An in-depth guide on how to identify what is hacks and what isn't.

[Tenebrous]

So as the thread title says, we are going to be doing a bit of "myth-busting" regarding hacked clients. To the most educated human beings 90% of this should be rather apparent.

This guide should be for moderators and experienced players. DO NOT use any of this information illegally (eg. downloading a client)


Sword Hacks

Killaura/Forcefield​

General Summary: Better known from the hacked client Nodus as Force-field. This is an auto-attacking hack, being able to hit out of range of normal distance, and at speeds not possible.

How to identify: Without modification this hack is usually one of the easiest to spot. Thanks to No Cheat Plus this hack looks extremely suspicious. If you see a player's head randomly flipping up and back down or doing 360s it is likely this hack, however not always.

How hackers like to hide it: This hack has several adjustable settings which can make it look more legit, be aware of this. The killaura in some clients has a setting known as lock view, turning it off will allow the player using it to move their head freely and not aim directly at the player. Unfortunately for us, this just makes it more difficult to recognize. Hackers can also adjust their killaura to swing at a certain speed and reach as well, turning it down will make them look more legit because they share the same reach as a regular player and at certain speeds it will look completely legit. Hackers also recently have gotten access to a setting known as "safety" or "killaura legit" or "silent" (thanks to my friend sethtard for [using jk] explaining this to me). Basically what I know is that there is a setting known as silent which makes your head derp less and there is another one known as safety which functions as a sort of triggerbot (see below). In addition to this hackers like to toggle this hack while in combat quite frequently. (There is a HUGE problem in the clan community with this.)
"Yes, you can set an Aura to as high as 20 APS (that's the maximum that the client / server will even recognize). The only way you can hit an Entity that quickly is if their health is being constantly updated. That can come from a mod like FastHeal / Regen or even an in-game effect, like the one from a Golden Apple. The entire point of having an APS speed higher than 6 or 7 (vanilla maximum) is, like you said, to target and hit multiple enemies rapidly. NCP will allow up to 15 or so APS (if the Entity is not rapidly updating health). NCP's multi-hit / FIGHT_DIRECTION check is a bit broken, as a delay as small as 50 milliseconds (which is the delay for 20 APS) will allow you to hit multiple Entities. NCP's biggest check against fighting is in the IMPROBABLE check (that check encompasses quite a bit), which tries to fix how fast you can rotate and attack an Entity at the same time (you can notice this in action if someone is running perpendicular to you and you hit them dead on - NCP won't like that and will cancel your hit). However, this can also be beaten with a good aimbot in a Kill Aura and, optionally, some basic movement prediction in the aimbot (this helps the case mentioned before - perpendicular hits)." [Rainbrella, client developer]

How to outsmart the hackers who try to hide it: At a point this hack doesn't become a hack anymore because it is too weak. Like if you set it to the lowest settings it isn't very noticeable or deadly. One thing that will really help you with hackers who are smart is to watch their sword, as soon as they get into range their sword will start swinging. Unless they click over it... which at that point it is undetectable without godly anti-cheat checking their click speed while the player is in the other players reach distance.

Example of it being used:

NCP Patch: Yes and no, depending on the internal settings of the killaura

Aimbot​

General Summary: This basically makes your player aim automatically at your opponent and clicks for you, giving you free kills.

How to identify: Aimbot is one of the more obvious hacks because the client is usually coded to aim at the nearest player and swing at maximum speed. If you see someone looking directly at or following your head (not always) in a fight it is most likely aimbot.

How hackers like to hide it: Aimbot has the same adjustable settings as killaura above, however its more difficult to hide because it automatically aims for the head of the player. However there is a bypass to this rule, some clients allow to pick which part of the body the aimbot aims for, etc.

