selenium: add open custom request in browser feature #4155

ArkaprabhaChakraborty · 2022-10-20T20:48:35Z

Related to: zaproxy/zaproxy#1456
Signed-off-by: ArkaprabhaChakraborty chakrabortyarkaprabha998@gmail.com

ArkaprabhaChakraborty · 2022-10-20T20:53:31Z

Wait ... now why did Java 18 fail?
Edit: A warning is failing the job :)

ArkaprabhaChakraborty · 2022-10-20T21:08:11Z

Found this. Probably won't be a wise idea to integrate it with ZAP tho... @thc202 can you please drop the ideas/headstart here?

kingthorin · 2022-10-20T21:32:58Z

You need to suppress the serialization thing in some UI classes. Search PRs a bunch were done at one or two points.

ArkaprabhaChakraborty · 2022-10-20T21:49:22Z

Got it... Apparently its there in this extension itself :).....

ArkaprabhaChakraborty

Discussions regarding PopupMenuItemOpenCustomRequestInBrowser :)

...rc/main/java/org/zaproxy/zap/extension/selenium/PopupMenuItemOpenCustomRequestInBrowser.java

ArkaprabhaChakraborty · 2022-10-26T20:19:13Z

this can be tried out now :)... just needs unit tests and help docs for completion.

kingthorin · 2023-01-06T18:34:51Z

Do you need advice on local testing or something? Is there a way we can help you cut down on pushes of small discrete changes?

thc202 · 2023-01-06T18:44:33Z

It was passing locally but failing in CI.

kingthorin · 2023-01-06T18:56:45Z

Oh okay.

ArkaprabhaChakraborty · 2023-01-06T19:03:23Z

Ahh finally :)

Helps in viewing a custom request with a browser. Signed-off-by: ArkaprabhaChakraborty <chakrabortyarkaprabha998@gmail.com>

ArkaprabhaChakraborty · 2023-01-18T20:10:25Z

ping @thc202 @kingthorin @psiinon :)
reason: impatience :)

kingthorin · 2023-01-18T20:18:24Z

I appreciate your honesty 😀

kingthorin · 2023-01-18T20:22:04Z

Code seems okay to me. I'm not sure I follow the force https part. I'll try to build this branch tonight and test it.

thc202 · 2023-01-18T20:25:44Z

The changelog and help should be updated.

...rc/main/java/org/zaproxy/zap/extension/selenium/PopupMenuItemOpenCustomRequestInBrowser.java

kingthorin · 2023-01-19T00:43:34Z

addOns/selenium/src/main/java/org/zaproxy/zap/extension/selenium/SeleniumAPI.java

+            }
+            return null;
+        } catch (Exception e) {
+            throw new ApiException(ApiException.Type.URL_NOT_FOUND, e);


I ended up with a ton of 1286162 [ZAP-IO-Server-1-17] WARN org.zaproxy.zap.extension.api.API - Request to callback URL https://demo.testfire.net/zapCallBackUrl/images/home2.jpg from 127.0.0.1 not found - this could be a callback url from a previous session or possibly an attempt to attack ZAP while testing. I guess this is due to media included in the custom request I was opening? It's awfully chatty/loggy.

I didn't understand how you got this :)..... the hist param didn't get appended :).....

kingthorin · 2023-01-19T00:46:07Z

...rc/main/java/org/zaproxy/zap/extension/selenium/PopupMenuItemOpenCustomRequestInBrowser.java

+        } catch (Exception e) {
+            View.getSingleton().showWarningDialog(e.getMessage());


I seemed to hit the exception case more often than not.

I browsed to demo.testfire.net clicked a few pages, submitted the login POST with any old values. Then tried to open a few of the things via the new menu.

I don't really understand what's "Custom" about it, but simple GETs seemed to work while other GETs failed, and the one POST I had to work with never worked.

Okay so for the POST requests, I think we need to follow the redirect/"follow the lead" to the very next GET request. Actually, I guess this was the same concern in the issue itself. I did need some views on what could be done. The main "concern" was to send modified headers and load the "result" in a browser to kind of verify/view the exploit/vulnerability.

kingthorin · 2023-01-19T00:55:18Z

I think I'm failing to grasp what this is supposed to be doing. I see the URL being replaced partially by a built callback URL but the content loaded is sometimes/generally the URL/request I've asked for.

