Tor Browser: Could a website or ISP detect modification to DOM done by users if Javascript is disabled?

I have Tor Browser (which is basically Firefox ESR) on "Safest" setting (Javascript disabled). We’re generally scolded about using extensions in it, as they can alter web traffic patterns to or from your browser, adding another fingerprinting vector by distinguishing you from other Tor Browser users.

If JS is turned off even in vanilla Firefox, and I apply modifications to the DOM (like CSS mods, zooming in etc.) after the website has finished loading, I can’t see how a website or ISP could detect what the user is doing in the DOM.

I know if you, for example, hide an element in CSS before it is fully loaded (such as the sidebar), the browser may skip downloading resources (such as icons) associated with the element. This would distinguish your web traffic patterns from other users. That’s why I wait till the page is fully loaded. I’m also careful to not trigger CSS media queries which can be set up to connect to a remote URL if triggered (or remove them first if they will be triggered).

I think the above should be enough to avoid distinguishing myself by my web traffic. Do you see any way I could be distinguished with only CSS & HTML?

What spells or magic items are available to detect lies?

I’m playing through Storm King’s Thunder, and came across an unusual magic item:

Gavel of the Venn Rune

The Gift of Truth feature for this item says:

Whenever a creature utters a lie while within the 30-foot-radius sphere, that creature takes 5 psychic damage and flinches visibly.

This is pretty cool, but it makes me wonder:

What spells or magic items are available to detect lies?

What does Detect Magic show for different Warlock special weapons?

For reference, Detect Magic snippet:

you can use your action to see a faint aura around any visible creature or object in the area that bears magic, and you learn its school of magic, if any.

Warlocks have a few unique weapon options. I am interested in what exactly does Detect Magic show for the following?

  1. A weapon created via the basic Pact of the Blade feature
  2. Magic weapon transformed to Pact of the Blade weapon (via the ritual), compared to before the ritual
  3. Pact of the Blade’s Improved Pact Weapon (feat) and its created weapon with +1 to hit and damage
  4. Hexblade’s chosen weapon, by touching a normal weapon after a long rest
  5. Hexblade’s chosen weapon, by touching a magical weapon after a long rest, compared to before choosing it

(Meta-note: I could make this 5 separate questions, but I think answer is so short, that it’s better to have this all in one place. But let me know if I really should split it up.)

How do you detect a doppelganger?

For plot purposes I replaced an NPC with a doppelganger (one of the advanced “rumored” kind that can steal memories and skills). As this quest progressed, I found that it was actually rather difficult to detect a doppelganger. In this case, he was a cleric in an order of paladins & clerics, so detect magic was out of the question. Supernatural abilities can’t be dispelled. And since the doppelganger had memories and skills (and, for plot purposes, had forgotten he was a doppelganger), a goof up or mistake in “performance” was unlikely. The party got through it and figured it out, but it did have us wondering:

Is there a spell or ability or some obvious racial “tell” that allows players to detect a doppelganger?

How can a character be able to Detect Thoughts on multiple people at once?

Since this video came out (timestamped to the important part), I have been puzzling over any spell I could find to understand what’s going on. While I know a DM can invent all they want for NPCs and enemies, I also know that Monty Martin (the DM of that game) finds pleasure in beating his players with enemies that conform to the same parameters that PCs have (thus making a RAW PC as his villain and outplaying the actual PCs). So I am sure that this demonstration of skill from the sallow-eyed man is an actual RAW spell or ability, though I have not been able to find such a trick since that episode first aired.

Does anyone know of a way that a character can be granted "mass detect thoughts"?

Will a Web Server detect a base64 encoded reverse shell on run time?

A vulnerable website blocks almost everything that is related to PE (Privilege Escalation), but when encoding the ls -al code into a base64 format, the website doesn’t block the dangerous code (at Scan Time), will the web server detect and block the code at Run Time ?

base64 -d <<< bHMgLWFs | sh: Base64 of ls -al

Web Server: Scanning the input.. Seems fine, I will not block it.

Web Server Inside: ls -al # Will it block it at run time ?

For the Purpose of Detect Magic and Identify. Would a Magic item that ran out of power for the moment be considered a magic item?

If a magic item runs on "Magic Batteries" when the Item is out of power would it be considered a magic time for the purpose of the Identify and Detect Magic spell?

For example, I have a Mirror that shows through illusions, it has crystals around it that are destroyed as you used it, you can replace the crystals for more uses when it has no crystals, would it still be considered a magic item detectable by the spells?

Would the same work for items with charges that recharge at dawn? If the item has 0 charges and is not dawn yet, would it be still be considered a magic item?