How do you find bugs / exploits on Minecraft servers?

How does it work?

I see again and again that someone finds a bug that you would never find in the normal way (i.e. If you play normally or search for bugs without tools).

There were e.g. Sometimes a hack with which you had infinite range and could mine blocks very far away.

Or if you place an enchanted cobblestone in the flowing lava of a cobble generator in Hypixel Skyblock, obsidian is created there.

How do you find such bugs? Especially if you don't know what the server is running on, or if they are server-specific plugins?

Try it out, or if you know the plugins, check the code that runs on for exploitable errors.

You just try it out.

Many bugs can also be found by chance.

"Infinite" range sounds more like a hack. It's probably something else again.

If someone finds an exploit, they mostly "examined" the plugin.

In addition, some plugins have special features with which you can identify them if they have not programmed themselves. (A stupid example would be the permission system:

/ manuadd = GroupManager

/ pex = PermissionsEx

/ lp = LuckPerms

Additionally:

If you are familiar with coding you can use the code of e.g. Pick up a plugin and check it gradually for weak points

I'm good at coding. I could do that. Problem is: How do I know the name of the plugin? "/?" is blocked on almost all servers.

Tried / searched bugs for 30 hours but haven't found anything game-breaking yet. So it's less like mans.

Besides, is there a special strategy?

And how do I find the plugin names?

The best thing to do is look for the feature set of the most popular plugins, and compare it with what the server can do. Optionally, you can also tap code that tells you this. I'm not sure how safe Minecraft servers are running these days. Otherwise you can simply write a program that gives you the option of a /? To simulate.

Already managed to get certain error messages issued by the plugin with the help of hacked clients. For example, "Disallowed Characters in the Chat" when I write characters on a sign that you normally can't write on.

Only if I enter this into Google (in goosefoot, of course), I will not find anything that points to any plugin.

Except when someone accidentally posted the code of the plugin on PasteBin. But that's rare.

Do you have an idea how / where you can find the associated plugin with the help of a specific error message? Or is Google my only hope?

I honestly don't know, sry.

What is not blocked on some servers:

/ about + [TAB]

Or

/ + [TAB]

This means that you can also see the plugins on some servers.

Otherwise you just have to try it out.

For example:

If / Essentials: tpa gives feedback, Essentials is installed

You could also try the following commands:

/ help

/ Bukkkit: help

/ Bukkit:?

/ Pl

/ Bukkit: Pl

(Ideally with variations of the capitalization or write an argument after it. Badly made plugins are then "overwhelmed" and let the command execute)

To find out the server version (for version-related exploits, glitches etc.) you can try these commands:

/ United

/ Bukkit: Ver

/ icanhasbukkit