For example if I "Open Custom Request in Browser" from the Sites Tree against http://demo.testfire.net/login.jsp in Firefox the page is displayed and tells me my Login failed 🤷. So it seems to be loading the right page but the display in the address bar is https://demo.testfire.net/zapCallBackUrl/-8942414862249798826?hist=17&null.

ArkaprabhaChakraborty · 2023-01-19T21:57:46Z

I think I'm failing to grasp what this is supposed to be doing. I see the URL being replaced partially by a built callback URL but the content loaded is sometimes/generally the URL/request I've asked for.

For example if I "Open Custom Request in Browser" from the Sites Tree against http://demo.testfire.net/login.jsp in Firefox the page is displayed and tells me my Login failed shrug. So it seems to be loading the right page but the display in the address bar is https://demo.testfire.net/zapCallBackUrl/-8942414862249798826?hist=17&null.

Did you try it with some new headers or cookies? :)

ArkaprabhaChakraborty · 2023-01-19T22:02:14Z

Most of the GETs that have a status 200 in the requestor/ request/response can be opened by this option. The fundamental difference is that this option can send in "modified" headers and cookies which is not quite possible for a normal browser. Also for "cache poisoning" attacks involving the usage of a header/cookie as a cache buster and a header/cookie as a vulnerable parameter... simply loading the URL using a browser doesn't help as it doesn't load the isolated vulnerable PoC which has been created in the cache with those cache busters... kinda helpful if we don't wanna poison the entire "base" cache response to which normal users are usually directed :P

kingthorin · 2023-01-19T22:18:27Z

Did you try it with some new headers or cookies? :)

Added when/how? I’m not prompted. Like I said I dunno how this is meant to work.

ArkaprabhaChakraborty · 2023-01-20T12:57:06Z

Did you try it with some new headers or cookies? :)

Added when/how? I’m not prompted. Like I said I dunno how this is meant to work.

In the requestor... simply modifying it? :)

kingthorin · 2023-01-20T13:50:54Z

Please tell me how users are meant to use this.

I’m currently accessing it from the Sites Tree. If I have to use Requestor first I’m going to send the request from Requestor how is that going to have an impact on my use of this?

I’m so confused and this is seeming VERY un-intuitive.

ArkaprabhaChakraborty · 2023-01-20T14:05:35Z

Please tell me how users are meant to use this.

I’m currently accessing it from the Sites Tree. If I have to use Requestor first I’m going to send the request from Requestor how is that going to have an impact on my use of this?

I’m so confused and this is seeming VERY un-intuitive.

You don't have to use the "send". Just to modify the request I mean.. I have to check the cases/ GET requests for which it's failing and decide a method for POST requests.

kingthorin · 2023-01-20T14:14:13Z

I'm still missing something here. I'll try to get time over the weekend to do a screen grab so that you can see how it's behaving for me.

ArkaprabhaChakraborty · 2023-02-25T06:33:02Z

I'm still missing something here. I'll try to get time over the weekend to do a screen grab so that you can see how it's behaving for me.

Had a talk with @kingthorin :). It didn't misbehave anymore :P. The POST request works well, tried it out on three CTF and got the flags with ease :).

ArkaprabhaChakraborty · 2023-02-25T18:59:39Z

Okay upon testing with http://demo.testfire.net/login.jsp The login request was a POST request, with the following:

Req Headers

POST http://demo.testfire.net/doLogin HTTP/1.1
Host: demo.testfire.net
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/110.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Content-Type: application/x-www-form-urlencoded
Content-Length: 85
Origin: http://demo.testfire.net
Connection: keep-alive
Referer: http://demo.testfire.net/login.jsp
Cookie: JSESSIONID=C795E2A4E041568C1B8D7FC33A325FC3
Upgrade-Insecure-Requests: 1

Req Body

uid=1%3D1%27+SELECT+*+from+tables&passw=1%3D1%27+SELECT+*+from+tables&btnSubmit=Login

Response Header

HTTP/1.1 302 Found
Server: Apache-Coyote/1.1
Location: login.jsp
Content-Length: 0
Date: Sat, 25 Feb 2023 18:44:03 GMT

And a big breaking error

ArkaprabhaChakraborty · 2023-02-25T19:08:20Z

Probably this mess-up is happening because of the moved temporarily and it's followups :)

