How to Catch a Hacker
Posted: Sun Oct 28, 2012 1:58 pm
Came across this explanation on catching hackers. Hope it proves interesting and helpful to everyone.How to Catch a Hacker
This won't be short...but I've been disturbed by how many of our admins have been banning suspected "hackers" when it is painfully obvious to seasoned players that they are not hacking. I don't claim to be wonderful at CS:S, and I haven't played competitively since CAL fell apart, but I know the ropes fairly well. Hopefully this will help you make the correct call on whether someone is hacking or not.
If you have any doubts, try calling in an experienced player or admin before banning the person you think hacks. When you ban someone wrongly, it makes you look bad, it makes our clan look bad, and it makes our server look bad. So let's try to avoid that.
Remember, always take demos of players when you suspect that they are hacking. If you do not, we cannot permanently ban them.
How To Catch A Hacker 101
What to Look For
This is the hard part. There are a good number of Counter-Strike hacks out there, and just as many players that are great at hiding the fact that they're cheating. You have to be diligent with your sound while spectating; remember some people have 7.1 surround sound, or 360 degree headphones and can hear quite clearly in any direction. Also, watch the radar. A good player will constantly check the radar and be able to make very accurate assumptions based on:
•Where a teammate died.
•What direction the teammate was heading.
•What direction the teammate was facing.
•Where the teammate was in regards to the locations of your other teammates.
•Spots where there are no teammates, leaving a gap for the enemy.
Another factor that may seem like someone is hacking, is if they are able to kill someone without even being able to see them. There can be a few reasons for this:
•Angles. A lot of the time you can spot (or be spotted) without being able to see the other person. Refer to this guide on angles to see what I mean.
•Spectating. Some players that die early in the round will observe the habits and skills of the opposing team. This will let them choose where to prefire next round, or have a good idea of where certain people are going/hiding.
•Anticipating common hiding/camping spots. You got prefired? You most likely are sitting behind a crate or door/wall that people sit behind on a regular basis, some players will just prefire in certain areas just in case, if it's a common spot.
•Shadows. Seriously people, make sure you have shadows turned on, and on high. Also be aware of where your shadow is at all times. Refer to this guide on shadows to see what I mean by your shadow will cast through things like doors.
•Your model clips through thin objects. So if you have your barrel poking through the middle of a door, you deserve the headshot that's coming your way.
•Your viewpoint is roughly in your upper chest. You do not see out the eyes of your player model, so if your head suddenly gets detached, remember that your point of view is lower than your head.
Also, if someone is spraying and keeps getting miraculous headshots, just watch the direction of the gun and see how the player controls the recoil. This is a tough one to spot but don't forget that you can somewhat control your spray. It honestly differs by gun type. I love the AK, but it takes some skill to handle. When a good players pulls headshots off with it or sprays and gets a headshot it's because they know how to handle it. Each gun is different. Here's the article on the AK-47, which shows recoil patterns.
Now the Problem. Good Hackers
There will always be people that hack, in any game, everyday. A lot will do everything in their power to make themselves seem legit. Even letting themselves get killed regularly just to keep the suspicions down, or toggling. Also, despite the info given above, it's hard to differentiate between a skilled player using the above tactics, or someone who is ghosting (a friend specing you and relaying everything to the player hunting you). Your best bet is to record a demo, and get the opinions of a few different people that deal with hackers on a regular basis. Remember, there as just as many skilled players as there are hackers out there, your decision in the matter can very often be a tough one.
Some Common Hacks
I haven't ever used hacks before, so some of these definitions may not be technically correct, but this is how they work to the best of my knowledge.
Aimbot
In CS:S, a player's model is composed of things called "hitboxes". These hitboxes allow differently placed shots to register depending on where the bullet struck. An aimbot is a program/script that causes a player to automatically target a specific hitbox (usually head, although I've seen an aimbot that allows you to target the chest hitbox). So essentially, every shot they fire will hit that specific hit box when the player aims "near" the hitbox. So say that the hacker has aimbot targeting the head hitbox. When the hacker aims around the player's head (his shoulders/chest, and the air around his head) it will register as a headshot. Look for a shaking screen, jumping crosshair, or crooked/upside-down screen while spectating them. Some poor quality aimbots may cause those effects. Be advised that some players have a high sensitivity and therefore and jerk their crosshair extremely fast, so it may just be a good flick that lined up the shot. Aimbots are not to be confused with a toggle aimbot, explained next.
Toggle (also known as an aimkey)
This is where a player may play without an aimbot and simply hit a key to activate it when they get in a sticky situation. This is obviously harder to catch, since the player may be playing normally and then pull off an amazing headshot. A lot of spectating is needed to try to identify this. When they release the key, the aimbot is no longer activated.