NCP Patch: Yes and No, depending on the internal settings of the aimbot

Click Aimbot​

General Summary: Click aimbot allows you to automatically hit the nearest entity within range of you every time you left-click with 100% accuracy. This gives the hacking player a major advantage as in normal combat both players miss a lot of the time when they swing their weapon. Forcefield is superior in every way, but people often use this weaker hack instead because it's harder to spot and prove. The best way to tell if someone is using this hack or not is to see if they're hitting you while angled away from you or straight up facing another direction. You also get hit slightly faster than normally possible by people using this hack. Note that click aimbots do not affect bow accuracy.

Example of it being used:

NCP Patch: No

Triggerbot​

General Summary: A more legit and/or modified killaura that only swings when you're looking at an entity.

How to identify: I have unfortunately seen many members of this community use this hack, I'm not going to name people but I've seen it been used. Basically if you see someone who only swings their sword when the enemy is directly in front of them, it is most likely triggerbot.

Example of it being used:

(The person recording has a ghost client, I'll go into this later)

NCP Patch: No

Multiaura​

General Summary: A more overpowered killaura which can hit many more entities at once than regular killaura

How to identify: You'll know if its being used xD

Example: LeafyGreenTea

NCP Patch: Yes

Bow Hacks
Bow Aimbot​

General Summary: Auto aims your bow for you, doesn't really work in multiplayer because of player movement, however there is a prediction in some clients.

Specific Values, etc: Although this hack is patched by the current versions of NCP players can turn off and on several settings such as lock view, which will allow the player's head to follow exactly where the other player is going. Some clients have a prediction, allowing the bow aimbot to predict where the player goes, I have no idea how it works so don't ask me.

How to identify: If you see someone who pulls back their bow at someone, and then head flips around and shoots at a different person near him it is likely bow aimbot.

NCP Patch: Sort of, but it doesn't really work on multiplayer because of player movement

Fast Bow​

General Summary: Abuses the infamous fence glitch and shoots your bow much quicker than normal

How to identify: Just someone rapid firing arrows everwhere

NCP Patch: No, however there is a plugin to prevent this.
​

Other Combat Related Hacks
Criticals​

General Summary: Causes the player to jump just a little bit and get critical hits without touching space bar.

How to identify: Looks like someone making random little jumps

Regen​

General Summary: Regenerates health more quickly than usual and to the rate of the users liking

NCP Patch: No, but MCSG has patched it so you don't have to worry about it

Velocity/Anti-Knockback/NoPush​

General Summary: Causes the player to not take knockback when hit

Fishy things: In some clients the player is actually allowed to set the anti-kb to whatever values they want, this hack is a different more customizable form of Anti-kb known as Velocity. It gets really weird when you realize that the player has the ability to set their knockback to as low or as high as they want, also they can set it to take negative knockback. There are two settings, x-z knockback and y-knockback. If a player sets both their knockbacks to 3 they will fly up 3 times the normal knockback hits you up and 3 times the way back and if a player sets both their knockbacks to say 1.5 they will take 1.5 times the normal knockback both up and back. If a player sets their y knockback to 0 and their x-z knockback to 1 (normal) they will not be knocked up and only back which is pretty much an anti combo hack. If the x-z knockback is at 0 and their y knockback is at 1-3, they will only be knocked up and not back. If both settings are at zero the player will take no knockback. Now this is where things get really fishy. A player can set both their knockbacks to 0.5 so they take knockback but not enough and it doesn't look like their hacking, be aware of this. You can also set the values to below zero allowing you to be pulled toward the enemy when they hit you.

NCP Patch: Nope

Autosoup​

General Summary- This hack allows players to bassicly do nothing and beable to fight as the client soups for them, making them have a HUGE advantage over normal players. This hack is pretty easy to detect as if a moderator /invsee's you it will show your soup being used from your inventory. This hack allows players on a KitPvP server with soup to become practically unkillable, and is normally combined with Killaura and an Autosword/Autotool to become a killing machine. its quite easy to notice because if you go up and hit someone and they instantly soup, you can assume they are using the hack.

Controversial PvP Hacks
Strength Hack​

General Summary: Ah, the infamous "OMG HE 1 HIT ME HAKr!" hack. Although has been discounted several times by people saying it doesn't exist, there is in fact several glitches that certain clients can abuse to cause this effect, see this video:

God Mode Hack​

General Summary: Another controversial one, however this was patched

Client Sided Hacks (none have a ncp patch)​

-Fullbright- Makes it so there is no darkness.

-Xray- Renders only ores user wants to see, mainly used for finding diamonds or chests.

-Tracers/ESP- Draws a line from user to a player from the middle of the users curser. and ESP just highlights a box around other players.

-Nametags - This hack (mainly seen within Nodus, but can be seen in other clients) allows the user to know where other players are by increasing nametag size, so you can see their nametag outside of Vanilla range. Most Nametags have a built in option that shows if the player is sneaking (by changing their nametag to say red (or something along those lines). This, like radar and every other kind of client sided hack, is practically unpatchable because it is client sided and theres not much you can do about that.

-Trajectories - This hack is bassicly an ESP for any type of throwable objects, so the user is able to determine where the arrow/throwable object will land (as far as I am aware, this doesn't include potions). This hack obviously bypasses because of the fact that it just makes an ESP line (similiar to tracers) except using the Bow trajectory algorithm (math stuff for those who don't know) to simulate it.

-Waypoints- This hack allows the hacker to pinpoint an area and have a client sided tracer (sometimes designated with a specific color) added while this hack is enabled, allowing them to easily find where they are going.

-LSD - This hack is client-sided and makes your screen go all crazy, whether its just making the screen flash different colors, to zooming in randomly/crazily, to actually changing the colors of blocks themselves randomly. This hack is pure uesless and is mainly added because developers of clients get bored and want to add something stupid in.

-Rearview Mirror - Exactly as it sounds, this hack allows the user to see behind himself as if he were actually looking into a rearview mirror of a car. Mainly for PvP and watching your back, this hack really isn't in many clients these days (the most notable being Nodus when it was around). There really isn't much else to be able to say about this.

-Radar - This hack allows players to know where other players are (assuming said player is within Render Distance of the user!) and know exactly how far away they are. This hack would be sort of game-breaking because of the fact if your hiding, they would know where you are, and how to locate say a base of some sort. There is no practical way to patch this, as its just getting entitys within the renderdistance and getting the location of said players

-Invsee- Normally a moderation tool, lately clients have been able to tweak the system and gain access to what players have in there hand and what they area wearing ( so instead of seeing someone in enchanted diamond, and he says he has full IV and a sharp V sword) said player can .invsee him and see what his sword, and his armor really hold. The thing about this, is that it does not allow people to see what is in the rest of the inventory, only what the server sends to the client (so in laymans terms, what they are holding, and their armor).
​

Movement Hacks (mostly patched by ncp)​

NoSlowDown- This hack is not actually a Sprint hack and what your seeing is Nodus Sprint hack (as I've explained Nodus keeps you running). NoSlowdown is Bassicly not slowing down for Cobwebs, in water, or on soul sand. This hack is indeed nerfed, so even using it, you throw checks by NC+. The Sprint and hit is also blocked by NC+ under the "Improbable: player has failed the improbable more than expected" check.

VClip- The short name for Vertical clipping, is bassicly like a NoClip but only on the Y axis. This worked for quiet some time on bukkit servers without NC+ but is since patched by both NC+ and the Bukkit server itself, setting an alert off that a player made an illegal movement. This hack used to be used to clip into peoples bases, steal their items, and leave. There is a slight bypass to this by getting hit, but it only works up to about 6-8 blocks and is glitchy as all hell, due to the fact that bows, and everything else causes Knockback this is nearly unpatchable (there use to be a NoCheat+ Fly bypass using this same mechanic of hitting yourself).

STP - This hack is a new one, that is quite interesting to say the least. The Initials stand for "SpawnTeleport" and does such. I'm not sure about the inner workings of this one, but at the moment, when a player types that in as ".stp" in a client, it will kick the player for the message "Nope!" and spawn them back at the spawn point. This doesn't seem like such a big deal, except it bypasses PvP logging plugins and makes the timer for teleportation useless. This has been patched in Bukkit 1.7 due to the fact the glitch was on Bukkits side and NoCheatPlus couldn't do anything about it.

Derp Mode - This hack is one that makes your player go all well... derpy. It sends random hit/look packets to make your player "spaz out" (on everyone elses screen) but on your screen it looks normal. There are versions of this hack that are specific, Such as: turning your head inside out, Stare (Ingame you will be looking one way, but on your screen your not) and ones that just make you "spaz out" for lack of a better term. This hack really is not game breaking, and is more of a "why not" kind of hack, and can be easily replicated without the use of Nodus or any other client that has a retard mode in it.

Fly - The typical hack found in almost every client, which allows the client user to obtain flight. Mostly patched by NoCheatPlus there use to be plenty of bypass' (hitting yourself, using bed packets to fly, sprint flying, infinite jumping and I believe one other) this was one of the more saught after hacks/mods to bypass. This hack is pretty self explanatory as it just allows the user to fly...

Jump - A feature I don't quite remember besides the fact that the popular client "Nodus" had it, this hack allowed for editing your jump height to whatever you had wanted it to be. Often mistaken for Fly/Flight hacks, this was actually one of the more useless hacks and was mainly used for "the lolz" instead of for practicality as flight would do the exact same thing, but more accurately.

Phase - Phase is a hack that sort of works as a sort of VClip, that clips you maybe 1/10th of the way into a block and allows you to go through blocks that are "transparant" in the games eyes (these types of blocks include, but are not limited to: glowstone, fence, iron fences, steps, slabs, doors, and through the corner of solid blocks). This hack in essence allows you to bypass the /lock commands of LWC (in regards to doors) and access bases that you would not have access to. Check the video below for a better idea.

Blink - Imagine this as a LagSwitch of sorts. The player turns this hack on, and it freezes their player position and all updates from the client, similiar to the hack 'Freecam', but when you re-enable it, the server is updated with all of your moving packets and other things of that nature, making you able to teleport you to places or appear as though you are speed hacking. Because of the nature of this being a "LagSwitch" it does indeed bypass NoCheatPlus to an extent (you can't go teleporting 500 blocks in one go) but you can still do some damage in PvP, being able to teleport around your enemy player, similiar to EnderPort, or to get away from your opponent, or to simply get through areas that would be very highly guarded (An example would be MineZ's dungeons).

Dolphin- Allows you to "Dolphin" through the water going extremely fast, patched by ncp

Water Walk- Or jesus, allowed for players to walk on water and be able to move faster in water in general. This was one of NoCheat+'s many patches, but due to a recent descovery allows you to walk on water once again by VCliping you into the water slightly which bypass' NoCheatPlus' check for it.

Sneak- This hack allows the player to be sneaking, but move at normal speed. NC+ has patched this version of sneak, and the only other sneak makes it like your holding sneak, sort of like the Better Sprint Mod, but with sneak. The new bypass version allows you too sneak at nearly full speed and is almost unpatchable, due to the way it works. Here is Nahrs comment (again, thanks nahr for explaining this) that explains how it works:​

"Sneak is accomplished by concurrently sending the un-sneak and sneak packets, which rapidly adds and removes the player using the hack from NCP's sneaking players list. That's an old bypass that is kind of hard to patch, but at the same time not the most useful (the player will un-sneak every once in a while)." [Nahr, client developer]

Enderport - This hack I personally have only seen in one client, and it made it so when you got hit (or were about to get hit, something along those lines) you would be teleported behind said player. This hack is mainly a PvP hack, and because of its rarity i know nothing about it, but if you're hit, the teleportation would seem to work (assuming it follows the general rule that VClip does when you're hit).

