From Cheating to Hacking, This Discord Activity is Broken…

From the screen to the ring, to the pen, to the king. Where's my crown? That's my bling. Always drama when I ring. Ladies and gentlemen, I've got a treat for you today. I'm going to reveal how someone cheated in Discord's Death by AI activity and how that led to them hacking into the company behind it, granting access to a treasure trove of dangerous opportunities. But starting at the beginning though, this whole operation was done by someone named Bob De Haacker. So for Bob De Haacker, it was just like any other day. They were bored and poking and prodding around in Discord's activities when they decided that maybe they should take a look at Death by AI. Now, if you never played Death by AI before, the way that it works is pretty simple. Basically, an AI will give you a prompt saying your grandma ran away with a knife and she's going to kill you, and what you have to do is you have to enter in a response on what you would do in that situation to survive. And once you put in your strategy, your tactic, AI will judge your response and it will read aloud a story on what happens to you with your response and whether or not you live or die. Now, I'm enacting the situation, but while Bob the Hacker was playing the game and doing stuff, they decided to open up their Chrome console to just see what was going on between the game and Bob the Hacker's computer. And you'll notice in these network requests, okay, there's just like five gazillion of them, but if we look in our network requests, there are two requests. There's a reveal request, and there's in fact two of them. Now, if we click on the first reveal request, move that open, you'll notice in this request username Schmoney Man Steve, and you can see in the game the strategy is "I warm up and not die," and the game says "I warm up and not die." Now, I forgot to point out, but for you to see these specific requests, you need to be the host of the Death by AI game, and that also means that if you want to cheat in Death by AI, you need to be the host of the game. So just keep that in mind. But if we go to the response of the request, we can see that we have three different options. We have story, which says, "As the biting winds howled around him, Schmoney Man Steve huddled beneath a hastily constructed snow shelter." So it's the story, and it also tells me that isSurvived equals false, which sounds like Schmoney Man Steve dies. Now, if we go over to my game and we click on continue, you will notice that the AI is going to say exactly what I said. Now, the quality is going to be horrendous because there's 500 things going on on my screen. It feels like I'm at a casino, but it's the same story. And if I continue, I should die and lose this round, and that is the case. But the thing that Bob the Hacker was thinking is that what if there was a way to modify this response? If we could modify this response, we could make the bot say any sort of story, but we can also make it where isSurvived is always true, so I always win, or isSurvived is always false, which isn't really helpful. You wouldn't want to lose. But remember, we're looking at Schmoney Man Steve. This isn't my account; this is my friend playing. What if there was a way where we could always make our friends lose? And ladies and gentlemen, welcome to how to cheat in Death by AI. But the easiest way that we're going to do this is we're going to get a Chrome extension called Requestly. Now, this will be linked in the description, and what this allows us to do is intercept and modify and mock HTTP requests. This allows us to modify those requests and change how the game plays if we code things properly. Don't worry, you don't have to code on this; it's very simple. But when you open up this Chrome extension, it's going to take you to Requestly, and it's going to ask you to make an account. Now, you do have to make an account to use this thing, but what's even worse is that the only way that we can do this thing properly is if we use the professional 7-day free trial. So when you use this, you will only have 7 days to cheat in the game. However, if you're brave enough to go on GitHub and compile the browser extension yourself, I have this linked in the description, but if you're brave enough, you can compile the browser extension yourself and use this for free indefinitely and not have to worry about this 7-day free trial. In the description, I'm going to have this link, which is basically a link to the template that I made, and when you throw this bad boy into your browser and you open it up, you should be able to click on the button "Import to my rules," which will successfully import your rule, my rule. It'll import the code thing so that you can use it without having to copy and paste a whole bunch of code. Okay, but when you click on this rule, you should see that there's a whole bunch of crap. Now, you can get nerdy and try to understand what I did, or you can just scroll down to the script that I made and just read the comments. The main thing that you want to look at are these three things: player name, among usy, 'cause I don't know why I left that in there, and isSurvived true or false. These are the three parameters that you are going to change to change the outcome of the game. So to keep things simple, I want to make it where I always win, and whenever the bot reads out a response, I want it to just say "among usy." So what I'm going to do is I'm going to replace player name with the name of my player in the game. Now, you should be able to see everyone's player name in the lobby when they all join, so just, I don't know, take a screenshot or note those down before you start getting up to your devious little plans. And that is going to modify every single result of the person who has the username Most Annoying User, which is me. Now, moving down in terms of the story, you could replace this with a long-winded story about how you are the absolute best, you have a massive wiener, or you can just put in complete brain rot. We got the bot to sing the KSI song. I think that's plenty enough. But what you could also do is you can completely remove this story equals ausy. Make sure to include the comma after, and when you remove this, all it will do is just make sure that you win every single time, which there are cases when you play the game the bot will say like "Amia met their end as the building crumbled. In the end, Amia survived." I think that's probably the best thing to do in my opinion. But regardless, just to show you how this thing works, I'm going to leave it as ausy, and I'm always going to win. Make sure to save the rule, go into your Discord, click on the extension, and you should see HTTP rules. Just go to recently used and pin this bad boy so it'll show up in the pinned rules, and make sure it is enabled or else nothing is going to happen. Now, you'll notice that when you enable it, the cheats don't work on the current round. You need to set it up before everyone submits all their answers. So anyways, once you enable the cheat and you enter in your completely 100% real answer, the cheat should take effect. Most Annoying User tries to, and what does the AI bot say? Among usy, and I survived. But kaboom! Ladies and gentlemen, we now know how to cheat in a Discord activity, which is only as valuable as your creativity with it in terms of trolling your friends. But Bob De Haacker was not satisfied about this. They wanted to learn more. If this Death by AI game is broken in this way, how broken is the rest of Death by AI? What potential disruption could happen if someone hacked into Death by AI? And spoiler alert, there's actually a lot. Now, if you don't know, Death by AI is made by Playroom. It shows at the start screen. But the thing with Playroom is that they're actually a service that allows you to build multiplayer games, and if you look at their features, they specifically focus on Discord, specifically Discord activities. So we can assume that Death by AI is run on this Playroom kit website, and Bob the Hacker decided, you know what? I think it's time for me to become a developer and get started for free.

