Manuel Caballero

Independent Security Researcher.
Perpetual Student of Life :)

[Manuel Caballero @magicmac2000]

@YouPulseX Haha =)

It's on the blog-post!

[Manuel Caballero @magicmac2000]

[ Chromium ] Stealth request that bypasses CSP, hides from DevTools, and leaks the real User-Agent (in case you faked it 😁)

https://t.co/1mNSKszJoE

[Manuel Caballero @magicmac2000]

@soutagx86 @siunam321 Great, so I didn't even steal it properly. I skipped the guy who actually found it first 🤦‍♂️😂

[Manuel Caballero @magicmac2000]

@soutagx86 @siunam321 But based on what I'm posting, it seems as if I read your research and took it as mine!! 🤣🤣🤣🤣

BTW, this thing is really useful to me, not because of the CSP but the fact that we can pass data bypassing what automated frameworks (bots) can easily see.

[Manuel Caballero @magicmac2000]

@host_down At 52 I'm still figuring it out, so you might want to pick a faster role model 😄

[Manuel Caballero @magicmac2000]

@siunam321 @soutagx86 Thanks, Siunam! I've updated the public post reflecting my sad reality 😄😄

https://t.co/1mNSKszJoE

[Manuel Caballero @magicmac2000]

@insertScript Hey Alex!!!! 😁

Same here! I had to double check it was me posting. Took me so long that by now someone else probably found the bug, reported it, got the bounty, AND spent it. But here I am, fashionably late to my own comeback. 😅

[Manuel Caballero @magicmac2000]

@soutagx86 @siunam321 Wow!! Congrats, soutag and thanks siunam for the pointer!

It seems I stumbled upon the same but a few years after haha =) Please, send me the link to the tweet to I can add proper credits to the blogpost! 😀

[Manuel Caballero @magicmac2000]

@shhnjk Haha this made my day, Jun! 😄 You were breaking browsers since 2015? And still at it. Glad the nostalgia hits! Means a lot coming from you.

https://t.co/ICCIDaOGN4
https://t.co/VbptHQAvaM

[Manuel Caballero @magicmac2000]

@shhnjk My friend, here's your PoC:

https://t.co/ekv2a8Ti23

Looks to me like a spoof.

[Manuel Caballero @magicmac2000]

@rebane2001 Thanks Rebane! ☺️ My publishing schedule is basically: one kid has a girlfriend (RIP my existence), the other ignores me on weekends. Half a Saturday is all I need. 🤣

[Manuel Caballero @magicmac2000]

@whithat444 For Chrome/FF/Safari, nope.

If you want to get examples of this on IE/Edge, you can check in the UXSS area where you will find many variations and several using javascript: and data:

https://t.co/1MgeiqoTQS

What are you trying to achieve, exactly?

[Manuel Caballero @magicmac2000]

@chlclient Striking similarities! =) It seems as if I've copied from that blog, but I haven't seen it. I've tested the prerender as described in the blog-post but it didn't work. So, apparently the snippet that you are sending has been patched, but they forgot to do it on prerender 🤣

[Manuel Caballero @magicmac2000]

@t0xodile Thanks, Thomas =) It's a bit of pure luck, really. I was trying to find a stealth extension detector and stumble upon this beauty in the middle of the research 🤣

[Manuel Caballero @magicmac2000]

@garethheyes Thanks, Garetho! You know you and Dave were big inspirations for me.

Thanks for always being so generous with your knowledge and helpful with me! ☺️

[Manuel Caballero @magicmac2000]

@PaulosYibelo Thank you, Paulos! 😄

After years of being the most important person in my kids' lives, I have now been officially downgraded to "that guy who still lives here." On the bright side, all that free time had to go somewhere. So here I am! 😄🤣

[Manuel Caballero @magicmac2000]

@PiotrBania @richinseattle @phrack Like these ones
https://t.co/9tgMUXBnNn

Cheers man! Looking forward to your next cracktros!

[Manuel Caballero @magicmac2000]

@herrcore The work that you do is wonderful. Simply awesome. If I had to start all over again, my first step would be to begin with your tutorials.

Congrats and my best wishes with the patreon!

[Manuel Caballero @magicmac2000]

@thechartist Hey Nick!

Thanks for your books and thoughts. I learned a lot from you. Now I need to put these things in action 😆😆😆.

QQ: when you say that MaxDD is -5.1%, are you measuring every day or end of month? If end of month, do you have a measurement of MaxDD intraday?

Thanks!

[Manuel Caballero @magicmac2000]

@priceactionlab @hughesanalytics Michael, fantastic book all around. I got several gems from it and for sure I was fooling myself =)

Why do you consider a filter (SMA200) invalid? Don't you think that using them to determine if an action is taken, is valid despite the fact that the number is arbitrary?

Thanks!