Wallhack
Allows players to see through walls, props, etc. Most use a wireframe setup that shows the models through things. Others used colored models. You can detect these by seeing the player lining up shots/headshots before they can see the player and also when they prefire (shoot before seeing the player). But as I warned before, if the player can hear you coming, he might try to judge when you are going to come around a corner and therefore he prefires on you. This is very hard to catch with experienced hackers.
Spinbot
One of the most blatant hacking subtypes. This causes a player to spin rapidly in circles and instantly one-shot headshot any player around. More explanation should not be needed.
Speedhack
Causes a player to move around the map faster than other players. Quite obvious. Can be turned on and off at will. If they are on your team, it's obvious if they do it as soon as they spawn. If they are on the opposite team, gauge how long it takes a player to get from spawn to a certain point. If the player can get their significantly faster they may have speedhacked. Spectating is the best option since bunnyhoppers also move quite fast.
No Recoil
This allows players to shoot a gun and not have the effect of recoil change their aim. Look for extremely close shot grouping and an ability to turn in a circle and hit multiple targets on the same height level in the head. No Recoil can easily be spotted, most of the time it will cause shaking under spectator view when shooting. Other cases the crosshair just won't move at all and that is easy to notice also. It's easiest on guns like the AK, which have huge recoil (see the AK-guide I linked earlier).
Radar Hack
Radar hacks allow players to see the locations of players on the map by showing the icons of all players on both teams on their radar. These are hard to catch. If they repeatedly go running around the map and killing all of the opposing team's players with a set pattern, they may be radar hacking. Again, it's very hard to catch since the player may just be walking around randomly. This takes a lot of spectating to identify.
AutoShoot (Also known as a "Trigger")
Puts aiming and firing on auto-pilot. As you move around, the hacking protocol will fire at players automatically, without you pulling the trigger. Can be hard to notice, unless when it fires it is set up to just get headshots.
NoSmoke/NoFlash
This is surprisingly common actually. They allow the user to be impervious to the effects of smoke and flash grenades, giving them a tactical advantage. It can be hard to spot without a lot of spectating. If they rush and throw a flash and keep running into it while pulling off good shots, it's possible they have an antiflash. If they shoot players through smoke and headshot them with ease (multiple times), they may have an antismoke hack.
MultiHack
This is the general term given to when a player is using multiple types of hacks at once or has a script that allows them to use multiple hacks. This is a prime example.
My hope is that this guide will give our newer admins some insight on how to identify different hackers and keep everyone on their toes looking for hackers and recording demos. If you do not know how, please look below.
________________________________________
From Master's Ban Request Template Thread with some alterations/updates by me.
How to get proof?
First the demo!
To get a demo you must first have you console enable.
To do so you want to go to options>keyboard>advanced.
There a box should open. With it open check the enable console.
Now when console is enabled open it up. Default key is (~).
1. With console open type in "record filename" . Whatever you type in filename is the name the demo will save to your hard drive as.
2. Watch the player and make sure to type in "status".
3. When you think you have gotten enough proof then type "stop".
The demo has been made!
Where is the demo located?
Normally the demo is located in your cstrike folder.
Location = C:\Program Files\Steam\steamapps\<Your Steam Name\counter-strike source\cstrike
In this folder you will have you demo, which will be name as of what you called it.
Then you will need to upload it to another site (www.zhost.tk or www.mediafire.com) and include the link to download it in your post or upload it through the Manage Attachment Button on the forums.
How To Get The Hackers Steam ID
You can do so by typing status in console.
How to take a Screen Shot:
Way 1:
1. Get all the information you want to be taken on the screen. Console screenshots can help in some situations, especially to give their STEAM ID, and name.
2. On your keyboard press your screenshot key, F5 for default.
3. Then go to C:\Program Files\Steam\steamapps\<youraccountname>\counter-strike source\cstrike\screenshots
4. You can either upload these to another site (www.zhost.tk, photobucket, etc.) and give the IMG code, or upload it through the Manage Attachment Button on the forums.
Way 2:
1. Get all the information you want to be taken on the screen.
2. On your keyboard press the "Prt Scr/Sys Rq button.
3. Open up paint and right click and press paste, or Ctrl + V.
4. Save the image where you can find it.
5. You can either upload these to another site (www.zhost.tk, photobucket, etc.) and give the IMG code, or upload it through the Manage Attachment Button on the forums.
original post is from http://hellsgamers.com/threads/58163-Ho ... h-a-Hacker
if you find this interesting click on the link and see the guides that are are mentioned, its a good read!