activity and how that led to them hacking into the company behind it granting access to a treasure Trove of dangerous opportunities but starting at the beginning though this whole operation was done by someone named Bob De haacker so for Bob De haacker it was

just like any other day they were bored and their poking and prodding around in discord's activities when they decided that maybe they should take a look at death by AI now if you never played death by AI before the way that it works

is pretty simple basically an AI will give you a prompt saying your grandma ran away with a knife and she's going to kill you and what you have to do is you have to enter in a response on what you

would do in that situation to survive and once you put in your strategy your tactic AI will judge your response and it will read aloud a story on what happens to you with your response and whether or not you live or die now I'm

en acting the situation but while Bob the hacker was playing the game and doing stuff they decided to open up their Chrome console to just see what was going on between the game and Bob the Hacker's computer and you'll notice

in these Network requests okay there's just like five gazillion of them but if we look in our Network requests there are two requests there's a reveal request and there's in fact two of them now if we click on the first reveal

request moved that open you'll notice in this request username schmoney Man Steve and you can see in the game the strategy is I warm up and not die and the game says I warm up and not die now I forgot

to point point0 but for you to see these specific requests you need to be the host of the death by AI game and that also means that if you want to cheat in death by AI you need to be the host of

the game so just keep that in mind but if we go to the response of the request we can see that we have three different options we have story which says as the biting winds howled around him schmoney

Man Steve huddled beneath a hastily constructed snow shelter so it's the story and it also tells me that is survived equals false which sounds like schoney man Steve dies now if if we go over to my game and we click on continue

you will notice that the AI is going to say exactly what I said now the quality is going to be horrendous because there's 500 things going on on my screen it feels like I'm at a casino but it's

the same story and if I continue I should die and lose this round and that is the case but the thing that Bob the hacker was thinking is that what if there was a way to modify this response

if we could modify this response we could make the bot say any sort of story but we can also make it where is survived is always true so I always win or is survived is always false which isn't really helpful you wouldn't want

to lose but remember we're looking at schmoney man steeve this isn't my account this is my friend playing what if there was a way where we could always make our friends lose and ladies and gentlemen welcome to how to cheat in

death by AI but the easiest way that we're going to do this is we're going to get a Chrome extension called requestly now this will be linked in the description and what this allows us to do is intercept and modify and mock HTTP

request this allows us to modify those requests and change how the game plays if we code things properly don't worry you don't have to code on this it's very simple but when you open up this Chrome extension it's going to take you to

requestly and it's going to ask you to make an account now you do have to make an account to use this thing but what's even worse is that the only way that we can do this thing properly is if we use

the professional 7-Day free trial so when you use this you will only have 7 days to cheat in the game however if you're brave enough to go on GitHub and compile the browser extension yourself I have this Linked In the description but

if you're brave enough you can compile the browser extension yourself and use this for free indefinitely and not have to worry about this 7-Day free trial in the description I'm going to have this link which is basically a link to the

template that I made and when you throw this bad boy into your browser and you open it up you should be able to click on the button import to my rules which will successfully import your rule my rule it'll import the code thing so that

