How to detect backdoors?

I want to know what's the best way to spot a back door in a leak so I don't get tricked

I don't know but i think a goodanti cheat can spot a back door

Basicly,
- Read and understand all code you run on your servers.
- Do NOT put workshop add-ons on a server directly, unpack and check them instead
- Override RunString/RunStringEx/CompileString to prevent running remote HTTP payloads.
- maps may have backdoors
- encrypted and/or obfuscated code is encrypted and/or obfuscated for a reason, a very bad reason.

For leaks, begin with searching for encrypted code patterns, like _G[, http, RunString(Ex), CompileString, \12\34\56 (regex \\\d+)

also a lot of backdoor examples: https://github.com/RyanJGray/Backdoor_Busting_2015

p.s. and if you spotted a backdoor in a leak - please share your findings!

14-07-2018, 11:31 AM

Asepia Wrote: I want to know what's the best way to spot a back door in a leak so I don't get tricked

Yeah I needed some help with this stuff too incase I got Backdoor Content

14-07-2018, 11:31 AM

Asepia Wrote: I want to know what's the best way to spot a back door in a leak so I don't get tricked

All you really need to do is skim through the code and make sure it doesnt say anything like ulx grant this dude bs or make sure it isnt leading to a database giving someone permission to delete the server. To sum it all up make sure you have a person by your side to help you with your backdoor needs.

I would say you have to test around. You cant basically say how to detect any backdoor if you dont know where one could be

I read all the replies and found it helpful, I need to start just putting workshop addons on my server, its always annoying when you find the last working LEAK and it has a backdoor for an addon you love.

Never thought of checking the leaks or addons I download from the workshop, your post made me think again on how I deal with custom content for sure. Are they that common though?

If you know lua, you can just read trough all the code.

If you don't know lua, don't download leaked addons.

Well the usually their like run console command bla bla then ulx adduser STEAM ID superadmin , just look in every script and in gamemode just every where , there is no back doors in CL