the most edgy hacker steam inventory

in the last episode, we looked at his steam profile including custom steam profile badge, steam name, steam group, invisible steam comment section etc.
i have found the actual most insane cs:go steam profile of all time and now we are going to look at his csgo inventory and all his csgo items...
part 1 featuring his steam profile: • the actual most edgy h...
twitter: / ohnepixel
instagram: / ohnepixel
twitch: / ohnepixel

[@wizardz4lyf502]

tf2 has an insane history of items being "cheated" into existence and i am eternally thankful cheesmo brought it up. Great vid!

[@firemaana6440]

even people without items get messages like 'Man.. I repoprted you for Duping' and it's never any other reason

[@SavouryLobster]

Same with CSGO. That's why you can't get your skins back after being scammed anymore.

[@nya69]

@@firemaana6440 thats just a generic scam message meant to scare people, valve hasnt support granted any items in ages n doesnt care abt the old duped items, the bug cheesmo was talking abt was when a guy found how to give literally any item based on ID n gave himself the mvm heavy bots minigun the deflector n a previous 1 i dont know the details of but i believe the finder was given a sunbeams maxs head

[@firemaana6440]

@@nya69 Don't worry, I was just joking

[@fredderf4655]

duped shovel?????

[@KexX1901]

„If you kill someone…“ „…in Game?“ „Yeah I hope ingame“ Hahahahaha

[@MrCrazyawesomecuber]

didn't even notice the joke until i saw the comment, that's hilarious

[@TrollYou-dz5jy]

cuz twitch rules are dumb ...

[@wojtekpolska1013]

@@TrollYou-dz5jy no lmao, its a joke. nothing about twitch rules

[@minds777]

@@wojtekpolska1013 no he had to make the comment “in game” just to reinsure twitch

[@HappyVLR]

Xd

[@whoops6325]

"i just put name tags on items" lmao fuckin golden

[@donkitphp]

That's literally all he does. Not even a scipt kiddie. Ohne acting like he's some bigbrain hackerman is the cringiest shit ever.

[@kwaygz]

@@donkitphp awesome but who asked

[@donkitphp]

@@kwaygz I mean you replied lmao

[@kwaygz]

@@donkitphp you have no idea

[@donkitphp]

@@kwaygz why are you a leet haxor that could teach me all of the programming languages to become a l33t h4x0r too? Lmao

[@IxMeTutorials]

As the CS:GO UI is built with web technologies, this is basically just about breaking the css layout with obscure unicode characters, just like you often see it on the web. It's unlikely that there are actual exploits possible with this beyond breaking the layout of your client UI.

[@Michael-dj6pd]

unless it can somehow activate escape characters, that can affect more than the UI.

[@Luna0wl]

New World has this problem right now you're able to inject html into your chat and fuck with UI and even crash the game with bad data injected in item descriptions.

[@S4NSE]

web technologies lmao

[@brazy6491]

@@Luna0wl no thats a completely different problem, new world just didnt sanitize their chat box and the game took it at face value, easy fix. cs:go and tf2 are written this way, manipulating game memory is alot worse than what happend on new world

[@pixelthec]

I tested and with this script there might be some potential to break the UI even more but it's so unpredictable that doesn't worth the nametags' price just to test everything out ingame. But no actual exploits really, just some weird visual stuff.

[@SrikarMaddula]

I was wondering why this hadn't been uploaded yet. That shit was so cool on steam. Cheesmo has an insane profile. I really hope I win one of those p250s.

[@MaxxerOfPepsi]

i already have a p250 pretty much like that :D

[@904]

@@MaxxerOfPepsi with the name like that?

[@MaxxerOfPepsi]

@@904 yeah its not the same name as the one in the video but yeah it makes the hud go wonky

[@SrikarMaddula]

@@MaxxerOfPepsi Damn that's cool af. If I had one like that, I might just start using the p250 lol

[@MaxxerOfPepsi]

@@SrikarMaddula i mean shit id trade it if you got anything good to offer me lol

[@Gr0]

kinda cool how he's open about alot of this stuff, most hacker nerds i have encountered are edgy like title says

[@durax-0xf]

not a hacker, script kiddie he said it himself he just used a script

[@fuckyoutube420]

@Anonymous User yeah thats y he corrected him, Cheesmo isnt a hacker. Scripter is different little boy

[@Anna-senpai]

@@durax-0xf not a skid. he knows hes not a hacker and doesnt try to make it sound crazier than it is.