you can use it without having to copy and paste a whole bunch of code okay but when you click on this rule you should see that there's a whole bunch of crap now you can get nerdy and try to

understand what I did or you can just scroll down to the script that I made and just read the comments the main thing that you want to look at are these three things player name among gusy cuz I don't know why I left that in there

and is survived true or false these are the three parameters that you are going to change to change the outcome of the game so to keep things simple I want to make it where I always win and whenever

the bot reads out a response I want it to just say among usy so what I'm going to do is I'm going to replace player name with the name of my player in the game now you should be able to see

everyone's player name in the lobby when they all join so just uh I don't know take a screenshot or note those down before you start getting up to your devious little plans and that is going to modify every single result of the

person who has the username most annoying user which is me now moving down in terms of the story you could replace this with a long- winded story about how you are the absolute best you have a massive wiener or you can just

put in complete brain rot we we got the bot to sing the KSI song I think that's plenty enough but what you could also do is you can completely remove this story equals aosi make sure to include the

comma after and when you remove this all it will do is just make sure that you win every single time which there are cases when you play the game the bot will say like Amia met their end as the

building crumbled in the end Amia survived I think that's probably the best thing to do in my opinion but regardless just to show you how this thing works I'm going to leave it as ausy and I'm always going to win make

sure to save the rule go into your Discord click on the extension and you should see HTTP rules just go to recently used and pin this bad boy so it'll show up in the pinned rules and make sure it is enabled or else nothing

is going to happen now you'll notice that when you enable it the cheats don't work on the current round you need to set it up before everyone submits all their answers so anyways once you enable the cheat and you enter in your

completely 100% real answer the cheat should take effect most annoying user tries to and what does the AI bot say among usy and I survived but Kaboom ladies and gentlemen we now know how to cheat in a Discord activity which is only as

valuable as your creativity with it in terms of trolling your friends but Bob De hacker was not satisfied about this they wanted to learn more if this death by AI game is broken in this way how broken is the rest of death by AI what

potential disruption could happen if someone hacked into death by Ai and spoiler alert there's actually a lot now if you don't know death by AI is made by playroom it shows at the start screen but the thing with playroom is that

they're actually a service that allows you to build multiplayer games and if you look at their features they specifically focus on Discord specifically Discord activities so we can assume that death by AI is run on this playroom kit website and Bob the

hacker decided you know what I think it's time for me to become a developer and get started for free so Bob thehacker made an account and to sign in you need to provide your email and it'll send you an email giving you this big

long link to sign in and a little hint that you'll need but this big long massive link has Firebase in it now I had no idea but if you don't know what Firebase is it's technically considered as a backend as a service what does that

mean to normal people it just does a lot of website stuff but Firebase has something called fir store which is an online database using fir store fire base datab base it's an online database which will be important for later but

when you create a developer account on playroom everything's pretty simple you can create your own game you can make it a Discord activity do hosting there's nothing out of the ordinary here but then Bob De haacker did the most

Unthinkable thing on the planet they opened up their Chrome console the network Tab and they refreshed the page and while they were poking and prodding around they found this account request which sends a request to Identity toolkit. gooogle apis again Firebase

accounts look up and then it gives you a key let's EXP okay let's let's shrink it there we go the key equals this big number here now I'm going to be honest with you guys I could pretend I know

what happens next and explain it as if this is common sense to everyone I have noing idea what Bob De haacker did they pulled this magic link that they sent to me that I still don't understand but it's to Google API identity toolkit

relying party get project config and they attach this key at the end now at this point I'm borderline confused but we now know that the Firebase project name is called playroom D production I hate to be a little bit more a nerd than

Bob De haacker but you could actually see what the name was if you just looked at that login link but with this Firebase name Bob De haacker thought what if there was a way that I could access playrooms database what you can

do is you can make API calls to fir store which allows you to access and get data from a database but also write information to a database but what they did is they copied this and then they attached it to the end of this which is

just kind of like firebases default structure in terms of a database so you have your projects you have the name of your project which we learned is playroom dasr then there's databases defaults documents and then in this case

it has cities and La however it would probably make sense if they followed a very simple structure that most Firebase projects use where in their documents they have a users folder and it's filled with a whole bunch of users and using

that plus coding knowledge which I don't have they stumbled across and put together this big link here where they're basically contacting Google's fir store specifically the playroom production project and they're looking in their databases for users but instead

of trying to like find out everyone else's information cuz who cares Bob De haacker thought what if I could make my account become admin I would have thought the exact same thing to be honest but what Bob Decker did is they

went back to the same request that we looked at to get this Firebase key and they just went to the response and they looked under users and there's something called the local ID which is kind of like your username and all they did is