ArkaprabhaChakraborty · 2023-03-09T16:35:42Z

293964 [ZAP-IO-Server-1-3] WARN  org.zaproxy.zap.extension.api.API - Request to callback URL https://demo.testfire.net/zapCallBackUrl/login.jsp from 127.0.0.1 not found - this could be a callback url from a previous session or possibly an attempt to attack ZAP
1678379473564   Marionette      WARN    Ignoring event 'pageshow' because document has an invalid readyState of 'uninitialized'.
306327 [Thread-17] ERROR org.zaproxy.zap.extension.selenium.PopupMenuItemOpenCustomRequestInBrowser - Reached error page: about:neterror?e=nssFailure2&u=https%3A//demo.testfire.net/zapCallBackUrl/login.jsp&c=UTF-8&d=The%20connection%20to%20the%20server%20was%20reset%20while%20the%20page%20was%20loading.
Build info: version: 'unknown', revision: 'unknown', time: 'unknown'
System info: host: 'homer', ip: '127.0.1.1', os.name: 'Linux', os.arch: 'amd64', os.version: '5.15.0-67-generic', java.version: '17.0.6'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
Capabilities {acceptInsecureCerts: true, browserName: firefox, browserVersion: 110.0.1, javascriptEnabled: true, moz:accessibilityChecks: false, moz:buildID: 20230227191043, moz:geckodriverVersion: 0.32.2, moz:headless: false, moz:platformVersion: 5.15.0-67-generic, moz:processID: 92527, moz:profile: /tmp/rust_mozprofilei9TI2p, moz:shutdownTimeout: 60000, moz:useNonSpecCompliantPointerOrigin: false, moz:webdriverClick: true, moz:windowless: false, pageLoadStrategy: normal, platform: LINUX, platformName: LINUX, proxy: Proxy(), setWindowRect: true, strictFileInteractability: false, timeouts: {implicit: 0, pageLoad: 300000, script: 30000}, unhandledPromptBehavior: dismiss and notify}
Session ID: 695162cb-6353-4d09-a770-6bb2cd12204b
org.openqa.selenium.WebDriverException: Reached error page: about:neterror?e=nssFailure2&u=https%3A//demo.testfire.net/zapCallBackUrl/login.jsp&c=UTF-8&d=The%20connection%20to%20the%20server%20was%20reset%20while%20the%20page%20was%20loading.
Build info: version: 'unknown', revision: 'unknown', time: 'unknown'
System info: host: 'homer', ip: '127.0.1.1', os.name: 'Linux', os.arch: 'amd64', os.version: '5.15.0-67-generic', java.version: '17.0.6'
Driver info: org.openqa.selenium.firefox.FirefoxDriver
Capabilities {acceptInsecureCerts: true, browserName: firefox, browserVersion: 110.0.1, javascriptEnabled: true, moz:accessibilityChecks: false, moz:buildID: 20230227191043, moz:geckodriverVersion: 0.32.2, moz:headless: false, moz:platformVersion: 5.15.0-67-generic, moz:processID: 92527, moz:profile: /tmp/rust_mozprofilei9TI2p, moz:shutdownTimeout: 60000, moz:useNonSpecCompliantPointerOrigin: false, moz:webdriverClick: true, moz:windowless: false, pageLoadStrategy: normal, platform: LINUX, platformName: LINUX, proxy: Proxy(), setWindowRect: true, strictFileInteractability: false, timeouts: {implicit: 0, pageLoad: 300000, script: 30000}, unhandledPromptBehavior: dismiss and notify}
Session ID: 695162cb-6353-4d09-a770-6bb2cd12204b
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[?:?]
        at jdk.internal.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:77) ~[?:?]
        at jdk.internal.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) ~[?:?]
        at java.lang.reflect.Constructor.newInstanceWithCaller(Constructor.java:499) ~[?:?]
        at java.lang.reflect.Constructor.newInstance(Constructor.java:480) ~[?:?]
        at org.openqa.selenium.remote.http.W3CHttpResponseCodec.createException(W3CHttpResponseCodec.java:187) ~[?:?]
        at org.openqa.selenium.remote.http.W3CHttpResponseCodec.decode(W3CHttpResponseCodec.java:122) ~[?:?]
        at org.openqa.selenium.remote.http.W3CHttpResponseCodec.decode(W3CHttpResponseCodec.java:49) ~[?:?]
        at org.openqa.selenium.remote.HttpCommandExecutor.execute(HttpCommandExecutor.java:158) ~[?:?]
        at org.openqa.selenium.remote.service.DriverCommandExecutor.execute(DriverCommandExecutor.java:83) ~[?:?]
        at org.openqa.selenium.remote.RemoteWebDriver.execute(RemoteWebDriver.java:552) ~[?:?]
        at org.openqa.selenium.remote.RemoteWebDriver.get(RemoteWebDriver.java:277) ~[?:?]
        at org.zaproxy.zap.extension.selenium.ExtensionSelenium.getProxiedBrowser(ExtensionSelenium.java:749) ~[?:?]
        at org.zaproxy.zap.extension.selenium.ExtensionSelenium.getProxiedBrowser(ExtensionSelenium.java:717) ~[?:?]
        at org.zaproxy.zap.extension.selenium.ExtensionSelenium.getProxiedBrowser(ExtensionSelenium.java:705) ~[?:?]
        at org.zaproxy.zap.extension.selenium.PopupMenuItemOpenCustomRequestInBrowser.openInBrowser(PopupMenuItemOpenCustomRequestInBrowser.java:73) ~[?:?]
        at org.zaproxy.zap.extension.selenium.PopupMenuItemOpenCustomRequestInBrowser.lambda$performAction$0(PopupMenuItemOpenCustomRequestInBrowser.java:54) ~[?:?]
        at java.lang.Thread.run(Thread.java:833) ~[?:?]