[@prodKossi]

@@Anna-senpai Yea, One is the one hyping him up to be a h4ckerman - he seems like a good dude

[@yikes710]

he's not a fuckin hacker lmfao, dude literally told you that he got sent a github link after asking a bunch of people. you people are so gullible it's insane

[@KrypeAV]

In dota 2 the Chinese skin community had figured out a bunch of exploits, the most basic of which was to simply put html links to pictures in description tags for items, rendering them ingame if you clicked on the item. This was a welcome addition to the dota skin community until valve stopped it. The explained that anytime someone loaded the skin in game (as in if they got matched in a game lobby or even just spectating a live game through the in game client) the person that had access to the server the html picture was on could just get the IP address of anyone that loaded it (because they are technically downloading the picture from the server to view it). It was a silly and short time where tags were abused and I hope it never happens to CS.

[@pondbear1433]

Boy do I have news for you about something that happens in the votekick menu

[@Sundrip]

7:02 "Back in the day, me and you baby" 💀💀

[@Halloweenharen]

Got into a wingman game with this guy and got to have a look at a few of his weapons, fun stuff

[@asthmakid1858]

I played with Brad Pitt also wingman and he said he is going to make actor from me, so funny these things happen right.

[@mattacer]

@@asthmakid1858 Yeah, I remember meeting Zeus yesterday. Friendly guy

[@asthmakid1858]

@@mattacer wow,that's crazy all this stuff happened to people in this comment section

[@herrmanncs]

Guys iam actually gay

[@sorriiez]

@@herrmanncs ehh and?..

[@Spookex166]

Anyone remember the old SFUI Vote Passed nametags with color?

[@TheRealSlav]

Yeah

[@S4NSE]

yep

[@poopooman9658]

yeah my awp still has it

[@TheRealSlav]

@@poopooman9658 can you still do that?

[@VeveSigma]

@@poopooman9658 yeah but the glitch does not work anymore, you only see the name of the command

[@bigbunda06t9]

lmao the arabic translates to "in the name of god, the most kind, the most forgiving"

[@sk27322]

yeah

[@Reichstaubenminister]

Kind of funny. Back then it was a meme when you found out, now it seriously seems like a sign.

[@ThisUsernameSystemF-ckingSucks]

@@Reichstaubenminister A sign? tf are you talking about?

[@Reichstaubenminister]

@@ThisUsernameSystemF-ckingSucks I don't remember.

[@tayri9736]

Enough with the clickbait, Cheesmo isn't a hacker lol

[@REVVVcrypto]

He pretty much just does shit offline, don’t think he’s accomplished anything alone.

[@chinchilla_462]

yeah just playing around with a script and throwing around knowledge doesn't make you a hacker, heavily agree with you

[@idspiel]

hes not a hacker.. zzz its common u can even buy everywhere

[@idspiel]

ure hacker when u exploit the web online.. penetrate.. solved maths.. solved coding etc.. entering government sites.n

[@idspiel]

@xxxcept a hacker means you invade what is already there..

[@foxxer64]

I would love if someone made a channel like this, documenting expoits and explaining the history of bugs etc

[@Kinonear]

Someone who doesn't know csgo would be confused. Like "Why the hell his mind blows up so much to just a interface location change?"

