i see some ppl saying that you should kick or ban someone with unknown screenGui.
are exploits done by inserting a external screenGui with scripts, finding every remote event in game, and allowing exploiters to fire those events?
i read many articles, and now i know that remote events should only be asking “can I …?” and not “I can …”
but i just wanna understand exploits better so i can block every potential problems.
i aint even asking for something like “how do i inject a gui in my playerGui in-game” or smth
im not a dirty exploiter so please let me know🥺
Not the most experienced with this but to my knowledge:
Firing remotes cannot inject a screenGUI, but you should operate under the assumption that exploiters can find ways to modify the arguments sent along with remotes, so you should never have a situation for example where the client is sending “Give me 1 million coins for this item”, only “can I sell this item” (and the server decides how much to give, and gives it).
The problems with custom GUIs with commands (that players shouldn’t have access to) that I’ve personally encountered are from malware in that gets into your game via plugin or free model and discretely calls a bunch of modules and usually http service so that anyone with access to the malware (or on some sort of user list) is given those special GUIs when they join the game.
I remember around 5-7 years ago or so (think early jailbreak) there was much more script injection weirdness going on where players could literally just give themselves everything in a game, teleport, etc., but I’m not 100% sure how much of that is still happening today. Hopefully someone can fill you in on that.
I mean scripting menus are usually scripted manually from what I have researched, or required by modulescript or a model sometimes.
Well all the client available remotes, yes.
Thats why sanity checks are needed when detecting anything from the client, you shouldn’t let things like “send 1 billion coins” go though, y’know?
Yeah you probably should ban them, if there is an anomaly like external gui, faster walkspeed, higher jump e.t.c, then yes, you should ban them.
Exploits always work on the client, because of FilteringEnabled, but, since the client has NetworkOwnership of the character, exploiters can basically modify any properties of their character, and it’ll replicate to the server and other players because of that. That’s why you see so much flinging scripts in games like NDS(Natural Disaster Survival), they modify properties of their own character, because thats basically the only thing they can do.
But that’s only the character, they also have all the things the client can see, like ReplicatedStorage, and from there they can fire remotes to the server, thats why, again, you need sanity checks on the server.
so tl;dr: All they can really do is fire remotes and change properties of their character.