ArkaprabhaChakraborty · 2023-03-09T16:40:38Z

Following through the redirect with the URL is what's causing the problem

ArkaprabhaChakraborty · 2023-03-09T16:41:47Z

So when we hit a redirect the URL should be changed back to the actual URL and shouldn't stay as zapCallBack

ArkaprabhaChakraborty · 2023-03-09T16:46:24Z

Now how da hekkk should I do this :)... webdriver.get() is what's used by the "getProxiedBrowser" :)... Can't have a selenium addition gotta do it with whatever we have :)

ArkaprabhaChakraborty · 2023-03-09T16:49:24Z

If we have a redirect..... then kinda replace the URL in a "breakpoint-ish" fashion... that's what's coming in my mind

kingthorin · 2023-03-09T17:04:01Z

What happens if you re-write the location header? locationzap or locationbroken

Doesn't help for meta or js redirects, but it's a step.

ArkaprabhaChakraborty · 2023-03-09T17:17:30Z

Rewrite? Like rewrite after I get the 302? And not follow the redirect automtically like its happening now?

kingthorin · 2023-03-09T17:22:51Z

I mean the user is selecting a message to open in the browser and we're feeding it from ZAP. So we know what msg is it. Just get the location header (from the response), extract the value. Set location to null, and set the value back into the message as locationzap or locationbroken. So then it's technically still part of the message but the browser shouldn't be able to redirect because it has a 3xx but no destination.

ArkaprabhaChakraborty · 2023-03-09T17:24:38Z

I mean the user is selecting a message to open in the browser and we're feeding it from ZAP. So we know what msg is it. Just get the location header (from the response), extract the value. Set location to null, and set the value back into the message as locationzap or locationbroken. So then it's technically still part of the message but the browser shouldn't be able to redirect because it has a 3xx but no destination.

Wait ... wouldn't the browser redirect to /locationzap or /locationbroken then?

ArkaprabhaChakraborty · 2023-03-09T17:25:57Z

So we know what msg is it. Just get the location header (from the response), extract the value.

Sometimes we will... other times it can be a direct send... like not just a replay from ZAP's stored History

kingthorin · 2023-03-09T17:26:01Z

So if the original was location: https://demo.testfire.net/login you're going to make it locationzap: https://demo.testfire.net/login

ArkaprabhaChakraborty · 2023-03-09T17:27:04Z

So if the original was location: https://demo.testfire.net/login you're going to make it locationzap: https://demo.testfire.net/login

Ahhh got it :) but will it help the case? IT will stop the error but :)

ArkaprabhaChakraborty · 2023-03-09T17:29:36Z

Actually, I don't really wanna stop the redirect... I want it to play it out... It's kinda like the "rendered" view in burp actually

kingthorin · 2023-03-09T17:30:04Z

Well it'll mean the redirect doesn't happen which I thought was your goal.

