Skip to content

fix: detections#10

Open
DataM0del wants to merge 10 commits intoinfyiff:mainfrom
DataM0del:patch-1
Open

fix: detections#10
DataM0del wants to merge 10 commits intoinfyiff:mainfrom
DataM0del:patch-1

Conversation

@DataM0del
Copy link

No description provided.

@Toon-arch
Copy link
Contributor

ur doing cloneref twice in one of the commits btw (i saw this 4 days ago)

@DataM0del
Copy link
Author

ur doing cloneref twice in one of the commits btw (i saw this 4 days ago)

oops lol, idk where but I'll try to find it

@DataM0del
Copy link
Author

image it's required because not `cloneref`ing services can get you detected along with `cloneref`ing the player's mouse object.

@DataM0del
Copy link
Author

if you mean as in "you're clonerefing the players service 20 times", it's because I just went through the code and stuff to add cloneref, never did any cleaning up lol.

@Toon-arch
Copy link
Contributor

if you mean as in "you're clonerefing the players service 20 times", it's because I just went through the code and stuff to add cloneref, never did any cleaning up lol.

ye lol

@DataM0del
Copy link
Author

if you mean as in "you're clonerefing the players service 20 times", it's because I just went through the code and stuff to add cloneref, never did any cleaning up lol.

ye lol

oh ok, I guess I'll go through and try to fix the code so it's not doing that 20 times at some point, currently working on trolling a web game because why not.

@fluffylopez94-coder
Copy link

Creat different remote spy In Roblox, the "remote spy" is not a type of cheat but a tool used by exploiters to monitor a game's network communication, specifically its "RemoteEvents" and "RemoteFunctions". By observing the data passed between the game server and a player's client, an exploiter can craft their own scripts to manipulate in-game elements like health or damage.
This is only possible in games with weak security practices, as developers are expected to validate all actions and data on the server side.
How exploiters use remote spies for health and damage
Here is a breakdown of how a remote spy can be used to alter your in-game health:
Exploiter joins a vulnerable game. The exploiter needs an executor program, which can inject custom scripts into the Roblox client.
Spy on game traffic. The exploiter runs a "remote spy" script to log the data passing through the game's remote events.
Find a weakness. The exploiter analyzes the logs to look for an insecure remote event. For example, they might find a remote event named DamagePlayer that accepts an amount value from the client.
Craft a malicious script. The exploiter writes a new script to repeatedly trigger the vulnerable remote event, passing in a large number for the damage amount.
Run the script. The exploiter executes their script through their executor, sending commands to the server to damage themselves or other players.
How developers prevent remote spy exploits
Developers can protect against these kinds of attacks by following the "never trust the client" rule of thumb. Here's how:
Validate input: When the server receives a message from a client, it should verify that the request is valid. For example, if a client fires an event to deal damage, the server should first confirm that the player could have performed that action (e.g., they are in a fight and aren't hitting from miles away).
Don't let the client decide values: The server should always determine critical values like health and damage. The client can send a request for an action (e.g., "I just shot a gun"), and the server will then calculate the damage and apply it.
Implement server-side checks: All changes to player stats and the game world should be handled and verified by the server. If a client attempts to bypass this with a malicious remote event, the server will ignore the invalid request or even kick the exploiter.

@DataM0del
Copy link
Author

Creat different remote spy In Roblox, the "remote spy" is not a type of cheat but a tool used by exploiters to monitor a game's network communication, specifically its "RemoteEvents" and "RemoteFunctions". By observing the data passed between the game server and a player's client, an exploiter can craft their own scripts to manipulate in-game elements like health or damage. This is only possible in games with weak security practices, as developers are expected to validate all actions and data on the server side. How exploiters use remote spies for health and damage Here is a breakdown of how a remote spy can be used to alter your in-game health: Exploiter joins a vulnerable game. The exploiter needs an executor program, which can inject custom scripts into the Roblox client. Spy on game traffic. The exploiter runs a "remote spy" script to log the data passing through the game's remote events. Find a weakness. The exploiter analyzes the logs to look for an insecure remote event. For example, they might find a remote event named DamagePlayer that accepts an amount value from the client. Craft a malicious script. The exploiter writes a new script to repeatedly trigger the vulnerable remote event, passing in a large number for the damage amount. Run the script. The exploiter executes their script through their executor, sending commands to the server to damage themselves or other players. How developers prevent remote spy exploits Developers can protect against these kinds of attacks by following the "never trust the client" rule of thumb. Here's how: Validate input: When the server receives a message from a client, it should verify that the request is valid. For example, if a client fires an event to deal damage, the server should first confirm that the player could have performed that action (e.g., they are in a fight and aren't hitting from miles away). Don't let the client decide values: The server should always determine critical values like health and damage. The client can send a request for an action (e.g., "I just shot a gun"), and the server will then calculate the damage and apply it. Implement server-side checks: All changes to player stats and the game world should be handled and verified by the server. If a client attempts to bypass this with a malicious remote event, the server will ignore the invalid request or even kick the exploiter.

awesome AI slop moment part 1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants