How do people know what to "inject" for exploits?

[Doglord120 (Dogking120)]

Hello, doge here. I’ve been wondering about how people get the exact name of instances and their properties. I’ve read about people being able to change the size of swords in sword-fighting games in order to gain more reach. But, how do people go about doing this as they won’t know what exact code to inject. Do they first inject code to get the names and properties?
I want to prevent this kind of issue in my game where players can modify localscripts and player properties.

[Lua_Basics]

Exploiting Explained

Exploiting Explained: Second Revision This post is a general information source on common exploiting terminology, tools, and methods. The formatting is in sections for each specific topic, and is in no specific order. If you’re not aware of exploiting by this point, you’ve probably been living under a rock that the pioneers used to ride for miles. While Roblox is seen as open grounds for free reign of exploits, this isn’t the case, and I attempt to tackle this wrong assumption in this post. Th…

This should explain it, now for your particular problem;

@Doglord120

where players can modify localscripts and player properties.

You can’t do anything about exploiters changing local scripts or LOCAL player properties but the properties won’t replicate. Now things like position can replicate and in this case you can quite easily prevent it. The short reason you can’t do anything about exploiters doing local stuff is it’s well, their own pc and they can change/take/alter absolutely everything but it won’t replicate so don’t worry.

Ways to patch common exploits?

To combat exploiting, all of your checks need to be on the server. Furthermore, they need to check only the position of the player, as almost everything else can be spoofed by the exploiter. In theory, an exploiter can change everything about their client, including removing and replacing your exploit-checking code but reporting to the server that everything is OK. They can even report a Velocity of 0 while they’re moving, report a WalkSpeed of 16 while using 200, or report touching parts they …

[Amiaa16 (Amia)]

Exploiters can do anything a normal LocalScript can do & more. You can read properties with a LocalScript? So can they!
It isn’t a matter of “knowing what to inject”. They can simply run any code they want to as a separate LocalScript. If they want to change your sword’s size, they can just print the contents of your backpack to get the sword’s name and from that point resize its handle.

[FlammableSnowman]

The general rule is not to trust the client. Using the client for specific purposes is fine, and prevents the server from being heavy.

However, scripts that should not be accessible publicly (ie datastores) should be stored on the server, because exploiters can easily access the client.

I’m not the best in Lua currently, so I’m sharing general knowledge. If I am incorrect, happily correct me.

---

Edit:

@Doglord120

I want to prevent this kind of issue in my game where players can modify localscripts and player properties.

I can’t help you here in terms of what the Roblox engine is capable of, but to prevent exploited content, it’s always safer to get on the legal side of things instead of relying on Roblox; essentially add an UI that lists the game’s ToS - the player must agree to it to carry on.

[Doglord120 (Dogking120)]

Ah, thx, I forgot that you can simply print things out from instances.