I guess it depends when/how it's coming up.

Is it when the original was a redirect, or is it when the original worked but "now" it's redirecting (because of an invalid session or csrf or ______)?

Edit: You already have handling detecting if it should be direct or cached when opening. This should just be an additional step shouldn't it? You should be able to figure out the conditions that lead to the situation(s) and build around them. Even if for some requests we have to refuse to open them (just show a warning dialog instead ... or "for now") 🤷‍♂️

ArkaprabhaChakraborty · 2023-03-09T17:32:52Z

Is it when the original was a redirect, or is it when the original worked but "now" it's redirecting (because of an invalid session or csrf or ______)?

did figure that out as well ... for the test site if you login successfully you enter the "dashboard", else, you're redirected to the login page aka login.jsp

ArkaprabhaChakraborty · 2023-03-09T17:34:37Z

Edit: You already have handling detecting if it should be direct or cached when opening. This should just be an additional step shouldn't it? You should be able to figure out the conditions that lead to the situation(s) and build around them. Even if for some requests we have to refuse to open them (just show a warning dialog instead ... or "for now") man_shrugging

TRUEEEEE BIG BRAIN MOMENT!!!! XD

ArkaprabhaChakraborty · 2023-03-09T20:51:30Z

nope it didn't quite work

ArkaprabhaChakraborty · 2023-03-09T20:53:35Z

So even for the "correct" login apparently there is a redirect which I missed :).... it redirects to the /bank/main.jsp with session id's and stuff

Signed-off-by: ArkaprabhaChakraborty <chakrabortyarkaprabha998@gmail.com>

psiinon · 2023-08-01T08:42:50Z

Has conflicts

ArkaprabhaChakraborty · 2023-08-01T09:58:47Z

I think this one will be dropped. We couldn't decide a correct action for POST requests

kingthorin · 2023-08-01T11:34:48Z

@ArkaprabhaChakraborty are you wanting to see/work this through to completion if we can settle on the POST behavior?

ArkaprabhaChakraborty · 2023-08-01T11:42:33Z

Yes 💯. I kinda need it. Even the POST functionality (I have only encountered GET situations but POST is a necessary one). But POST is just one of them. PUT, DELETE and other situations is waiting to catch us by surprise :).

…

On Tue, Aug 1, 2023, 5:04 PM Rick M ***@***.***> wrote: @ArkaprabhaChakraborty <https://github.com/ArkaprabhaChakraborty> are you wanting to see/work this through to completion if we can settle on the POST behavior? — Reply to this email directly, view it on GitHub <#4155 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AN6F3GMIYIH5OU5VIMUZDBDXTDSWHANCNFSM6AAAAAARKQ45P4> . You are receiving this because you were mentioned.Message ID: ***@***.***>

thc202 changed the title ~~Add open custom request in browser feature~~ selenium: add open custom request in browser feature Oct 20, 2022

ArkaprabhaChakraborty commented Oct 21, 2022

View reviewed changes

...rc/main/java/org/zaproxy/zap/extension/selenium/PopupMenuItemOpenCustomRequestInBrowser.java Show resolved Hide resolved

ArkaprabhaChakraborty force-pushed the arkaprabha/add-custom-request-response-browser branch from 848061d to 7d11572 Compare October 26, 2022 11:49

ArkaprabhaChakraborty force-pushed the arkaprabha/add-custom-request-response-browser branch from ad38613 to cd4513b Compare January 7, 2023 13:27

Add 'open custom request' in browser feature

5131bda

Helps in viewing a custom request with a browser. Signed-off-by: ArkaprabhaChakraborty <chakrabortyarkaprabha998@gmail.com>

ArkaprabhaChakraborty force-pushed the arkaprabha/add-custom-request-response-browser branch from cd4513b to 5131bda Compare January 7, 2023 13:42

kingthorin reviewed Jan 19, 2023

View reviewed changes

ArkaprabhaChakraborty requested a review from kingthorin February 24, 2023 08:39

ArkaprabhaChakraborty added 2 commits March 22, 2023 22:46

Add null query check

3d2704b

Signed-off-by: ArkaprabhaChakraborty <chakrabortyarkaprabha998@gmail.com>

Add Forced status code change on redirect

357b56f

Signed-off-by: ArkaprabhaChakraborty <chakrabortyarkaprabha998@gmail.com>

		} catch (Exception e) {
		View.getSingleton().showWarningDialog(e.getMessage());

selenium: add open custom request in browser feature #4155

Are you sure you want to change the base?