[@tybs33]

4:17 "what if you like can put commands through a nametag" that question aged really well, atleast there was only the player name exploit for now

[@dancingenginier5707]

the guy who gave himself the minigun (it was specil in that it could delete proectiles like rockets and pipes) was the guy who got the unusual cheaters lement (halo looking hat) that the guy was talking obout

[@Velehokala]

1:48 "in finland we kill people for fun" :DDDDD

[@Cssisabeautifulthang]

These lootbear adds are crazy

[@americantoastman7296]

"so, if you kill someon-" "IN GAME RIGHT??" Bruh xD

[@jakakumar9449]

that is so interesting

[@P0KEBLOX]

Sorry but this is driving me nuts and here is an explanation in laymans terms. The client communicates with the steam servers through something called an API (Application Programming Interface) which is the same thing the trading bots and this script uses. The API should have the same name restrictions as the client but some times A) the programmer forgets or B) At the time of making it they only expected the API to be public which means they didn't need to validate the name to make sure to weird characters are in it. You wouldn't really have to worry about SQL injection because most modern database API's only let you execute one command per line so SELECT `items` FROM inventory; would work but something like SELECT ``DELETE items from INVENTORY` items` FROM inventory wouldn't as multiple commands are being used. Another reason you wouldn't have to worry about it is the fact that the database API's also do something called escaping which just means it removes the extra ` that allows you to execute multiple commands.

[@mihalis1010]

You could just run a drop table instead. I'm sure they have backups of their backups, but Valve needs apparently needs to be pushed to do something about their game which is very clearly broken.

[@tacokoneko]

is it possible with DOTA 2 i want to try it

[@benjulesprice]

@@mihalis1010 The strings are obviously escaped. You really think their public API has oversight as crazy as this? Not saying it's impossible but definitely not that trivial.

[@Almostbakerzero]

id think this would enable cross-site scripting rather than sql injections. sql injections would require the name to be executed by steam servers which is unlikely if they properly sanitize their db. cross-site scripting means putting executable code somewhere where its executed by a client accessing the text. this might happen in the context of a person viewing your inventory in a web browser or viewing your gun in game or maybe in the "kill screen".

[@dameck9570]

I was about to write that👍🏼

[@blocksource4192]

That's what i was thinking as well, rather than outdated exploits that don't even work on some web servers, I would rather think an XSS injection could be more common here, however theres possibilities that the UI most likely doesn't have the actual JS engine even enabled/loaded, which would make it impossible, and second to that, I doubt they would store steam cookies in the html for the UI.

[@Wanis23]

Anxiety bookmark Sadge. It feels like dying everynight.

[@miinus8972]

ohnepixel predicted the votekick html exploit in this vid

[@DaniRentz]

I still waiting for the moment when Ohne is drinking when suddenly he is surprised and spits on the screen xddd

[@cholimba]

i probably wouldnt report a free unboxing bug, atleast not for the time no one else knows about it. I wouldnt sell my items i unbox but just for the unboxing experience it would be hella fun i think

[@zeushvh]

this guy just gets fascinated by so little things lol... every video if it isnt normal csgo "OMG HACKER PROFILE" lol.

[@wojtekpolska1013]

10:24 actually no, they gave him the item back (obviously untradable) - it's name of the gun is "Deflector" - its the normal minigun, but it has ability to shoot rockets out of the sky. Not that much overpowered, so there wasnt much harm giving it to a single person.

[@the-jar]

Do you have proof he still has it? He gave himself one but from everything I’ve heard it was removed and they simply gave him another custom unusual like they did to other people. Even the wiki says it was taken away from him

[@QuackZack]

He no longer has it after they patched it out and removed it. Also the deflection ability would be overpowered, as it deflects all projectiles and would negate ALOT of burst damage and make projectile classes extremely useless. It was only meant for a bot AI to use.

[@wojtekpolska1013]

@@QuackZack " Also the deflection ability would be overpowered, as it deflects all projectiles and would negate ALOT of burst damage and make projectile classes extremely useless" It doesn't matter, there are literally "VALVE" weapons, with insane stats, that are in the accounts of valve employees. One player having a weapon that's a little bit stronger doesn't matter that much

[@QuackZack]

@@wojtekpolska1013 Complete difference between a Valve employee that rarely joins or play TF2 to goof around with an OP weapon compared to a regular player that could literally join every casual match and ruin it if he wanted it.

