Name Spoofing Patch

Resources Community Resources
,
#13

Doesn’t look bad and easy to make lol but thank you very much

#14

And that is a damn problem already

#15

i feel like this is too much code for just one thing,
this can be accomplished like this in only a few lines

local HttpService = game:GetService("HttpService")

game:GetService("Players").PlayerAdded:Connect(function(plr)
	local success, data = pcall(function()
		return HttpService:JSONDecode(HttpService:GetAsync("https://api.rprxy.xyz/users/"..plr.UserId)).Username
	end)
	if plr.Name ~= data then
		plr:Kick("Invalid Name")
	end
end)
#16

If the player is in game then yes it will return the spoofed value, it’ll only return the correct value if the player isnt in game.

#18

That would kick every player as it’s comparing player.Name to a table, for instance:

{"description":"There's peace in solitude.","created":"2009-08-20T17:41:27.387Z","isBanned":false,"id":4225178,"name":"Rdite","displayName":"Rdite"}

Additionally if the request just fails it will also kick the player if they weren’t already kicked by the fact that it’s comparing a table to a string.

#19

Actually it takes the username index if you scroll on a little more
image

But it seems roblox just did a patch anyways, don’t know how long it’ll last if it does.

1 Like
#21

Apologies, I am blind and stupid.

#22

No no, don’t call yourself stupid lol

2 Likes
#23

Hopefully this patch will be the final and only one needed, from what I’ve heard this has been known since 2019, but only recently surfaced.

#24

Its patched as the new signature has been rolled out according to the FFlag watcher. https://fflag.eryn.io/history/PCDesktopClient/DFFlagTestFullSig42

#25

The rprxy.xyz site is quite neat.

#26

This is a network vulneurability and not a traditional exploit. It’s done by modifying the information that is sent from the client to the server before the client loads in, therefore things like playeradded will fire after the info has already been spoofed

#27

A roblox staff just said name spoofing was patched now. (Well for DisplayName)

#28

Username spoofing was patched aswell.

1 Like
#29

image
image1329×320 31.2 KB

I guess they were trying to get a new signing system for the old public key pinning method

#30

There was a two part patch. The first part involved the membership type and account age as these were pretty safe to do. The second part added a handful of extra fields to the signed data, among these were UserName and DisplayName.

8 Likes
#31

Will Roblox be patching this soon?

#32

It’s already patched it seems like, look at the post above by ConvexHero.

1 Like
#33

Oh alright. Thank you for the help!

#34