they just copied this big chunk of text and they pasted that big number at the end and they clicked on send now you'll notice uh no text to speech this thing ain't working and that's because it got patched but don't worry that's what

screenshots are for baby you can see from the screenshot that Bob thehacker sent a get request to Google's API for fir store playroom production and they had their user at the end and it returned a whole bunch of information

specifically the fact that their role was a developer now Bob Decker thunk what if I just select this and I change it to admin and that is exactly what they did they basically just made a patch request they copied all this

information changed the role to be admin and they clicked on the big send button Bob De haacker now has the role of admin we have two things to look forward to the first thing is that this is where

everything went downhill for death by Ai and playroom and the second thing to look forward to is that the rest of this video isn't going to be as confusing as it just was but this is how the playroom

developer portal looks like normally on a normal user account you can only see your games it says developer and you can modify your game and stuff but Bob De haacker had something a little bit stranger they actually had the ad it

doesn't say developer it says admin on the top left and when you're just on a normal user account the only games that you can see are the games that you make using playroom but Bob De haacker when they went to see their games um they

couldn't just see their own games they could also see every other person's game like CSS in the dark red brick test game and even the hit game among us to Bob De haacker could access it all but this

also included the game death by Ai and what Bob De haacker could do is access a whole bunch of things EGS and what type of Havoc can you cause well we're going to start with the very simple stuff and

then move up to completely blowing up the whole platform it feels like but what Bob the hacker could do is they could change a whole bunch of the Discord bot credentials so they could just completely reset the bot token and

death by AI would just not work there's also some triggers which we'll get to later but not only could they disable death by Ai and just change all this stuff to break it uh but they could also go to the game's hosting and they could

upload their own game they could change death by AI to be whatever game they decide to program and put on there you can make it link you to a YouTube video maybe a really bad video on a different

website however there's a lot more of a pressing issue that any like myself could abuse to do a lot of damage because remember looking back at this dashboard what are these triggers talking about well these are basically things that you can enable that will

send messages to people when they first play Death by Ai and you can see that I could edit these messages and I can also turn it on and off so I could enable this trigger and I could edit the

message message where death by AI the bot itself will send a DM to people when you first play the game and it'll say hey thank you for playing death by AI you can get free death by AI premium in

five gazillion dollars by visiting this obviously not a scam website using this you could send people a big scam and it would be sent by the real death by AI bot and just in case you weren't aware death by AI can send you a direct

message because when you authorize the bot when you first play this game it'll show up in that little authorized ation pop up that the bot can send a DM to you but Gamers I kind of saved the best for

last because here's the thing with these triggers right now for any bad thing to happen people need to actually play the game again what if there was a way I could send a message to every single person that has ever played death by AI

man that would suck and it turns out in the screenshot a little bit of a clue is uh sticking out at us spinning our face the whole time it's the fact that the Chrome Network tab is open and if you

look in the network tab there's a request that you can open up where tells you the description of the bot it tells you what the bot's ID is but you can see in the Discord fields we can see the

Discord client ID you can see the client secret in the screenshot all the stuff was just completely blank but if you look at the network tab this was the whole entire client Secret in fact there's also the Discord bot token the

whole thing in plain text and using this Discord bot token I can fully control the Discord bot the death by AI bot if someone was Super Evil they could use this bot token to make the Discord bot DM every single person that has played

death by AI that still has it authorized and to make things even worse by the way remember all these games that Bob De haacker had access to considering that they could see the client ID secret and Bot token of every single one of those

games if they had a Discord bot related to it this could have been a pretty nasty disaster if Bob Decker was trying to do something evil but when it comes to finding bugs like this instead of causing a big Havoc Bob thehacker

decided to do the good thing and they contacted the developers of playroom about this issue so they at least had a chance to fix it and ladies and gentlemen the playroom developers the people behind death by AI did a damn

good job let me tell you in less than 20 minutes this whole admin exploit was fixed uh I'm not finished Bob De haacker did a little bit of a Discord Avengers team up with good old XYZ Eva which if

you watched a lot of my videos you know XYZ Eva is the person that hacked into a whole bunch of Discord box to find vulnerabilities and I've covered it in a couple of videos they found another vulnerability in a whopping 2 minutes

when you go to playroom and you refresh the page there's a request that gets made to dev. jooin playroom.rug message game's not found so they did fix this but considering that they had this simple of a vulnerability it makes me ask the question I wonder

what other Discord activities have gaping security holes like death by Ai and specifically the back end that they Ed playroom I just want to say a big thanks to Bob De haacker though for finding this and being patient enough to

explain it to a Like Me by some Modern Day miracle I might have explained it in a way that is not confusing I hope anyways bye-bye I love you mAh