Glide - Glide, in essence is a "slowfall" type hack. Referenced in this thread as a semi-NoCheatPlus flight bypass, this hack allows the user to extend their falling distance to great lengths, essentially making it a getaway tool for hackers in trouble (Imagine a person using a wing suit). Some versions of this hack don't bypass NoCheatPlus unless they are hit before they start gliding, while the ones that bypass auto-magically are severely nerfed because of how fast they have to fall.
​

Other Hacks​

NoSwing - One of the oldest hacks in the book, this hack simply stops the player animation of Swinging your arm. This can be used in a variety of griefing incidents or trolling incidents where the user would hit the person, but due to a lack of swinging their arm it would cause some confusion for the victim. This can easily be sighted if you simply watch the person, and he doesn't swing his arm while he is breaking a block, or hitting something. This hack does not actually bypass NoCheatPlus as it is simple to for NoCheatPlus to see if there was no Swing Arm movement while attacking/breaking blocks.

Freecam- This acts as an "out of body experience" allowing the player to fly/wander around within their render distance without actually moving or being known that they are their. Sadly this is unpatchable as it is all client sided. This in conjunction to cavefinder helps hackers find bases.

FastEat - Working alongside the same principles as Fastbow (read below) this hack allows players to eat any type of food within a matter of milliseconds, giving them an extreme advantage over any opponent because of the ability to eat a Golden Apple in nearly an instant. I'm not to sure if this is patched or not, but since Fastbow was patched I would assume this is as well.

Fastplace and Speedmine- Im going to kill two birds with one stone on this one. These two hacks do exactly what they say, enable the player to fastly placed blocks (somewhat checked by NoCheatPlus!) and SpeedMine, which allows players to break blocks slightly faster than the normal. Vanilla has blocked the ability to speedmine to an extent, and in conjunction with NoCheatPlus, makes speedmine pretty much patched (hackers are still able to break blocks faster, depending on their minespeed they set, but eventually is caught by how NoCheatPlus handles the check, which is check minespeed over X ammount of blocks and comparing it to what should normally happen.)

Creative Control- Imagine this as basically automated destruction. What this does is allow people to select two areas to create a region, and makes the player automatically destroy everything in that area until that area becomes air. This hack doesn't bypass NC+ in the one client that it is in at the moment so their is no reason to fear it.

Erratic- Basically the blink hack on steroids, it stimulates packets so much that you appear to teleport all around the player

Fake Hacker- Makes the selected player look like they're using killaura/aimbot

Paralyze- Stimulates packets on the player or on the target player causing insane knockback

Firion- Basically a version of freecam that allows you to fly around the map and shoot arrows from above

​

What hacks cannot do
-Fishing rod macro/Autoclick

-Force op (Although there is a glitch for this to work in some clients but it requires the server to have a specific plugin)

-Reach Hack- This one is Iffy. Yes, a client can take advantage that the fact Bukkit only checks if the player is within about 6 blocks of an entity before hitting/interacting. but NC+ has knocked that range down to about 4.25 blocks (this is due to accounting for lag) while the vanilla fight distance i believe is at 3.5 blocks. Above a 6 block range (placing and hitting on bukkit and vanilla servers) it is not possible to place outside of those ranges, though it use to be possible. While it is an advantage, heres the question, would you rather be whacked at 6 blocks, or 4.25 where you still have a chance. I know i would choose the latter option...




Ghost clients are clients with a hide-able menu and several settings making it look more legit so you can record with them and it looks normal, its as simple as that.
However there is some controversy pertaining to the fact that they do exist, check out this comment made by Cinquae on a video.

"Ok, for everyone saying "Ghost clients" are actually a thing. They are myth, always have and always will. The term "Casper client" originated when people couldn't find anything to hackusate Cayden on so they brought it up. If someone can find me a "Ghost client" where it makes you look like "Cayden" then lets see it. When people "Claim" to have a ghost client its usually vip huzuni or wurst of some s***. You can hide the gui and triggerbot. but tell me how am I "Triggerbotting" if u can hear me clicking and the particles + mouse are in sync. You guys never fail to amuse me everytime I hit the comment section." [Cinquae, Pot PvPer]

