Game being exploited heavily, not sure how to resolve

Help and Feedback Scripting Support
#162

If there is currently someone exploiting in your game, it is probably some kids using a software or something.

Or as someone said earlier, a backdoor may have gotten into your game.

The best solution is to scan your game with an anti-virus scanner, or just simply ban the exploiter.

1 Like
#163

We have scammed our game with an anti-virus scanner and we do not have backdoors in our game. Also, we can not ban the exploiter if we do not know who it is.

#164

Good point, I think the other idea is better

#165

But would they be able to use Synapse to somehow delete all players, and remove them from the players list (probably disconnecting clients), since thatā€™s whatā€™s happening.

1 Like
#166

Using btools. Good example is btools can dele players with exploits

#167

No, they canā€™t but they can crash the server

#168

They can, if you ever played holdā€™s admin house hackers would delete characters by hacking the btools

#169

How would you get btools to delete the character since dex explorer canā€™t even do that, btools usually is obtained from scripts

#170

Maybe the exploiters script runs a function or something to tell the game to give him btools

#171

Are you using any free models?

#172

There is no function as you said but they can use long module scripts and make gui and script btools themselves because it would be problematic to obtain btools by function from the game

#173

Yes they ar eyeing few models they Claim are trusted

#174

Iā€™ve heard that the hand to GUI is a backdoor.

#175

Part spawning:

while true do
   for _,v in pairs(game.Players.LocalPlayer.Character:GetChildren()) do
if (v:IsA("Accessory")) then
v.Handle.Mesh:remove()
end
end
wait()
for i,v in pairs(game.Players.LocalPlayer.Character:GetChildren()) do
if (v:IsA("Accessory")) then
v.Parent = workspace
end
end
wait()
end

Server shutdown:

while wait() do
   for i,v in pairs(game:GetService'Players':GetPlayers()) do
       if v.Character ~= nil and v.Character:FindFirstChild'Head' then
           for _,x in pairs(v.Character.Head:GetChildren()) do
               if x:IsA'Sound' then x.Playing = true x.CharacterSoundEvent:FireServer(true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true, true) end
           end
       end
   end
end

OR

while wait() do
    for i,v in pairs(game:GetService'Players':GetPlayers()) do
        if v.Character ~= nil and v.Character:FindFirstChild'Head' then
            for _,x in pairs(v.Character.Head:GetChildren()) do
                if x:IsA'Sound' then x.Playing = true end
            end
        end
    end
end

Source: v3rmillion

#176

It is not, I have looked at the source and it is clean. As well, it is the same person who made the admin, TheFurryFish.

#177

I heard part spawning is somehow connected with hat drop that was used in the past. Isnā€™t that why there is an ā€œAccessoryā€ word in the script?

#178

I want to clarify some misinformation in this thread as Iā€™ve seen quite a bit of it.

First off, you cannot disable filtering enabled (FE). This property was forced over a year ago to prevent dangerous exploits (things compromising the gameā€™s integrity, safety of children, etc.) Even though the property is there, unchecking it will not disable it.

Second off, client side exploiting is extremely limited when a game handles sanity checking well. Things like teleporting, flinging, etc. can be patched from the server in almost every instance (this is why big games like Jailbreak donā€™t really suffer from this issue).

Some of the things you described would not be possible even without serverside sanity checking // anti-exploit meaning that a backdoor should be present and removable. Exploit developers have gotten very sneaky about these things. Some backdoors are hidden in areas not seen by default in studio. You can show those using this property in studio settings: Studio | Documentation - Roblox Creator Hub
Otherwise, there are a few good backdoor checkers that will look for telltale signs of a backdoor.
Namely, the most common backdoors will have require(), getfenv(), or obfuscated code (stuff that looks like jibberish). If you see any of that stuff and you did not write it, then delete it!

How to help prevent your games from exploiters:

  1. Make sure that any FM you add is checked. If you donā€™t understand the code, try to ask a friend! Check to see how long the developer has been around. Are they brand new and potentially a bot?
  2. Check all plugins! Many plugins are actually fakes that act just like the real deal but will constantly add new backdoors into your studio session (and then game when published) meaning they will keep hiding until the plugin is deleted and the backdoors removed. Just like above, check the plugin author and make sure it is a longtime, trustworthy developer and not a fake clone. Anything like (anti-lag) is a big red flag and you should not trust that stuff!

a) Exploits like flinging objects can be prevented. Any unanchored parts should have the network ownership set to nil (on the server) or in the case where they need to be controlled (like a car), the player controlling them. API here: Network Ownership | Documentation - Roblox Creator Hub
Any parts that do not need to move should be anchored, so double-check that! Unanchored parts really should not be set to automatic network ownership handling (which is the default) as then exploiters can manipulate those parts and cause havoc.
b) Teleportation exploits can be dealt with my constantly checking a userā€™s position and if the jump was too big in a period of time, moving them back to their previous position can be done. This module is pretty awesome since you can do a bunch of AE stuff and chose who/when to enable the checks on. Haquess - Inhibit movement exploits for your game! - #6 by ForbiddenJ (This was not made by me)
c) Sound exploits can be dealt with by checking the respect filtering enabled property. CAUTION: Make sure any scripts that rely on sound via the client are properly dealt with on the server if need be (e.g you may need remotes if certain sounds need to be played on the server via a localscript). Info here: SoundService | Documentation - Roblox Creator Hub
d) Check out these forums! There are so many great resources that talk about exploiting and how to deal with it. We are all here to help. Donā€™t be afraid to reach out.

I hope this helps a bit and let me know if you have any questions :slight_smile:

EDIT:
I decided to add a bit more here regarding client side anti-exploits.

While clientside anti exploits can help identify very specific things in an exploit, they are easily bypassable. In general you should never trust the client because they can manipulate stuff as much as they please. If you want to add some clientside AE to rat out people that are just copy and pasting scripts and do not know what they are doing, that is fine. But donā€™t waste your time on doing anything crazy. Good anti-exploits must be on the server so that 1) exploiters cannot see the code and 2) whatever is being picked up cannot be bypassed. When it comes to exploiters firing remotes and whatnot that you do not want them to have access to, make sure you do sanity checks for the remotes on the server.

For example:
Letā€™s say you have a remote that gives admins special access to something. Make sure on the backside of the remote, you check to see if the user is an admin via a table or something of that nature. For sensitive server side stuff, you must protect your remotes!

12 Likes
Exploiting Explained
#179

Of course, but they can be easily bypassed by exploiters with in-game tools and items.

#180

Since its on the server its almost impossible to bypass without a backdoor.

1 Like
#181

This is not true. If you do proper sanity checking (on the server), that code cannot be touched or even seen. Client-side anti exploits are always bypassable and should only be used to weed out script kiddies / people that do not know what they are doing.

1 Like