[@wojtekpolska1013]

@@QuackZack no lol, there are hundreds of casual servers, and giving heavy the ability to shoot rockets is not even that gamebreaking. he still dies to spies, snipers, sentries, pyros, etc. its not overpowered, literally only 1 person in the world has that item, and its not even that OP.

[@noeldev]

So basically this is just a glitch you can do with the csgo API from my understanding, i doubt name tags could actually execute any commands through it unless valve messed up the code big time, which is possible just look up the crate depression lol

[@durax-0xf]

theres no csgo api afaik and you cant call nametag uses through web api

[@benjulesprice]

@@durax-0xf maybe not an API but per se but you can communicate with the server directly bypassing any sort of client side validation (in this case character restrictions).

[@andrius4210]

what extensions is he using to see the float bar on every item?

[@teh_productions]

This type of hacking that doesn't interfere with other players and it's strictly for cosmetic purposes like this I have no problems with.

[@lezlienewlands1337]

IIRC the custom weapon that the guy spawned in was the "Deflector". Used by robots in MVM that could destroy pipes and rockets.

[@generalmisery]

remember trillux getting banned for finding the zeus bug and only after big drama they unbanned him. Valve does not give a shit about their players.

[@de_trixa]

he got banned from faceit not valve lol you cant get banned for using glitched that are already in the game

[@Butthead110]

TF2 my fav game for many years but the cheater problem its to heavy ):

[@VeveSigma]

the story with the colored name was a bug that allowed to use the name code for the vote command comfimation, it was up for a few year but go patched now you can't even use the original command anymore the text was this #SFUI_vote_failed

[@buzzbya]

this is the true meaning of hacker, not people who pay for aimbot and walls

[@realmackle]

I'm best friends with someone that uses this script. Everyone is so utterly confused when they pick their guns up, it's really funny

[@antonsnr1037]

Is he willing to share the script? :P

[@TEA-mg5eb]

finna need that bru

[@Taquinetot]

i wonder if with burpsuite you could just capture a packet to rename the weapon and just insert illegal unicode characters there

[@Sgt.Guncat]

Back in the day a buddy of mine showed me an exploit that you could use any cosmetic combo so you could combine hats,coats etc. in tf2 if you modified a windows file profile picture wouldnt load anymore but that was the only downside. I deinstalled it after a couple days but it was a cool lottle exploit.

[@cx5_]

I love that so much, I can still remember when I clapped a nametag on my c4 and thought I was super unique haha "Explosive Toaster" will always have a special place in my heart xd

[@hexx_2864]

how do you get c4 to your inventory?

[@SuperGRIMED]

Haha i still got the russian calculator on my c4 :)

[@flaggboi]

9/11 never forget is mine

[@TianyuQi]

at least no one had made a csgo name tag inject rce out of this

[@knownpenguin7573]

As someone in chat said he sounds like a rich kid who just bought the script

[@mValerianW]

Imagine this guy will have burning gloves some day

[@michaelkaren5028]

This is the kind of "hacker" I like

[@yikes710]

bro is literally some kid that found a github link, hacker is a crazy term for him lmfao

[@qujc]

this aged well (cs2 name xxsl exploit)

[@grrr-ou9oc]

a little bit of cyber security info an injection typically runs code on the server, this is where all the economy breaking bugs will be something scarier than that would be an ACE exploit, allowing code to be run on the computer of anyone who views the skin. one minute, you're checking out cool skins, the next minute your computer is being used to mine some form of crypto

[@9bytehub]

Some of yall were born to deep dive into this stuff. Its interesting

[@siorzen1473]

I found may be his old account? On steam, same glitches on profile, groups , but VAC banned

[@FredTheSpider]

Not an edgy hacker or a skid, just a bored fella breaking stuff for fun

[@timlarsson3634]

Dude i am trying to sleep😂😂

[@thatslegit]

guys a real chad, literally having the nuke codes to csgo and he chooses to mess with nametags only

[@getrekt4302]

What are you using to display all that extra info on steam?

[@KillerDragoon87]

I couldn’t imagine a corporation as big as Valve not being protected by SQL injection, but maybe communicating through a script instead of intended text boxes could be a vulnerability valve didn’t consider. Very interesting.

