The Story of Minecraft's Most DANGEROUS Exploits

The Story of Minecraft's Most DANGEROUS Exploits - ForceOP's

Рет қаралды 173,132

Күн бұрын

One of the most powerful types of minecraft exploits, also happens to be its rarest. Today we'll talk about some of the very few minecraft forceOP exploits that have actually existed.
My Patreon (exclusive censored content, worlds and plugins) - / themisterepic
--------------------------------------------------------------------
Want to run your own minecraft server with friends or a community?
Get a 25% discount on hosting with code "Epic"!
shockbyte.com/partner/themist...
--------------------------------------------------------------------
Huge thanks to Gildfesh for helping me out with some of the obscure exploits I mentioned in this video!
iCanHasGrief - • HOW TO become Admin on...
Nodus Session Stealer - • Nodus: Session Stealer...
• Nodus - SessionStealer...
Team Avolition Authentication Exploit - gist.github.com/ajvpot/3115176
Other Minecraft Authentication Exploit - github.com/nerdsinspace/leaky...
Thanks for watching! Subscribe and Join My Discord!
Discord - / discord
Twitter - / themisterepicyt
Twitch - / themisterepicyt
Join my OG Minecraft Server, The OG Network! (1.8-1.20): og-network.net
- Website: og-network.net
- Discord: / discord
0:00 - Intro
0:54 - The First Minecraft ForceOP Exploit
3:04 - The Nodus Session Stealer
5:49 - Ajvpot Account Authentication Exploits
8:17 - Bungee Spoofing
11:15 - The Handshake Exploit
12:55 - Sign, Command Block and Book ForceOPs
15:12 - Vulcan ForceOP
17:04 - Log4j
Music Used:
1. First Blood - The Dota 2 Official Soundtrack
2. C418 - Strad
3. nyoko - Flowing Into The Darkness
4. Scott Buckley - Inbound
5. DBadge - Drop ( • Beats You Can Only Lis... )
6. Scott Buckley - Decoherence
7. Lena Raine - Rubedo
If there is any content in this video which you own and would like removed, than please contact me and I will be happy to oblige.
#minecraft #minecraftexploit #minecraftserver

Пікірлер: 515

@TheMisterEpic 25 күн бұрын

Make sure to subscribe, and check out my patreon for exclusive content! www.patreon.com/TheMisterEpic

@mineabdo2515 25 күн бұрын

Can you talk about pojav lancher in mobile 📱 and its java edition and if you buyed the game you can play in hypixel and for mods you need to put them in tge mods folder and you can download directly forge or fabric in any version

@DRPURGE-nh1oh 25 күн бұрын

Amazing video man ❤ thank you for taking the time outa your day to make this for us you don't get enough credit

@DRPURGE-nh1oh 25 күн бұрын

Also take a break you need it dude

@ultraalex20 25 күн бұрын

@TheMisterEpic

@Ofuka880 24 күн бұрын

do you know authmebridge exploit?

@raihanvarghese8553 25 күн бұрын

Minecraft has more vulnerabilities than I have chromosomes

@LandrewLeng 25 күн бұрын

bro 💀

@TheMisterEpic 25 күн бұрын

Lol

@erubus5231 25 күн бұрын

more than one?

@Nightcaat 25 күн бұрын

@duckny8316 25 күн бұрын

Lol@@TheMisterEpic

@doufmech4323 25 күн бұрын

This is not just Minecraft's most powerful vulnerabilities, it is one of THE worlds most powerful vulnerability (CVSS of 9.8). A remote attacker can execute arbitrary code via the log4j component, and since it is an exploit in the logger, no one would be able to see if an atracker had gained entry.

@maritoguionyo 24 күн бұрын

not a direct Minecraft exploit

@blikthepro972 24 күн бұрын

i love how the reddit post asking about the handshake exploit has a troll comment and a reply getting mad at them

@infered5365 25 күн бұрын

The Log4j exploit (called Log4shell) was given a 10.0 severity rating on the CVE scale. The Log4J exploit ranked among the most severe vulnerabilities in software in the history of software. It sits on the throne alongside EternalBlue (which spawned Ransomware as we know it), Remote Code Execution in email servers for governments, and why the protocol FTP isn't even used anymore. It spawned a furious hellfire of system administrators patching their environments at a speed and urgency not even paced by Y2K.

@CZghost 24 күн бұрын

Yeah, it was pretty much the most severe vulnerability, and that was given the sheer scale of the library. Scale of the library isn't defined just by its program size, but also the usage. And it was EVERYWHERE. This vulnerability quite literally affected the whole Internet. That's why there was such a big fuss about it.

@vitulus_ 24 күн бұрын

I remember hearing that later versions of Java aren't susceptible to the RCE part of the exploit.

@unknownname3703 24 күн бұрын

and itsonly the XZ backdoor that is the other 10.0 CVE i know of. log4j was crazy

@unknownname3703 24 күн бұрын

and itsonly the XZ backdoor that is the other 10.0 CVE i know of. log4j was crazy

@jamesr736 24 күн бұрын

Wait, we don't use FTP anymore?

@alex4703 25 күн бұрын

It should be noted that server seeker going public makes cracked servers super vulnerable to forceop. When owners create these servers, they're unaware that anybody can join the server and log in with operator permissions

@Theunicorn2012 24 күн бұрын

@xelabrat2 24 күн бұрын

@@Theunicorn2012 It should be noted that server seeker going public makes cracked servers super vulnerable to forceop. When owners create these servers, they're unaware that anybody can join the server and log in with operator permissions

@apoloqy954 24 күн бұрын

@xelabrat2 24 күн бұрын

@@BloodravenRivers way to break the comment chain loser

@sethviets5120 24 күн бұрын

@@BloodravenRiversIt should be noted that the people here were doing something called a chain, and you just broke that said chain.

