Hi, I have a question about exploits to ensure I am taking the correct approach to prevent it. I want to know what exploits can’t do, for example, can exploits modify client game code at run time? or are they just external scripts injected into the game?
Basicly exploiters can access anything that is on the client(Module scripts,local scripts,variables,events). They can’t access ServerScriptService & ServerStorage, since these are on the server and not client also they can’t view server scripts. If you’re events aren’t secured they can fire them and put through variables you assign to fire things on the server.
Exploiters can do anything imaginable on their own computer, whether it’s messing with your variables, changing your code, or even stealing the physical place and all your LocalScripts.
Keep in mind that when trying to stop exploiters, you should never try to detect exploits client-side. The exploiter will always win. Instead, monitor the position, orientation, and velocity of their avatar and body parts on the server, as these are calculated on the client and sent to the server.
Here is what most exploiters, using pre-made code executing exploits can do:
Decompile your code (basically, read it)*
Execute any Lua code (including access to methods you don’t normally get access to)**
See any instance, including nil instances (parented to nil), that are clientsided
See remote and bindable traffic, and intercept / MITM it †
Here is what advanced exploiters can achieve if they wish:
Modify code during runtime
Modify your environment live, or even the engine itself
(tl;dr anything to the client)
No exploiters can actually run code on any server. Some games are particularly stupid and allow for loadstring execution via a remote (this is so silly, I cannot comprehend it), but if you put code on the server, as long as filtering is enabled, assume that what you see on the server is correct as long as it isn’t from a client.
* Only a few exploits are capable of this, and in a very limited fashion ** Some exploits can only execute lua instructions or have a very limited environment † Only one exploit on the market I know of is capable of this, but keep it in mind.