[@judfps]

aged well

[@Rusty49]

i was wondering if someone was gonna say this@@judfps

[@Alex-bi8ob]

what happened@@Rusty49

[@Rusty49]

@@Alex-bi8ob people were injecting malicious code through their name and in workshop maps

[@hugoperuzzo4376]

hi : what's the plugg in that you use to display the intems prices ? thanks a lot in advance !

[@TruthJX]

Maybe it uses an HTTPS proxy that intercepts data going from you to Valve, for example when you rename an item. The outgoing data with the text you entered could be intercepted and changed and then sent out, possibly circumventing the in game / in app text restrictions.

[@romanianfps]

Lmao no... you need mental help

[@eclipse632]

@@romanianfps ????? are you mentally stable yourself? the suggestion this guy made could probably work, although it's much easier to just run some custom panorama js in-game to do it imo

[@romanianfps]

@@eclipse632 Why the fuck would a custom text use a fucking http proxy dude? Its literally just special characters that haven't been blocked yet by valve 🤣🤣🤣

[@eclipse632]

@@romanianfps the reason something like that is needed is because nametags do not allow you to use certain special characters (e.g paragraph separator) in nametags legitimately, personally I have no experience in doing something like that so never tried it as it wasn't first thing to come to my mind when I did it myself, but yes that would probably work, and something like that is necessary

[@romanianfps]

@@eclipse632 actually you and the other guy I right I just fully looked into it

[@aeyde]

part 2 yes

[@rrulan]

EDGY HACKER INVENTORYXDDD

[@Reichstaubenminister]

If a CS:GO Nametag ever gets exploited through SQL Injection because someone forgot to escape a parameter, I will eat a broom. And PowerShell isn't just a new cmd.exe, it's an entire programming language that can interact with .NET Framework.

[@Oliverii]

nah fam powershell is just a blue cmd.exe ik man insane

[@Reichstaubenminister]

@@Oliverii No, it is not. Try to run a .ps1 script via cmd.exe.

[@Oliverii]

@@Reichstaubenminister yeah i can It seems to me that you just have skill issue fam 💀

[@user-co2jg8ll5m]

Lol, it became so easy to do that every person could talk in discord with same inventory(

[@alyxburke]

I worked out another way to do this after the stream. I really believe there’s huge potential in these name tag bugs

[@shipy490]

how did you do it?

[@alyxburke]

@@shipy490 magic

[@SrikarMaddula]

I really hope that doesn't involve scripting. Or stuff that's borderline bannable. Although if the method turns out to be too easy, people might come with game breaking bugs that will cause Volvo to step in.

[@alyxburke]

@@SrikarMaddula it’s definitely not difficult but it’s also not bannable because you’re not interacting with vac secured servers

[@kememlemems723]

@@SrikarMaddula Volvo owns valve comfirmed

[@yvngfrap8341]

That's so weird I must've figured something out too with my Tiger tooth falcion knife too because the name doesnt show up just like his on the name tag XD

[@Papi_John]

I wonder if these will still exist in CS2. (more than likely they will)

[@Matsyir]

They do still work in CS2, but the UI is a bit smaller by default, so the vertical nametags aren't as tall unless you set UI scale to 110%. Also, when having multiple weapons with vertical nametags, in csgo the nametags of the upper weapons overlap onto weapons below them, but in CS2 the nametags seem to just get cutoff / stop being rendered where it hits the gun below it. (I only have two weapons with these nametags right now so I couldn't test that much, it probably cuts off even more if you have vertical knife+2 vertical weapons) Realistically though, if Valve ever wanted to fix this, they easily could without even messing with anyone's inventory. They just need to stop rendering the weird newline character (it's not a normal newline it's this character: 
), and they could also similarly enforce a client-side character limit to prevent the 21 character nametags. They could basically just re-enforce whatever limitations they want on nametags as they're loaded or rendered - remove any banned characters and limit the length. (I hope they don't but admittedly it is pretty ridiculous that this is possible lol, imagine if someone used these at a major, bit of a bad look for cs/valve)

[@lonkyz9572]

what is this extencion ohnepixel is using for steam inventory?

