How to Catch a Hacker

[F4ithl3ss]

Other Guides/Rules:

Main Admin Training Guide

Jailbreak Bible

Guide on what NOT to do

HLDJ/Mic Rules

Macrodox Guide

Rules for Racism

Guide on getting proof for bans

Guide To Make A Ban/T-List Report

 

--Credit to former member "Slazenger" for this post---

 

This won't be short...but I've been disturbed by how many of our admins have been banning suspected "hackers" when it is painfully obvious to seasoned players that they are not hacking. I don't claim to be wonderful at CS:S, and I haven't played competitively since CAL fell apart, but I know the ropes fairly well. Hopefully this will help you make the correct call on whether someone is hacking or not.

 

If you have any doubts, try calling in an experienced player or admin before banning the person you think hacks. When you ban someone wrongly, it makes you look bad, it makes our clan look bad, and it makes our server look bad. So let's try to avoid that.

 

Remember, always take demos of players when you suspect that they are hacking. If you do not, we cannot permanently ban them.

 

 

How To Catch A Hacker 101

 

 

 

What to Look For

This is the hard part. There are a good number of Counter-Strike hacks out there, and just as many players that are great at hiding the fact that they're cheating. You have to be diligent with your sound while spectating; remember some people have 7.1 surround sound, or 360 degree headphones and can hear quite clearly in any direction. Also, watch the radar. A good player will constantly check the radar and be able to make very accurate assumptions based on:

• Where a teammate died.
  
• What direction the teammate was heading.
  
• What direction the teammate was facing.
  
• Where the teammate was in regards to the locations of your other teammates.
  
• Spots where there are no teammates, leaving a gap for the enemy.
  

Another factor that may seem like someone is hacking, is if they are able to kill someone without even being able to see them. There can be a few reasons for this:

• Angles. A lot of the time you can spot (or be spotted) without being able to see the other person. Refer to this guide on angles to see what I mean.
  
• Spectating. Some players that die early in the round will observe the habits and skills of the opposing team. This will let them choose where to prefire next round, or have a good idea of where certain people are going/hiding.
  
• Anticipating common hiding/camping spots. You got prefired? You most likely are sitting behind a crate or door/wall that people sit behind on a regular basis, some players will just prefire in certain areas just in case, if it's a common spot.
  
• Shadows. Seriously people, make sure you have shadows turned on, and on high. Also be aware of where your shadow is at all times. Refer to this guide on shadows to see what I mean by your shadow will cast through things like doors.
  
• Your model clips through thin objects. So if you have your barrel poking through the middle of a door, you deserve the headshot that's coming your way.
  
• Your viewpoint is roughly in your upper chest. You do not see out the eyes of your player model, so if your head suddenly gets detached, remember that your point of view is lower than your head.
  

Also, if someone is spraying and keeps getting miraculous headshots, just watch the direction of the gun and see how the player controls the recoil. This is a tough one to spot but don't forget that you can somewhat control your spray. It honestly differs by gun type. I love the AK, but it takes some skill to handle. When a good players pulls headshots off with it or sprays and gets a headshot it's because they know how to handle it. Each gun is different. Here's the article on the AK-47, which shows recoil patterns.

 

 

 

Now the Problem. Good Hackers

There will always be people that hack, in any game, everyday. A lot will do everything in their power to make themselves seem legit. Even letting themselves get killed regularly just to keep the suspicions down, or toggling. Also, despite the info given above, it's hard to differentiate between a skilled player using the above tactics, or someone who is ghosting (a friend specing you and relaying everything to the player hunting you). Your best bet is to record a demo, and get the opinions of a few different people that deal with hackers on a regular basis. Remember, there as just as many skilled players as there are hackers out there, your decision in the matter can very often be a tough one.

 

 

Some Common Hacks

 

I haven't ever used hacks before, so some of these definitions may not be technically correct, but this is how they work to the best of my knowledge.

