FireClickDetector and FireProximityPrompt Exploit Detection

thats the same script that my friend executed and it still doesnt replicate i already told you, do you want him to record his whole screen for you to understand ?

I can literally see that your “friend” got 2nd line empty, ofc it wont do anything


he executed this

I am just trying to give feedback. However, using move-to or tween cannot be fully detected, which slows down and makes exploiting less optimal. Exploiters will still use these methods, but with this resource, they will not be able to constantly server hop and activate the click detector or proximity prompt. Despite this, the methods mentioned can still be bypassed, and there may be other ways to do so as well. Anti-cheat is a perpetual problem, and the more people working on it, the better it will become. This resource can be beneficial for the community and for individuals who may not understand that adding a remote that can remove anything from the map is not a good idea.

And uhm how can it be bypassed ?

Things I said before, and possibly other things that I am unaware of, may lead to a workaround with the MouseHoverEnter event firing, or even something worse.

Tested with all the signals and it does still detect (firesignal isnt replicated when there is no NetworkOwnership on the client)

You could have made both of these scripts way simpler .
I would have added an extra layer to detect who is firing it but this is for learning and example so, yea.

task.wait(1) -- Server Init

-- > Declarations < --

local Debouncing = false

-- > Security Check < --
-- Could add an extra layer to make sure no false pos is to make a table for the player currently running said prompt
script.Parent.PromptButtonHoldBegan:Connect(function() -- Most exploits don't run this
	task.wait(script.Parent.HoldDuration - .1)
	Debouncing = true
end)

script.Parent.PromptButtonHoldEnded:Connect(function() -- Most exploits don't run this either
	task.wait(.1)
	Debouncing = false
end)

-- > Proximity Prompt Trigger < --

script.Parent.Triggered:Connect(function(player)
	if Debouncing then
		print('Ran from server!') -- Test
	else -- I wouldn't kick, but you can.
		player:Kick('BAC - You have been Banned @ [' .. os.date() .. '] ! Alpha-3B | Tampering with ProximityPrompts.') -- Test
	end
end)

and for Click Detector

-- > Declarations < --

local Entered

-- > Functions() < --

script.Parent.MouseHoverEnter:Connect(function()	
	Entered = true
end)
script.Parent.MouseHoverLeave:Connect(function()
	Entered = false
end)
-- Detector Part / Adds a Magnitude Detection also
script.Parent.MouseClick:Connect(function(player)
	if player.Character and player.Character:FindFirstChild("HumanoidRootPart") and (script.Parent.Parent.Position - player.Character.HumanoidRootPart.Position).Magnitude < script.Parent.MaxActivationDistance + 3 then
		if Entered then
			print('Player Pressed From Server!')
		else
			player:Kick("[BAC] : You have been Banned! @ " .. tostring(os.date()) .. " | Attempting to run ClickDetector from illegal executor!");
		end
	end
	if (script.Parent.Parent.Position - player.Character.HumanoidRootPart.Position).Magnitude > script.Parent.MaxActivationDistance + 5 then
		player:Kick("[BAC] : You have been Banned! @ " .. tostring(os.date()) .. " | Attempting to Run ClickDetector from illegal distance!");
	end
end)


1 Like

Also, you can detect firetouchinterest by getting the touching parts of it and checking if its nil. As exploits usually don’t add that extra bit of protection. (I would also add a Magnitude check on the TouchTransmitter). I knew it was about time someone wanna gonna release stuff like this so why not let the rest of the cats out the bag?

I myself made an anti-exploit for these two objects and you can find it in the link below. Yet, mine only checks for distance on ClickDetectors (on ProximityPrompt I don’t check since it doesn’t seem to trigger if you increase the distance from the client) and for ProximityPrompt it checks if is enabled.

The anti-exploit will also prevent dead players or players that are missing things like the Humanoid to trigger them, as many times the developer could interact with the player’s character.

Link: Anti-Exploit for ClickDetectors and ProximityPrompts

I found a bypass
In a server script:

  script.Parent.ClickDetector.MouseHoverEnter:Connect(function()
     print("Hovering")
  end)

In a local script:

local part = workspace.Coin --The BasePart with the click detector

workspace.CurrentCamera.FieldOfView = 1

workspace.CurrentCamera.CameraSubject = part

part.ClickDetector.MaxActivationDistance = math.huge

repeat workspace.CurrentCamera.CameraType = Enum.CameraType.Custom; task.wait(.1) until workspace.CurrentCamera.CameraType == Enum.CameraType.Custom -- Repeats are there to fix a bug. My camera type is fixed, even if I delete this script for some reason.

repeat workspace.CurrentCamera.CameraSubject = part; task.wait(.1) until workspace.CurrentCamera.CameraSubject == part

Output:

Not everyone will, but you can use metatables to make it appear as if MaxActivationDistance never changed, and change the camera subject to the next coin

Edit: I had this idea yesterday but had to sleep.

Imma just make a whole anticheat tbh, see you in 2 mounth or so ^^

  • ill fix this bypass thanks for sharing

Is this really a very reliable anti-cheat?

RoGuard is great and Server Detections have a extremly low rate of false detection.
And the pro version have a CoreGui detection

Can i get a demonstration?

Most games that have a “CoreGui” detection aren’t actually, they are really just using preloadasync and checking for if any images are added into CoreGui aka a Library.
Most scripts use ProtectedGuis now, so this is basically useless now

while task.wait() do -- loops
	game:GetService("ContentProvider"):preloadAsync({game.CoreGui}, function(assetid, status) -- search coregui for any assets, the 2nd arg is useless
		if string.find(tostring(assetid), "rbxassetid://") then -- Roblox will never put a rbxassetid by themselves in.
			game.Players.LocalPlayer:Kick('Exploiting! External Library Added to the Game!') -- Kick Player if detected (I would kick with a remote tbh)
		end
	end)
end
1 Like

Nobody is ContentProvider anymore and its just a trash detection anyway. RoGuard doesnt have an instantly CoreGui Detection, it have a Scrolling detection (when you scroll on an exploit gui), TextBox (when you type something in his exploit)

syn.protect_gui:

1 Like

This is a really cool anti-exploit Spidercraft! Will definitely use because of the annoying exploiters…

Oh yeah! I also love a lot the anti-cheat filterware, its quite cool, thanks you Spidercraft!!! <3