xAPI - A Powerful Pentesting and Debugging Tool

Introduction

xAPI is a fast, flexible and powerful pentesting and debugging tool written in pure luau.
It can detour, decompile and clone functions, hook metamethods and features over 60 globals that emulate the functionality of most executors.

Installation

To install xAPI, you will need to install the module from the GitHub repository and then insert it into your game, preferably inside of game.ReplicatedStorage.

You can then use the following script to load xAPI:

require(game.ReplicatedStorage.xAPI)()

Feedback and Improvements

  • Go to Issues for questions or bugs
  • Go to Pull Requests for improvements

Notes

Current version: 4.1

53 Likes

Pretty sure this is against Roblox ToS. Its pretty much the same thing as a Ultimate Trolling GUI. If you put it inside the game, your game will get deleted.

10 Likes

Is it really? There’s no real exploiting nor anything that ruins other players’ experience. I mean you could do it, but that’ll be like saying Roblox Studio is against the TOS because you can make TOS breaking content in it.

19 Likes

Unfortunately yes. Even if its not real exploiting you can still insert innapropiate things with it. Its the same case as Ultimate Trolling GUI. With that, you can also insert innapropiate things. I’ve seen countless Script Executor games get deleted in an almost instant.

The reason why its probably against the ToS is because it allows you to insert things without it being really in the game. Making the game basically not liable. The ToS prevents that and will get the game/creator banned.

9 Likes

With xAPI there’s only one function which could insert innapropiate things: a modified version of require. That’s it. There’s no loadstring, Http requests or GetObjects.

(Outdated since v3.5.0)

6 Likes

I have updated the post. Require can also insert Ultimate Trolling GUI.

7 Likes

And using require isn’t against TOS. Your point? Even if there’s a possibility of someone using my script maliciously, it’s still not me who did it.

17 Likes

Seems like you haven’t read my post.

require is only against the ToS if you’re inserting ToS breaking stuff.

4 Likes

So require isn’t against TOS unless you are using maliciously? Doesn’t that apply to xAPI as well?

11 Likes

No. xAPI is a Script Executor. and once again the ToS doesn’t like Script Executors because they can make the game not liable.

4 Likes

It’s not a script executor though.

6 Likes

image

3 Likes

*Simulator. It’s supposed to mimic the functions of a Roblox executor which vanilla Roblox doesn’t have.

13 Likes

Simulator or not, its STILL a Script Executor.

3 Likes

Have you read the source code? There’s no way you can execute scripts using it. (OUTDATED, still not an executor though)

13 Likes

Its no different then using HD admin :insert command… All It can do is require other things which have been uploaded to roblox and already passed moderation.

Anyway, the creator of the asset is not responsible for how people use it.

9 Likes

No. im not gonna read a 600 line code.

Yes. But HD admin is for admins only. You can’t decline that it can be used by multiple people (which are also not ADMIN) and insert malicious things. You also can’t decline that multiple Executor games have been banned in the past and still are.

2 Likes

Seems cool, but what are the use cases? Making exploits so skids can play with it?

4 Likes

If you’re not gonna read it, then how do you know what you are talking about?

15 Likes

HD Admin can be used by anybody??? It’s a free model, not limited to roblox admins. There are hundreds of free admin games which haven’t been banned. You can not insert malicious things via the require command or insert service, etc as they are only able to insert things which have already been uploaded to roblox and gone through moderation,

Script executers which make use of load string have been banned, that is because players can run their own code which has not been moderated by roblox in a live environment that roblox can not moderate.

Also, you dont need to read the source code, its not that hard to search for instances of load string and find that there are none.

Lastly, it really doesn’t matter. If roblox has a problem with this asset, they have the right to moderate it, you dont.

16 Likes