This won't be short...but I've been disturbed by how many of our admins have been banning suspected "hackers" when it is painfully obvious to seasoned players that they are not hacking. I don't claim to be wonderful at CS:S, and I haven't played competitively since CAL fell apart, but I know the ropes fairly well. Hopefully this will help you make the correct call on whether someone is hacking or not.
If you have any doubts, try calling in an experienced player or admin before banning the person you think hacks. When you ban someone wrongly, it makes you look bad, it makes our clan look bad, and it makes our server look bad. So let's try to avoid that.
Remember, always take demos of players when you suspect that they are hacking. If you do not, we cannot permanently ban them.
How To Catch A Hacker 101
What to Look For
This is the hard part. There are a good number of Counter-Strike hacks out there, and just as many players that are great at hiding the fact that they're cheating. You have to be diligent with your sound while spectating; remember some people have 7.1 surround sound, or 360 degree headphones and can hear quite clearly in any direction. Also, watch the radar. A good player will constantly check the radar and be able to make very accurate assumptions based on:
•Where a teammate died.
•What direction the teammate was heading.
•What direction the teammate was facing.
•Where the teammate was in regards to the locations of your other teammates.
•Spots where there are no teammates, leaving a gap for the enemy.
Another factor that may seem like someone is hacking, is if they are able to kill someone without even being able to see them. There can be a few reasons for this:
•Angles. A lot of the time you can spot (or be spotted) without being able to see the other person. Refer to this guide on angles to see what I mean.
•Spectating. Some players that die early in the round will observe the habits and skills of the opposing team. This will let them choose where to prefire next round, or have a good idea of where certain people are going/hiding.
•Anticipating common hiding/camping spots. You got prefired? You most likely are sitting behind a crate or door/wall that people sit behind on a regular basis, some players will just prefire in certain areas just in case, if it's a common spot.
•Shadows. Seriously people, make sure you have shadows turned on, and on high. Also be aware of where your shadow is at all times. Refer to this guide on shadows to see what I mean by your shadow will cast through things like doors.
•Your model clips through thin objects. So if you have your barrel poking through the middle of a door, you deserve the headshot that's coming your way.
•Your viewpoint is roughly in your upper chest. You do not see out the eyes of your player model, so if your head suddenly gets detached, remember that your point of view is lower than your head.
Also, if someone is spraying and keeps getting miraculous headshots, just watch the direction of the gun and see how the player controls the recoil. This is a tough one to spot but don't forget that you can somewhat control your spray. It honestly differs by gun type. I love the AK, but it takes some skill to handle. When a good players pulls headshots off with it or sprays and gets a headshot it's because they know how to handle it. Each gun is different. Here's the article on the AK-47, which shows recoil patterns.
Now the Problem. Good Hackers
There will always be people that hack, in any game, everyday. A lot will do everything in their power to make themselves seem legit. Even letting themselves get killed regularly just to keep the suspicions down, or toggling. Also, despite the info given above, it's hard to differentiate between a skilled player using the above tactics, or someone who is ghosting (a friend specing you and relaying everything to the player hunting you). Your best bet is to record a demo, and get the opinions of a few different people that deal with hackers on a regular basis. Remember, there as just as many skilled players as there are hackers out there, your decision in the matter can very often be a tough one.
Some Common Hacks
I haven't ever used hacks before, so some of these definitions may not be technically correct, but this is how they work to the best of my knowledge.
Aimbot
In CS:S, a player's model is composed of things called "hitboxes". These hitboxes allow differently placed shots to register depending on where the bullet struck. An aimbot is a program/script that causes a player to automatically target a specific hitbox (usually head, although I've seen an aimbot that allows you to target the chest hitbox). So essentially, every shot they fire will hit that specific hit box when the player aims "near" the hitbox. So say that the hacker has aimbot targeting the head hitbox. When the hacker aims around the player's head (his shoulders/chest, and the air around his head) it will register as a headshot. Look for a shaking screen, jumping crosshair, or crooked/upside-down screen while spectating them. Some poor quality aimbots may cause those effects. Be advised that some players have a high sensitivity and therefore and jerk their crosshair extremely fast, so it may just be a good flick that lined up the shot. Aimbots are not to be confused with a toggle aimbot, explained next.
Toggle (also known as an aimkey)
This is where a player may play without an aimbot and simply hit a key to activate it when they get in a sticky situation. This is obviously harder to catch, since the player may be playing normally and then pull off an amazing headshot. A lot of spectating is needed to try to identify this. When they release the key, the aimbot is no longer activated.
