ExploitPreventer

ExploitPreventer

This is a fabric mod that prevents known client-side exploits.


Disclaimer: Use this mod at your own risk. The maintainers are not responsible for any bans or other consequences.

If you're interested in servers or plugins that are using these exploits then look in the Hall of Shame.

Beware of fake downloads

Only download ExploitPreventer from the official Modrinth page: https://modrinth.com/mod/exploitpreventer

Fake or unofficial versions of this mod may contain malicious code.

Exploits

This mod currently protects against the following exploits:

• Sign translation vulnerability (and other component magic)
• Local HTTP request via resource pack
• Device fingerprinting via resource pack

Sign Translation Vulnerability (and other component magic)

Link: https://wurst.wiki/sign_translation_vulnerability

A server can trick a client into resolving translation keys and sending the resolved text back to the server. This allows the server to get what mods are installed on the client (by checking for mod-specific translation keys or keybinds) and player languages etc.

Our fix: We prevent the client from resolving translation keys and keybinds on sign and anvil edit screen.

Local HTTP request via resource pack

Link: https://alaggydev.github.io/posts/cytooxien/

A server can force the client to make HTTP requests to any IPs, including local services (e.g. http://localhost:8080) by sending a specially crafted resource pack URL. The server also can know whether the request was successful or not, or if the SHA1 hash of the response matches a specific value. The server can use this to detect what local services are running on the client machine (e.g. router, TVs, previously LiquidBounce).

Our fix: We block resource pack URLs that point to local IPs. Ideally, we would like to block all HTTP responses without a proper CORS header (just like a browser), but this would break backwards compatibility.

Device fingerprinting via resource pack

Link: https://alaggydev.github.io/posts/cytooxien/

A server can abuse the client-side resource pack cache to uniquely identify clients. This allows a server to track users across multiple sessions, even if they change their username or IP address.

Our fix: Each account would have its own resource pack cache directory. This way, the server cannot correlate resource packs between different accounts.

Mod detection via plugin channels

Some mods register plugin channels to communicate with the server. Servers can use these channels to detect the presence of certain mods on the client.
This behavior is intentional and required for many mods to function correctly (e.g. for mod specific features, networking, or compatibility with server-side plugins).


Because this information is explicitly exposed by the mod itself, this mod does not attempt to block or hide plugin channel registration or usage. Doing so would break legitimate mod functionality and is outside the scope of this project.

Other mods

There are other mods that attempt something similar. These mods are not recommended because they are either waiting for my patches that they can incorporate them into their own mods, were created entirely using AI or are simply cheap copies of my mod.

Getting Death Threats

Due to the nature of this project, exposing and protecting against exploits used by certain servers, I have received death threats from individuals who feel threatened by this work. These threats are serious and do not go unnoticed.


However, they will not stop me. If anything, receiving death threats only reinforces that this project is hitting where it matters. The people sending them have a clear interest in keeping these exploits alive and players unprotected. I will continue to maintain and improve this mod, expose new exploits as they are discovered and fight even harder for player privacy and security. Intimidation is not going to work here.


If you are aware of who is behind any such threats, please report them to the appropriate authorities.

Reporting

If you discover a bypass or any other client-side exploit, please contact nikoverflow on Discord or send an email to nikoverflow007@gmail.com. Include a brief summary of the issue, clear step-by-step reproduction instructions, the Minecraft version you used and any relevant logs or screenshots.