You open a staging build as a "DE" test user. The API returns prices in euros. The page still says good evening in your real timezone and formats dates like home. The scenario is already dirty — before anyone looks at headers.
This is not an attack guide. It is the opposite: authorized testers keep the fixture honest, so locale, geo-offer and anti-fraud checks are actually the thing under test.
What the page can read without asking
Any origin can call Intl.DateTimeFormat().resolvedOptions().timeZone. No permission prompt, no GPS. The engine answers with the system zone, not the zone of the VPN exit and not the Accept-Language you set in DevTools.
The same family of APIs leaks offset, locale, and how Date prints. Anti-fraud and fingerprint scripts look for exactly that mismatch: IP says Amsterdam, clock says Asia/Dubai. In a test, the same mismatch means you are not exercising the Frankfurt path you wrote in the ticket.
Why "just change the OS clock" is a bad fixture
OS-level clock tricks break your calendar, CI timestamps, and every other app on the laptop. A VM per locale is honest and slow. We built a smaller tool because we hit this on our own web work.
Timezone Spoofer is a Manifest V3 extension (Safari companion on the App Store) that patches Date and Intl in the page context, iframes included, at document_start. You pick from 400+ IANA zones — search by city, region, or UTC offset — apply, the tab reloads already living there.
For a test account that must follow a VPN exit, auto-detect from IP is the useful switch: the clock tracks the new address. Per-site exclusions keep the bank and the calendar on real time. Storage is local. No account.
IP and clock are one story
A timezone patch without a matching exit is still a half-fixture. For authorized work that needs a different address — not a lecture on "hiding" — we use Noname VPN: a key from @unlocknoname_bot in about a minute, a free day to check the route, no email. The same key lands in the iOS and Android apps.
The short loop we actually run:
- Scope is written. Staging or an asset you are allowed to touch.
- Connect the VPN exit that matches the ticket.
- Enable Timezone Spoofer auto-detect (or pin the IANA zone by hand).
- Only then open the app under test.
The longer argument — why the tester's home laptop shows up in screenshots and logs — is pentest OPSEC. The difference between a scan, an assessment and a pentest is the first piece.
What you can order from us
Zero Day Labs takes authorized security work — we use the same products described in this series, not a rented scanner PDF.
You can write to [email protected] or the contact form and ask for:
- a security assessment (map of assets, controls, residual risk);
- an authorized pentest on a written scope;
- a web application review (from the editor: DOM, network, evidence);
- a review of agent and tool isolation (what the agent is allowed to call);
- help making test fixtures honest (locale, timezone, exit address) so the report describes your system, not the tester's laptop.
Say which job you want, the scope, and what "done" looks like. We reply with a concrete proposal — same rule as the rest of the site.