED

added in API level 21
String ACCESSIBILITY_DISPLAY_INVERSION_ENABLED
Setting that specifies whether display color inversion is enabled.
Constant Value: "accessibility_display_inversion_enabled"

ACCESSIBILITY_ENABLED

added in API level 4
String ACCESSIBILITY_ENABLED
If accessibility is enabled.
Constant Value: "accessibility_enabled"

ACCESSIBILITY_SPEAK_PASSWORD

added in API level 15
String ACCESSIBILITY_SPEAK_PASSWORD
This constant was deprecated in API level O.
The speaking of passwords is controlled by individual accessibility services. Apps should ignore this setting and provide complete information to accessibility at all times, which was the behavior when this value was true.
Whether to speak passwords while in accessibility mode.
Constant Value: "speak_password"

ADB_ENABLED

added in API level 3
String ADB_ENABLED
This constant was deprecated in API level 17.
Use ADB_ENABLED instead
Constant Value: "adb_enabled"



Energy Blackouts total electric outage graphite carbon balls trow 2 ground impact

  https://www.alibaba.com/product-detail/Graphite-Carbon-Ball-C80-Instead-of_1601156433008.html?spm=a2700.galleryofferlist.normal_offer.d_ti...