 

Aimbot

In CS:S, a player's model is composed of things called "hitboxes". These hitboxes allow differently placed shots to register depending on where the bullet struck. An aimbot is a program/script that causes a player to automatically target a specific hitbox (usually head, although I've seen an aimbot that allows you to target the chest hitbox). So essentially, every shot they fire will hit that specific hit box when the player aims "near" the hitbox. So say that the hacker has aimbot targeting the head hitbox. When the hacker aims around the player's head (his shoulders/chest, and the air around his head) it will register as a headshot. Some players have a high sensitivity and jerk their crosshair extremely fast, so it may just be a good flick that lined up the shot. Aimbots are not to be confused with a toggle aimbot, explained next.

 

Toggle (also known as an aimkey)

This is where a player may play without an aimbot and simply hit a key to activate it when they get in a sticky situation. This is obviously harder to catch, since the player may be playing normally and then pull off an amazing headshot. A lot of spectating is needed to try to identify this. When they release the key, the aimbot is no longer activated.

 

Wallhack

Allows players to see through walls, props, etc. Most use a wireframe setup that shows the models through things. Others used colored models. You can detect these by seeing the player lining up shots/headshots before they can see the player and also when they prefire (shoot before seeing the player). But as I warned before, if the player can hear you coming, he might try to judge when you are going to come around a corner and therefore he prefires on you. This is very hard to catch with experienced hackers.

 

Spinbot

One of the most blatant hacking subtypes. This causes a player to spin rapidly in circles and instantly one-shot headshot any player around. More explanation should not be needed.

 

Speedhack

Causes a player to move around the map faster than other players. Quite obvious. Can be turned on and off at will. If they are on your team, it's obvious if they do it as soon as they spawn. If they are on the opposite team, gauge how long it takes a player to get from spawn to a certain point. If the player can get their significantly faster they may have speedhacked. Spectating is the best option since bunnyhoppers also move quite fast.

 

No Recoil

This allows players to shoot a gun and not have the effect of recoil change their aim. Look for extremely close shot grouping and an ability to turn in a circle and hit multiple targets on the same height level in the head. No Recoil can easily be spotted, most of the time it will cause shaking under spectator view when shooting. Other cases the crosshair just won't move at all and that is easy to notice also. It's easiest on guns like the AK, which have huge recoil (see the AK-guide I linked earlier).

 

Radar Hack

Radar hacks allow players to see the locations of players on the map by showing the icons of all players on both teams on their radar. These are hard to catch. If they repeatedly go running around the map and killing all of the opposing team's players with a set pattern, they may be radar hacking. Again, it's very hard to catch since the player may just be walking around randomly. This takes a lot of spectating to identify.

 

 

AutoShoot (Also known as a "Trigger")

Puts aiming and firing on auto-pilot. As you move around, the hacking protocol will fire at players automatically, without you pulling the trigger. Can be hard to notice, unless when it fires it is set up to just get headshots.

 

NoSmoke/NoFlash

This is surprisingly common actually. They allow the user to be impervious to the effects of smoke and flash grenades, giving them a tactical advantage. It can be hard to spot without a lot of spectating. If they rush and throw a flash and keep running into it while pulling off good shots, it's possible they have an antiflash. If they shoot players through smoke and headshot them with ease (multiple times), they may have an antismoke hack.

 

MultiHack

This is the general term given to when a player is using multiple types of hacks at once or has a script that allows them to use multiple hacks. This is a prime example.

 

 

 

My hope is that this guide will give our newer admins some insight on how to identify different hackers and keep everyone on their toes looking for hackers and recording demos. If you do not know how, please look below.

[ttaM]

I love giving credit to the original author.

 

Slazenger made this.

[Fulcata]

This won't be short...but I've been disturbed by how many of our admins have been banning suspected "hackers" when it is painfully obvious to seasoned players that they are not hacking. I don't claim to be wonderful at CS:S, and I haven't played competitively since CAL fell apart, but I know the ropes fairly well. Hopefully this will help you make the correct call on whether someone is hacking or not.

 

If you have any doubts, try calling in an experienced player or admin before banning the person you think hacks. When you ban someone wrongly, it makes you look bad, it makes our clan look bad, and it makes our server look bad. So let's try to avoid that.

 

Remember, always take demos of players when you suspect that they are hacking. If you do not, we cannot permanently ban them.