selenium: add open custom request in browser feature #4155

Conversation

ArkaprabhaChakraborty commented Oct 20, 2022

ArkaprabhaChakraborty commented Oct 20, 2022 • edited

ArkaprabhaChakraborty commented Oct 20, 2022 • edited

kingthorin commented Oct 20, 2022

ArkaprabhaChakraborty commented Oct 20, 2022

ArkaprabhaChakraborty left a comment

Choose a reason for hiding this comment

ArkaprabhaChakraborty commented Oct 26, 2022

kingthorin commented Jan 6, 2023 • edited

thc202 commented Jan 6, 2023

kingthorin commented Jan 6, 2023

ArkaprabhaChakraborty commented Jan 6, 2023

ArkaprabhaChakraborty commented Jan 18, 2023

kingthorin commented Jan 18, 2023

kingthorin commented Jan 18, 2023

thc202 commented Jan 18, 2023

kingthorin Jan 19, 2023

Choose a reason for hiding this comment

ArkaprabhaChakraborty Jan 19, 2023

Choose a reason for hiding this comment

kingthorin Jan 19, 2023

Choose a reason for hiding this comment

ArkaprabhaChakraborty Jan 19, 2023

Choose a reason for hiding this comment

kingthorin commented Jan 19, 2023 • edited

ArkaprabhaChakraborty commented Jan 19, 2023

ArkaprabhaChakraborty commented Jan 19, 2023 • edited

kingthorin commented Jan 19, 2023

ArkaprabhaChakraborty commented Jan 20, 2023

kingthorin commented Jan 20, 2023 • edited

ArkaprabhaChakraborty commented Jan 20, 2023

kingthorin commented Jan 20, 2023

ArkaprabhaChakraborty commented Feb 25, 2023

ArkaprabhaChakraborty commented Feb 25, 2023

Req Headers

Req Body

Response Header

ArkaprabhaChakraborty commented Feb 25, 2023

ArkaprabhaChakraborty commented Mar 9, 2023

ArkaprabhaChakraborty commented Mar 9, 2023

ArkaprabhaChakraborty commented Mar 9, 2023

ArkaprabhaChakraborty commented Mar 9, 2023

ArkaprabhaChakraborty commented Mar 9, 2023

kingthorin commented Mar 9, 2023 • edited

ArkaprabhaChakraborty commented Mar 9, 2023

kingthorin commented Mar 9, 2023 • edited

ArkaprabhaChakraborty commented Mar 9, 2023

ArkaprabhaChakraborty commented Mar 9, 2023

kingthorin commented Mar 9, 2023

ArkaprabhaChakraborty commented Mar 9, 2023 • edited

ArkaprabhaChakraborty commented Mar 9, 2023

kingthorin commented Mar 9, 2023 • edited

ArkaprabhaChakraborty commented Mar 9, 2023

ArkaprabhaChakraborty commented Mar 9, 2023

ArkaprabhaChakraborty commented Mar 9, 2023

ArkaprabhaChakraborty commented Mar 9, 2023

psiinon commented Aug 1, 2023

ArkaprabhaChakraborty commented Aug 1, 2023

kingthorin commented Aug 1, 2023

ArkaprabhaChakraborty commented Aug 1, 2023 via email

ArkaprabhaChakraborty commented Oct 20, 2022 •

edited

ArkaprabhaChakraborty commented Oct 20, 2022 •

edited

kingthorin commented Jan 6, 2023 •

edited

kingthorin commented Jan 19, 2023 •

edited

ArkaprabhaChakraborty commented Jan 19, 2023 •

edited

kingthorin commented Jan 20, 2023 •

edited

kingthorin commented Mar 9, 2023 •

edited

kingthorin commented Mar 9, 2023 •

edited

ArkaprabhaChakraborty commented Mar 9, 2023 •

edited

kingthorin commented Mar 9, 2023 •

edited