Wallhack
Allows players to see through walls, props, etc. Most use a wireframe setup that shows the models through things. Others used colored models. You can detect these by seeing the player lining up shots/headshots before they can see the player and also when they prefire (shoot before seeing the player). But as I warned before, if the player can hear you coming, he might try to judge when you are going to come around a corner and therefore he prefires on you. This is very hard to catch with experienced hackers.
Spinbot
One of the most blatant hacking subtypes. This causes a player to spin rapidly in circles and instantly one-shot headshot any player around. More explanation should not be needed.
Speedhack
Causes a player to move around the map faster than other players. Quite obvious. Can be turned on and off at will. If they are on your team, it's obvious if they do it as soon as they spawn. If they are on the opposite team, gauge how long it takes a player to get from spawn to a certain point. If the player can get their significantly faster they may have speedhacked. Spectating is the best option since bunnyhoppers also move quite fast.
No Recoil
This allows players to shoot a gun and not have the effect of recoil change their aim. Look for extremely close shot grouping and an ability to turn in a circle and hit multiple targets on the same height level in the head. No Recoil can easily be spotted, most of the time it will cause shaking under spectator view when shooting. Other cases the crosshair just won't move at all and that is easy to notice also. It's easiest on guns like the AK, which have huge recoil (see the AK-guide I linked earlier).
Radar Hack
Radar hacks allow players to see the locations of players on the map by showing the icons of all players on both teams on their radar. These are hard to catch. If they repeatedly go running around the map and killing all of the opposing team's players with a set pattern, they may be radar hacking. Again, it's very hard to catch since the player may just be walking around randomly. This takes a lot of spectating to identify.
AutoShoot (Also known as a "Trigger")
Puts aiming and firing on auto-pilot. As you move around, the hacking protocol will fire at players automatically, without you pulling the trigger. Can be hard to notice, unless when it fires it is set up to just get headshots.
NoSmoke/NoFlash
This is surprisingly common actually. They allow the user to be impervious to the effects of smoke and flash grenades, giving them a tactical advantage. It can be hard to spot without a lot of spectating. If they rush and throw a flash and keep running into it while pulling off good shots, it's possible they have an antiflash. If they shoot players through smoke and headshot them with ease (multiple times), they may have an antismoke hack.
MultiHack
This is the general term given to when a player is using multiple types of hacks at once or has a script that allows them to use multiple hacks. This is a prime example.
My hope is that this guide will give our newer admins some insight on how to identify different hackers and keep everyone on their toes looking for hackers and recording demos. If you do not know how, please look below.
________________________________________
From Master's Ban Request Template Thread with some alterations/updates by me.
How to get proof?
First the demo!
To get a demo you must first have you console enable.
To do so you want to go to options>keyboard>advanced.
There a box should open. With it open check the enable console.
Now when console is enabled open it up. Default key is (~).
1. With console open type in "record filename" . Whatever you type in filename is the name the demo will save to your hard drive as.
2. Watch the player and make sure to type in "status".
3. When you think you have gotten enough proof then type "stop".
The demo has been made!
Where is the demo located?
Normally the demo is located in your cstrike folder.
Location = C:\Program Files\Steam\steamapps\<Your Steam Name\counter-strike source\cstrike
In this folder you will have you demo, which will be name as of what you called it.
Then you will need to upload it to another site (www.zhost.tk or www.mediafire.com) and include the link to download it in your post or upload it through the Manage Attachment Button on the forums.
How To Get The Hackers Steam ID
You can do so by typing status in console.
How to take a Screen Shot:
Way 1:
1. Get all the information you want to be taken on the screen. Console screenshots can help in some situations, especially to give their STEAM ID, and name.
2. On your keyboard press your screenshot key, F5 for default.
3. Then go to C:\Program Files\Steam\steamapps\<youraccountname>\counter-strike source\cstrike\screenshots
4. You can either upload these to another site (www.zhost.tk, photobucket, etc.) and give the IMG code, or upload it through the Manage Attachment Button on the forums.
Way 2:
1. Get all the information you want to be taken on the screen.
2. On your keyboard press the "Prt Scr/Sys Rq button.
3. Open up paint and right click and press paste, or Ctrl + V.
4. Save the image where you can find it.
5. You can either upload these to another site (www.zhost.tk, photobucket, etc.) and give the IMG code, or upload it through the Manage Attachment Button on the forums.
original post is from http://hellsgamers.com/threads/58163-Ho ... h-a-Hacker
if you find this interesting click on the link and see the guides that are are mentioned, its a good read!