 

 

 

How To Catch A Hacker 101

By [HG] Slazenger

 

 

 

What to Look For

 

This is the hard part. There are a good number of Counter-Strike hacks out there, and just as many players that are great at hiding the fact that they’re cheating. You have to be diligent with your sound while spectating; remember some people have 7.1 surround sound, or 360 degree headphones and can hear quite clearly in any direction. Also, watch the radar. A good player will constantly check the radar (http://www.fpsgod.com/dont-forget-about-the-radar/) and be able to make very accurate assumptions based on:

 

Where a teammate died.

What direction the teammate was heading.

What direction the teammate was facing.

Where the teammate was in regards to the locations of your other teammates.

Spots where there are no teammates, leaving a gap for the enemy.

 

Another factor that may seem like someone is hacking, is if they are able to kill someone without even being able to see them. There can be a few reasons for this:

 

Angles. A lot of the time you can spot (or be spotted) without being able to see the other person. Refer to this guide on angles (http://www.fpsgod.com/introduction-to-angles/) to see what I mean.

Spectating. Some players that die early in the round will observe the habits and skills of the opposing team. This will let them choose where to prefire next round, or have a good idea of where certain people are going/hiding.

Anticipating common hiding/camping spots. You got prefired? You most likely are sitting behind a crate or door/wall that people sit behind on a regular basis, some players will just prefire in certain areas just in case, if it’s a common spot.

Shadows. Seriously people, make sure you have shadows turned on, and on high. Also be aware of where your shadow is at all times. Refer to this guide on shadows (http://www.fpsgod.com/being-one-with-the-shadows/) to see what I mean… your shadow will cast through things like doors.

Your model clips through thin objects. So if you have your barrel poking through the middle of a door, you deserve the headshot that’s coming your way.

Your viewpoint is roughly in your upper chest. You do not see out the eyes of your player model, so if your head suddenly gets detached, remember that your point of view is lower than your head.

 

Also, if someone is spraying and keeps getting miraculous headshots, just watch the direction of the gun and see how the player controls the recoil. This is a tough one to spot but don’t forget that you can somewhat control your spray. It honestly differs by gun type. I love the AK, but it takes some skill to handle. When a good players pulls headshots off with it or sprays and gets a headshot it's because they know how to handle it. I, Slaz, have even had that happen before, believe it or not. ^^ Each gun is different. Here’s the article on the AK-47 (http://www.fpsgod.com/the-ak-47-css/), which shows recoil patterns.

 

 

 

 

Now the Problem. Good Hackers

 

There will always be people that hack, in any game, everyday. A lot will do everything in their power to make themselves seem legit. Even letting themselves get killed regularly just to keep the suspicions down, or toggling. Also, despite the info given above, it’s hard to differentiate between a skilled player using the above tactics, or someone who is ghosting (a friend specing you and relaying everything to the player hunting you). Your best bet is to record a demo, and get the opinions of a few different people that deal with hackers on a regular basis. Remember, there as just as many skilled players as there are hackers out there, your decision in the matter can very often be a tough one.

 

 

 

Some Common Hacks

 

I haven't ever used hacks before, so some of these definitions may not be technically correct, but this is how they work to the best of my knowledge.

 

 

 

Aimbot

 

In CS:S, a player's model is composed of things called "hitboxes". These hitboxes allow differently placed shots to register depending on where the bullet struck. An aimbot is a program/script that causes a player to automatically target a specific hitbox (usually head, although I've seen an aimbot that allows you to target the chest hitbox). So essentially, every shot they fire will hit that specific hit box when the player aims "near" the hitbox. So say that the hacker has aimbot targeting the head hitbox. When the hacker aims around the player's head (his shoulders/chest, and the air around his head) it will register as a headshot. Look for a shaking screen, jumping crosshair, or crooked/upside-down screen while spectating them. Some poor quality aimbots may cause those effects. Be advised that some players have a high sensitivity and therefore and jerk their crosshair extremely fast, so it may just be a good flick that lined up the shot. Aimbots are not to be confused with a toggle aimbot, explained next.