"Oh, and for that one kid who says "Some1 can code it super good". Prior to playing minecraft I coded java for 5 and a half years. I took a look at minecrafts code and there is no way you can possibly make it to where you hit them without people questioning it. Personally, from my coding and expertise with all this Good I can tell you Cayden was "Client free". At the most he used some click modifier or something of that sort. However, Just saying no "Ghost client" can make you seem anywhere close to legit since Aura "The modified hit range" can only be tempered with from a certain range. In most clients fighting a hacker or being one urself you can see when you get those hits. Usually it's because the code (Which I wont relay to you atm) is not verified with minecrafts original hit radius (Creating the range you all see when someone is hacking). At most, you can lower the "Range" which is only lowering the actual hack not the minecraft hit radius. You can still tell when someone is cheating even with the lowest settings. So yeah, ill pay someone 50 dollars if you can find me any "Client" that makes you seem legit. Oh, and if ur some kid who thinks I am cheating, you're absolutely r*******." [Cinquae, Pot PvPer]




Many of the pvp specific hacks can be replicated by normal gameplay
People such as Cayden, Zayshi, Cinquae, SwaggingSheep, and ComboDombo are famous for "head twitches", making it look like they hack but they really don't.
​

Thank you and I hope you enjoy my guide
I might make more of these sometime
Credits go to: Awkward_Midget for doing some of this for me


​

 

[Tenebrous]

Comment if you'd like some changes, all opinions are welcome!

 

[Sepyz]

You have too much free time. +1

 

[AlLuc]

Nice guide, I knee majority of tjese except for the less noticible like tracer, thanks

 

[TheMangoTiger]

Nice guide woah!
Maybe to improve it's layout though, just split up each of the bulletpointed hacks with a gap/enter key or whatever, and change the green text at the end it hurts ma eyes ;-;

Other than that the content is really useful and this must have taken ages. Thanks for making it

 

[Tenebrous]

Nice guide woah!
Maybe to improve it's layout though, just split up each of the bulletpointed hacks with a gap/enter key or whatever, and change the green text at the end it hurts ma eyes ;-;

Other than that the content is really useful and this must have taken ages. Thanks for making it

Fixed.

 

[Trilexium]

I knew most of this already due to some client analysis here and there on my test server, but it's still a great and informative guide nonetheless. Now I have something to link people when they call hacks on me (which happens several times a day because of my weird tendency to look up while hitting people).

 

[Tenebrous]

I knew most of this already due to some client analysis here and there on my test server, but it's still a great and informative guide nonetheless. Now I have something to link people when they call hacks on me (which happens several times a day because of my weird tendency to look up while hitting people).

I know what you mean by head twitches and looking up, many get banned for this on here however its more common and accepted in the potpvp community. People such as Cayden and Cinquae show two POVs of this tactic.

Spoiler: [Videos Contain Bad Language]

 

[hdwisiaaof]

this should be compulsory reading for mods

 

[Trilexium]

I know what you mean by head twitches and looking up, many get banned for this on here however its more common and accepted in the potpvp community. People such as Cayden and Cinquae show two POVs of this tactic.

Spoiler: [Videos Contain Bad Language]

I know who both of them are- Cayden just played on a ridiculously high sensitivity and had perfect aim, and Cinquae is more like what I'm like. Whenever his head goes up on his opponent's screen it goes up on his screen too- ruling out triggerbot because on his screen he wouldn't look up (should he have been using a client).

I just get a whole bunch of hackusations for things like looking up while hitting and 'impossible head movements' (quickly snapping to someone behind me- that little trick got me banned from kohi).

 

[Ceroria]

I can provide some examples of Click Aimbot/Triggerbot if you'd like. Unfortunately the TriggerBot ones would cause flame here seeing as they are videos of members in this community. I could probably post one of them, seeing as the player is already banned (not for the evidence I have, I never submitted it because it really wasn't enough but it's kind of fishy)

 

[Tenebrous]

I can provide some examples of Click Aimbot/Triggerbot if you'd like. Unfortunately the TriggerBot ones would cause flame here seeing as they are videos of members in this community. I could probably post one of them, seeing as the player is already banned (not for the evidence I have, I never submitted it because it really wasn't enough but it's kind of fishy)

May I see them?