Whats happens when a caster’s soul returns to his polymorphed body by the effect of Magic Jar?

Consider the following sequence of actions:

  • A caster casts Magic Jar and his souls travel to the chosen container
  • The caster manages to possess an NPS’s body. The caster’s class features are retained in the new body, together with the original WIS, INT and CHA scores.
  • The caster in the new body casts True Polymorph on the original body and transforms it into a dragon (for example)
  • The caster makes is soul travel back to the original, polymorphed body.

Now, what happens to the casters’ class features? Are they retained? Is there any difference between this course of actions and simply casting True Polymorph on self?

modest 2.9.2 – response body: transformed: dechunked

I would appreciate if someone can point me to the right way solving this

Have a POST for a refresh token and modsec closes the connection(?) — the browser goes into an endless loop back and forth ; using apache 2.4.6 and modsec 2.9.2 in centos 7.

  1. Can I disable modsec engine completely for this request?

  2. Doesn’t say “rule matched” in the H header and K section in audit lists so many rules to post here (but can post if someone needs it)


--522ec87e-F-- HTTP/1.1 400 Bad Request X-Frame-Options: SAMEORIGIN Cache-Control: no-store Pragma: no-cache X-Frame-Options: SAMEORIGIN Access-Control-Expose-Headers: Access-Control-Allow-Methods Access-Control-Allow-Origin: https://mysite.com Access-Control-Allow-Credentials: true Content-Type: application/json Content-Length: 69 X-XSS-Protection: 1; mode=block Connection: close     --522ec87e-H-- Apache-Handler: proxy-server Stopwatch: 1585504125443097 26443 (- - -) Stopwatch2: 1585504125443097 26443; combined=7503, p1=367, p2=6899, p3=71, p4=124, p5=41, sr=64, sw=1, l=0, gc=0 Response-Body-Transformed: Dechunked Producer: ModSecurity for Apache/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.0.0. Server: Apache Engine-Mode: "ENABLED"  --522ec87e-Z-- 

Internal server error with special characters in request body – possible vulnerability?

While blackbox testing of web-application, I found some unexpected behavior. Request body of original request, sent by browser, contained post parameter like this:

user[email]=test@test.test 

After some fuzzing, application returned 500 (Internal Server Error) on queries that started by %00 (null byte), followed by characters not equal to %09, %0a (new line), %0b, %0c, %0d and %20 (space). If it is followed by one more null byte, or one of already mentioned characters, it behaves properly.

I’m pretty new to web testing, and wondered what can cause this, and is it really unexpected behavior.

I suggested this code to execute some code and sanitizing other characters like “, ‘ and others to prevent command injection, but null byte terminates string with the command, so the command goes wrong (for example, missing ‘ or ” in the command), but why it needs other character after the null byte?

Or maybe this is related to specialized functions to send mail in other languages?

Also, I thought about database processing, but it still does not make sense, why we need this characters in the end, and why new line, space and others, changes the behavior.

What could lead to this behavior, and is it worthy point to research deeper?

If a body possessed by a user of Magic Jar is Feebleminded, and the possessor leaves the host body, who was Feebleminded?

Consider that I am possessing a host using magic jar, and that while I am possessing the host, I am subjected to the feeblemind spell and fail my saving throw.

For whatever reason after this, I decide to the leave the host body and return to the container of magic jar. Well, now a question arises: who continues to suffer the effects of feeblemind?

Which Great Elder One wants to be symbiotic with a world and rule it as part of its body?

My player wants to be a warlock of the Great Old One. The campaign would be at Forgotten Realms setting (D&D 5e).

He wants to make a pact with a thing who wants to gather all knowledge in the world and become one with the world itself (like, become a living world), to rule it.

That is a very strange concept and I can’t find any suitable creature in FR lore.

Maybe Zuggtmoy? I have no idea.

What creature from the FR lore (any editions) would be most suitable for this situation?

Can a ghost (undead creature) take over a clone body (resultant component from spell)?

Lore wise, ghosts (and demons) have nifty powers of ownership & possession – and this is often a nifty game mechanic. In fiction-fantasy they take over the most ridiculous things from cars, to people or even entire houses – going out and about wherever they like. Its just fun.

This tradition is continued in 5e. The ghost continues to have this mechanic, at least on humanoids (no mention if dragons, giants or other sentient beings have ghosts, but i digress). Demons also have mention of this in their description (monster manual) and they can take over objects – though the actual mechanic for how a DM should run this, or how & / or who they can then take over, is not mechanically developed (please correct me if i am wrong on this – such rules or rulings would TOTALLY ROCK).

This brings us to the question (above): when clone spell is cast / matures / 120 days, they get a perfect (albeit scar-free and possibly much younger) humanoid-version of the cubic-inch of flesh humanoid target-component. Groovy! When this OriginalOwner of that said cubic-inch-flesh-person ‘DIES’ (zero h.p.? chooses to leave? not turned to undead?), their soul (&/or spirit?) leaves their body and just goes over (astral? as a ghost? etherial? teleports? warp factor ten? speed force?) to their BodyPrime / Clone location. Wakes up (full hit points? all spells? remembers their death? PTSD?) and is ready to take on the world. Easy!

Assuming that this 120 day+ Clone body is Primed & Ready For Action, why can’t a passing ghost (or demon actually) just, you know, take over for a bit? Or why not forever? Why leave if / when knocked out (‘zero hit points’) – as there is no ‘imprint’ from the original host-flesh-bit’s spirit-soul-essence? Why can’t a wizard (or bard or Nagpa or powerful dragon caster… or whatever) just go into full-on business pumping out bodies of Brad Pitt when he was so sexy… or any actress named ‘Jennifer’ for that matter… or virtually anyone it can get a cube of flesh from whilst adding Gentle Repose style magic?

SO MANY CAMPAIGN IDEAS!!!

But wait a moment! How much of this is actually RAW? Luckily we have the Good Lads (and Ladies) from StackExchange to tell me what’s what. Here the good folks tell me that i have had way too many magical mushrooms.

In Short How do ghosts (&/or any alien spirit such as a demon) interface with a mature 120 day+ clone body? Can they take it over temporarily? To what extent could / would this function as a Home Body for that creature?

Honestly, this would be fun. One can imagine an entire D&D version of Altered Carbon… but we must respect the 5e RAW. Just what is that exactly?

Also: i get that this question is poorly written (‘entertaining but not concise’). I will gladly modify this in order to meet the stoic (dour? terse?) restraints required by the StackExchange Mod-Editorial community! = )

Admin privileges depending on JWT body

From a security perspective is it ok to store the permissions of a user inside the body of the Json Web Token? For example a jwt body like this:

{    "username": "lukas",    "isAdmin": true } 

The integrity of the body is verified by the signature of the token so I think it is no problem to use this technique but as it is really security relevant I want to ensure whether my thoughts are right.

If someone is under the effect of microcosm, does putting the physical body in quintessence affect their dream world?

Does putting someone’s physical body in quintessence, thus removing them from the time stream, also remove them from the dream demiplane their mind was sent to by Microcosm?

The point of this is to see if we can separate the mind and body and use Dream Travel to go to the dream created by Microcosm, with the body of the dreamer safely stored in Quintessence.

All of this assumes that Microcosm does create a dream demiplane, which by RAW may be dubious. But if it does, cheap pocket plane with better time traits we could otherwise get. Downside: dealing with monsters of the dream world might suck. Upside, pretty hard to get there if you’re not a creature related to dreams.