 

 

Toggle (also known as an aimkey)

 

This is where a player may play without an aimbot and simply hit a key to activate it when they get in a sticky situation. This is obviously harder to catch, since the player may be playing normally and then pull off an amazing headshot. A lot of spectating is needed to try to identify this. When they release the key, the aimbot is no longer activated.

 

 

Wallhack

 

Allows players to see through walls, props, etc. Most use a wireframe (http://i107.photobucket.com/albums/m285/tymun/e618b02f.jpg) setup that shows the models through things. Others used colored models (http://i107.photobucket.com/albums/m285/tymun/ca5cc2da.jpg). You can detect these by seeing the player lining up shots/headshots before they can see the player and also when they prefire (shoot before seeing the player). But as I warned before, if the player can hear you coming, he might try to judge when you are going to come around a corner and therefore he prefires on you. This is very hard to catch with experienced hackers.

 

 

Spinbot

 

One of the most blatant hacking subtypes. This causes a player to spin rapidly in circles and instantly one-shot headshot any player around. More explanation should not be needed.

 

 

Speedhack

 

Causes a player to move around the map faster than other players. Quite obvious. Can be turned on and off at will. If they are on your team, it's obvious if they do it as soon as they spawn. If they are on the opposite team, gauge how long it takes a player to get from spawn to a certain point. If the player can get their significantly faster they may have speedhacked. Spectating is the best option since bunnyhoppers also move quite fast.

 

 

No Recoil

 

This allows players to shoot a gun and not have the effect of recoil change their aim. Look for extremely close shot grouping and an ability to turn in a circle and hit multiple targets on the same height level in the head. No Recoil can easily be spotted, most of the time it will cause shaking under spectator view when shooting. Other cases the crosshair just won't move at all and that is easy to notice also. It's easiest on guns like the AK, which have huge recoil (see the AK-guide I linked earlier).

 

 

Radar Hack

 

Radar hacks allow players to see the locations of players on the map by showing the icons of all players on both teams on their radar. These are hard to catch. If they repeatedly go running around the map and killing all of the opposing team's players with a set pattern, they may be radar hacking. Again, it's very hard to catch since the player may just be walking around randomly. This takes a lot of spectating to identify.

 

 

 

 

AutoShoot (Also known as a "Trigger")

 

Puts aiming and firing on auto-pilot. As you move around, the hacking protocol will fire at players automatically, without you pulling the trigger. Can be hard to notice, unless when it fires it is set up to just get headshots.

 

 

NoSmoke/NoFlash

 

This is surprisingly common actually. They allow the user to be impervious to the effects of smoke and flash grenades, giving them a tactical advantage. It can be hard to spot without a lot of spectating. If they rush and throw a flash and keep running into it while pulling off good shots, it's possible they have an antiflash. If they shoot players through smoke and headshot them with ease (multiple times), they may have an antismoke hack.

 

 

MultiHack

 

This is the general term given to when a player is using multiple types of hacks at once or has a script that allows them to use multiple hacks. This is a prime example (http://i107.photobucket.com/albums/m285/tymun/7c8db417.jpg).

 

 

 

My hope is that this guide will give our newer admins some insight on how to identify different hackers and keep everyone on their toes looking for hackers and recording demos. If you do not know how, please look below.

 

________________________________________

 

From Master's Ban Request Template Thread (http://www.hellsgamers.com/forums/showthread.php?t=18) with some alterations/updates by me.

 

How to get proof?

 

First the demo!

 

To get a demo you must first have you console enable.

To do so you want to go to options>keyboard>advanced.

There a box should open. With it open check the enable console.

 

Now when console is enabled open it up. Default key is (~).

 

1. With console open type in "record filename" . Whatever you type in filename is the name the demo will save to your hard drive as.

2. Watch the player and make sure to type in "status".

3. When you think you have gotten enough proof then type "stop".

 

The demo has been made!

 

Where is the demo located?

Normally the demo is located in your cstrike folder.

Location = C:\Program Files\Steam\steamapps\<Your Steam Name\counter-strike source\cstrike

 

In this folder you will have you demo, which will be name as of what you called it.

 

Then you will need to upload it to another site (http://www.zhost.hellsgamers.com (http://www.zhost.hellsgamers.com) or http://www.mediafire.com (http://www.mediafire.com)) and include the link to download it in your post or upload it through the Manage Attachment Button on the forums.

