Does the Mage Hand cantrip pass through solid surfaces?

Last session, my Arcane Trickster was faced with some murky water and we needed to know how deep the bottom was. I decided to use mage hand to try to locate the bottom of the water without putting my own hand in there, but then we were stuck with the question: would my mage hand just float straight through the bottom?

Another way of wording this question would be “does mage hand go through walls”?

The spell says:

A spectral, floating hand appears at a point you choose within range.

But exactly what the hand is is not described any further. Does spectral mean “float through walls” like an incorporeal ghost, or is it spectral only in the sense that it’s not a creature or an object? Either way, if the caster sent the hand through a wall or the floor, would it go through or just bump up against the wall?

Are there any magic items in 5e that will cast Pass Without Trace?

I’ve been looking for a way for my Assassin Rogue 12/War Domain Cleric 2 character to be able to cast Pass Without Trace, so they can more easily not abandon the party and still get surprise. Getting that surprise round is the goal, so if you have another way we can do it, that’d be great. Our party does not have a druid or thief rogue, so unfortunately we cannot use the Staff of the Woodlands, which would otherwise be perfect because, well:

You can also use an action to cast the Pass without Trace spell from the staff without using any Charges.

Anyways, Does anyone know of a similar magic item that will allow us to cast pass without trace? Or an alternative way to gain surprise on our enemies other than stealthing into each room?

How are ghostly warders permitted to pass in and out of their maga’s home aegis?


Background

We have a magi with a ghostly warder founding a new covenant. One of the first orders of business is to cast aegis of hearth (AM5 p.161). Since the ghostly warder has a might score, our understanding is that they would be excluded unless they were given a token or part of the casting.

What is the mechanism for permitting a warder?

The two options that were apparent to us, but involved a follow up question were:

  • Are they given a token? If so, how can they even carry a token?
  • Are they part of the casting? If so, how can they participate in the casting of a spell?

Can objects with a spell effect pass through Leomund’s Tiny Hut?

So here’s the situation: I’m chilling inside a tiny hut I cast earlier, and some of the other party members are right outside. No one is in danger, and then someone does something to cause an attack by a bunch of mimics that look like trees. I open up my handy bag of caltrops, toss them into the air, and cast animate objects. My spikies of death whirl out of the hut and I laugh at the ensuing mayhem as I start to spray sawdust all over in a festive manner from my protective bubble.

Here my problem: I know that my equipment can pass through the tiny hut’s walls, but I also know spells can’t. This leads to my question:

Can my equipment that has a spell acting on it pass through the tiny hut‘s walls?

I’m not 100% sure I should have been allowed to do that.

Trying to use HMAC to pass a string to be verified. Is this secure

I am working on a django project and trying to create a REST api to verify email without using any database.

My present server connection is HTTP and not HTTPS

So some one using the api end point POST his email.

REQUEST:  curl --location --request POST 'http://127.0.0.1:8000/api/openlogin' \ --header 'Content-Type: application/json' \ --data-raw '{ "email":"test13@test.com", }' 

Now i am generating a random 6 digit number eg: 435667 and an email will be sent to test13@test.com

send_mail('PIN TO VERIFY','ENTER THE PIN 435667',None,[test13@test.com]) 

Send the HMAC value of 435667 as a response to this api

    raw = '435667'.encode("utf-8")     key = 'SOME_SECRET_KEY'.encode('utf-8')     hashed = hmac.new(key, raw, hashlib.sha1)     pin_hmac_hash = base64.encodebytes(hashed.digest()).decode('utf-8')     eg: pin_hmac_hash = "SOME_HMAC_HASH_OF_PIN" 

So the response for /api/openlogin will be

{ 'email': 'test13@test.com' 'pin': "SOME_HMAC_HASH_OF_PIN" } 

Now the user sends me back the pin along with the HMAC hash in the response

curl --location --request POST 'http://127.0.0.1:8000/api/verifypin' \ --header 'Content-Type: application/json' \ --data-raw '{ 'pin': "SOME_HMAC_HASH_OF_PIN", 'email': 'test13@test.com', 'emailed_pin':'435667' }' 

Will someone guess the pin from SOME_HMAC_HASH_OF_PIN.

Ofcourse i will further try to autenticate the api using JWT token. So the email cannot be tampered

This is an example of PIN but it can be any string of sensitive information. Can i rely on hmac

How do I pass a list of cookies to Wfuzz?

I know that you can pass cookies in Wfuzz by using multiple -b parameters like so: wfuzz -w /path/to/wordlist -b cookie1=foo -b cookie2=bar http://example.com/FUZZ

but I am wondering if you can pass a list of cookies, instead of doing them one by one, which takes forever and is ineffecient. I have looked everywhere for an answer it seems but I can’t find one.

Can a bipedal (chained) eidolon pass itself off as a human or similar race?

So I saw the bodyguard suggested build in the SRD and thought “That sounds awesome, but you know what will make it even better? If it were a shinobi.” Yes, I know very anime that’s just how I am. The rune is an obvious problem but giving them a fox mask would build on the anime field and hide the rune as per the rules (see below). Can a bipedal take on a human form or does it have to be a monstrous humanoid or something similar. Maybe an Aasimar or a Humanoid Fey? If not is there a way to accomplish this with feats or archetypes.

The SRD says

The eidolon’s physical appearance is up to the summoner, but it always appears as some sort of fantastical creature. This control is not fine enough to make the eidolon appear like a specific creature. The eidolon also bears a glowing rune that is identical to a rune that appears on the summoner’s forehead as long as the eidolon is summoned. While this rune can be hidden through mundane means, it cannot be concealed through magic that changes appearance, such as alter self or polymorph (although invisibility does conceal it as long as the spell lasts).

Biped Starting Statistics

Size Medium; Speed 30 ft.; AC +2 natural armor; Saves Fort (good), Ref (bad), Will (good); Attack 2 claws (1d4); Ability Scores Str 16, Dex 12, Con 13, Int 7, Wis 10, Cha 11

Free Evolutions

Claws, limbs (arms), limbs (legs).

Bodyguard Source: PZO1117

The eidolon looks like a humanoid warrior. The natural armor of a Bodyguard eidolon appears to be a suit of metal plate, though this armor is actually part of the eidolon’s body. Bodyguard eidolons are normally trained in a variety of dangerous weapons.

11 points: Base Form biped; Primary Evolutions improved natural armor, weapon training; Secondary Evolutions ability increase (Strength), fast healing, weapon training (martial).

An unchained Eidolon can do that via the Acesstor Subtype and many others which is why I specified chained which from what I’ve heard is a massive upgrade from unchained.

Ancestor source: PZO9473 Whether created by bonding with the soul of a petitioner that was the summoner’s ancestor in life or calling upon the impressions of such a soul left behind on the Ethereal Plane or the Akashic Record, ancestor eidolons are outsiders cast in the mold of mortals, and exhibit extraordinary skill and talent. They usually appear as idealized versions of the bodies they possessed while still alive, but distinctive and proud. Ancestor eidolons lend whatever aid they can to their summoner, who typically has some form of familial connection with the eidolon, be it by blood, honor, or devotion.