[@ExodiumTM]

4 seconds in and it's already obvious he's Finnish lol

[@onnionn1]

hes swedish bro

[@scxnezz]

wait i was in a game with someone who had a name like this on his ak a couple days ago. The script must have leaked through the community or I actually met one of the few people who actually have it

[@outercores]

if i could get cases for free you best believe id rinse that dry and never tell a soul

[@finja8896]

this was uploaded on my birthday :D

[@oM477o]

I was dissapointed when my #SFUI_vote_passed stopped rendering correctly but it's good to know there are other wild unicode names you can apply

[@bleach_my_eyes_plz]

Too bad valve were cheap and made all the crazy cool bug report unusuals untradable

[@blazethefox1621]

reminds me of the time i put a nametag on the bomb. i got a couple of questionis on how i did that, but it was so long ago now i don't even remember anymore. probably a tutorial on youtube though somewhere if you look it up

[@grqfes]

10 min of pure info

[@romancewastaken]

its really simple, i also have a nametag with super long unicode and it stretches the ui. you just use cheat engine

[@P4GrAnGeR]

Wonder how these look on CS2

[@TheWizardsOfOz]

This guy could be finnish.

[@k7y]

checks are made on client side, by talking to the API straight you can bypass the checks. Simple

[@Aparino]

Yes but how

[@durax-0xf]

theres no api for csgo and afaik you cant call a nametag use through the web api

[@krasipanic]

his voice sounds like tentacion before death

[@techjambo]

what is the chrome add-on ohnepixel uses? on steam

[@Zinox..]

7:02 me and you baby we used to have fun

[@illgetmyDad]

Rocket league gave players that found game breaking bugs a white hat car topper they’re worth a ton on money now only like 30 in existence

[@WcajababKd]

Some days ago I was betting in hope for a better knife which I got. I got a karambit slaughter mw with that exact long Arabic name that disappears when I turn on 4:3. Is it worth anything extra?

[@Furby.1987]

also reported some stuff to different developers and the reaction from them can be rly different... had developers paying for findings and had some which were rly angry cuz of it... as example: I dont report to Bohemia anymore

[@MoopLL]

???

[@BenibomBugs]

the youtube UI looks weird too..

[@vix2642]

you heard it dont note it

[@-uurty]

i have a friend who can do this. few of us sent him weapons we they wanted it done to and hed sent it back to them

[@HaoAqua]

I think on cs2 they will patch it, but there also will be some more bugs like this

[@ThemasterPink]

U can still do it

[@xmorose]

"hacker"

[@angelcumshot4107]

Кто-нибудь знает, что у него за расширение в браузере для стима?

[@eddiebernays514]

steam is so popular and seems so goddamn vulnerable.

[@barbar1an_]

This was really interesting, thanks for sharing

[@M2rsh]

hacker != cheater

[@rosia7598]

7:02 he has to be scandinavian

[@yikes710]

bro is literally some kid that found a github link, hacker is a crazy term for him lmfao

[@bradyoo2786]

I can expose an admin of TGP sharking me over $3500 in skins when I was new to trading

[@F.R.O.X.U]

he could sell smthing like ak safari for much more $ then its normaly worth

[@WekyWekDuck]

Valve customer support has been shit for the past few years

[@zakizdaman]

"SQL injection" nice viewers It's arbitrary code execution

[@definitivnicht1q279]

that is advanced gamer shit

[@01dom]

A simple prevention would be to allow only normal characters

[@salsa221]

yeah valve has to be pretty lazy to allow this

[@cringer8107]

they actually removed many symbols i used in previous names which im very say about :(

[@sarminder4357]

@@salsa221 sounds like valve.

[@salsa221]

@@cringer8107 yeah you used to be able to change color and stuff

[@wuwuwuwuwuwuwuwuwuwuwuwuwu4376]

copy pastes premade script = hacker

[@flavor1327]

Time to get patched