 

How To Get The Hackers Steam ID

 

You can do so by typing status in console.

 

 

How to take a Screen Shot:

 

Way 1:

1. Get all the information you want to be taken on the screen. Console screenshots can help in some situations, especially to give their STEAM ID, and name.

2. On your keyboard press your screenshot key, F5 for default.

3. Then go to C:\Program Files\Steam\steamapps\<youraccountname>\counter-strike source\cstrike\screenshots

4. You can either upload these to another site (http://www.zhost.hellsgamers.com (http://www.zhost.hellsgamers.com), photobucket, etc.) and give the IMG code, or upload it through the Manage Attachment Button on the forums.

 

Way 2:

1. Get all the information you want to be taken on the screen.

2. On your keyboard press the "Prt Scr/Sys Rq button.

3. Open up paint and right click and press paste, or Ctrl + V.

4. Save the image where you can find it.

5. You can either upload these to another site (http://www.zhost.hellsgamers.com (http://www.zhost.hellsgamers.com), photobucket, etc.) and give the IMG code, or upload it through the Manage Attachment Button on the forums.

 

http://webcache.googleusercontent.com/search?q=cache:cDL3cavF7dIJ:hellsgamers.com/archive/index.php/t-14196.html+&cd=1&hl=en&ct=clnk&gl=us&client=firefox-a

 

https://hellsgamers.com/threads/14196-Guide-How-To-Catch-A-Hacker-101

[Cal45]

Awesome write-up. This was definitely needed!

[ttaM]

Awesome write-up. This was definitely needed!

 

It's been on the website for over 2 years

[Devistator]

I remember this.

[Colonel Potter M.D.]

I remember this & Slaz

[Cal45]

It's been on the website for over 2 years

 

The reminder was needed because this still happens pretty frequently.

[Hobbes]

The reminder was needed because this still happens pretty frequently.

 

What reminder?

[AnonyHorse]

What reminder?

 

This is the reminder

[fweakz]

Great writng on how to catch a hacker, i think this is needed for everyone who host a server, nice job

[jessicasmith]

very nice forum

[Crucible]

Hey All, I read this post through and didn't see what i was looking for, I am not an Admin but i try to help to get demo's when i catch haxxors and get them banned with the help of Persian Skillz and some other admins on my f/l. now to my point, we have some high ping players on the dust2 unlim. server and i understand their ping can be 160 or sometimes more, and be playable as long as it is stable i have no qualms about that, but sometimes those players pings are spiking and they still pwn? could someone be lag switching and how would learn to catch it? Thanks in advance

[Tyler2]

This needs to be used more often....people need to go right down to How to get proof and read that shit

[xWolfpack]

Catch me if you can

[Crucible]

Thank You F4ithl3ss for doing a repost of this. i knew some of the tricks, but wow that article opened up a whole new door. was that something you saved off a while back or was it still in the forums? i searched everywhere i could think to look and about the only guide i found was Mr. Diamelo's article on bhop scripters

[excalibuR]

a repost? this been up since 2011 bud.

[Crucible]

Umm yea? not trying to be an ass, but but if it was posted in a different place in the forums and it gets reposted here. i would think it would be called a repost

[RedDevil6193]

I m tired of removing derp posts, if you are making post make sure its for asking a question and not something "free post" type.

[KiLLeR SeNSaTioN™]

Gentlemen,

 

The text of the original post credited to Slazenger (aka ExcalibuR) was copied from the Next Level Gaming website.

 

Ironically, this individual was VACBANNED for hacking last week.

 

It's unfortunate that this individual got over on this clan for months with his l33t hidden hacks and no-one was able to catch him; until the Valve Anti-Cheat System caught him.

 

As a financial supporter of this clan, I have a valid concern that he is allowed to promote and solicit donations for his hacks on the website.

https://hellsgamers.com/topic/102954-aimbot-activated/

https://hellsgamers.com/topic/102741-wallhacks-activated/

 

It seems counter-productive to me.

 

Regards.

[tinkerbell]

very useful write up on this topic, thanx