@Jackpkmn 25 күн бұрын

Using log4j to op yourself is up there with using a flamethrower to light a campfire.

@_WarrantyVoid 24 күн бұрын

More like on the tier of using the Tsar bomba to light a match. With Log4Shell one can directly take over the user account the Java application runs on, if that account has admin / root priviliges or there is a viable privilige escalation exploit available then the computer is basically fucked, especially if stuff like bios level advanced persistent threat is used (if the computer is not a VM that is). If the computer has credentials then even more can be compromised. Automate that process and you got a self-replicating botnet. Remote Code Execution exploits are no joke.

@DenLedeTomat 23 күн бұрын

I can't believe that they used that fkin enormous power to gain only the coords and tokens oof

@MrBelles104 24 күн бұрын

I'm so glad the handshake exploit was finally explained, I was always curious about Minecraft change logs and that reddit thread never got anywhere.

@blackstone12 24 күн бұрын

A lot of new servers use velocity as bungecord is outdated and unsafe

@Slendercze0 24 күн бұрын

Wait til bungeeguard/velocity modern forwarding bypass 😂😂😂 (its impossible without brute force)

@Gildfesh 25 күн бұрын

That Gildfesh guy seems pretty cool

@WFly101 25 күн бұрын

Godflesh is good band

@tutwastaken69 25 күн бұрын

hmmm

@flipflops99 25 күн бұрын

I love how he is subscribed to Team Avo 6:06

@Bluebird_YT 25 күн бұрын

I accidentally leaked my session id from a crash report for a sodium bug in 2023. So apparently Mojang didn’t fix the crash reports having the session ids.

@felixbemme7257 24 күн бұрын

Sharing sensible files with outside people isnt something they need to fix. Just dont share files like that with randoms

@Theunicorn2012 24 күн бұрын

I accidentally leaked my session id from a crash report for a sodium bug in 2024. So apparently Mojang didn’t fix the crash reports having the session ids.

@felixbemme7257 24 күн бұрын

@@Theunicorn2012 Because thats not an mistake. Crash reports are supposed to have this kind of data. You are just not supposed to share files and logs without checking what they do/contain with randoms on the web.

@roughlyunderscore 24 күн бұрын

Don't the session IDs expire when you exit the client?

@Bluebird_YT 24 күн бұрын

@@roughlyunderscore they expire after 2 weeks

@larry_toast2642 25 күн бұрын

I'm the kinda guy to watch 17min videos before going to work in 5 minutes

@hedireal 25 күн бұрын

i used to grief servers with the bungeecord exploit, me and a group of friends wrote a plugin that would act as the "hub" that would allow us to join the affected sub-server directly from the game with a command, change the name/ip that we were joining with, and a couple other things that i've forgotten now we were probably the first or second group of people to use it, fun times :)

@Ninjalette666 24 күн бұрын

im surprised the 'i work for planetminecraft' line ever worked. no admin from another website ever deserves admin on ur server. its that simple.

@Alex-qj9yu 24 күн бұрын

It’s why people are the weakest link in security

@LimitlessJayson 23 күн бұрын

but considering none of us were cybersecurity nerds all they were thinking is.. "maybe if i give him op he will recommend my server more!!"

@Ninjalette666 22 күн бұрын

@@LimitlessJayson you dont need to be a cybersecurity nerd to understand that you dont give operator status to a random.... do u hand your password over to anyone that asks for it? braincells people.... use them?

@Ninjalette666 22 күн бұрын

@@LimitlessJayson also no one is going to recommend servers for you, that costs money and its something people dont realise. you either struggle up the normie voting lists or your server gets spread by word of mouth or reddit or planetminecraft. there is no easy quick way to get your server to 'make it'

@LimitlessJayson 22 күн бұрын

@@Ninjalette666 this was 10 years ago that this stuff happened why are you speaking to me like I'm retarded

@DonutMT 25 күн бұрын

grabbing some popcorn, anyone want some?

@Nightcaat 25 күн бұрын

I’ll take some 🍿

@ReimBuch 25 күн бұрын

Sure, some tasty popcorn would be nice rn

@DonutMT 25 күн бұрын

@@ReimBuch here ya go!

@WFly101 25 күн бұрын

blackwater park is the new minecraft hacked client featuring guest member steve von from Asperger's co. It's very shï sàh lō

@TCMCGMB 25 күн бұрын

thx for reminding me

@sneezing_panda 25 күн бұрын

Ah Scetch and Nodus. Was good times running around with him. That Session ID exploit was wild times.

@Theunicorn2012 24 күн бұрын

Ah Scetch and Nodus. Was good times running around with him. That Session ID exploit was wild times.

@RoyD_S 24 күн бұрын

@@Theunicorn2012 bad bot

@Bluebird_YT 25 күн бұрын

I wouldn’t be surprised if there is a new forceop method with the new components replacing nbt data in 1.20.5+.

@lisiasty688 24 күн бұрын

There is always at least one exploit but not discovered yet. Sometimes it takes a lot of time and some programs or Minecraft versions are just not worth it. I mean you can find something in 1.2.5 but I wouldn't be worth it if that's only that version because something was removed for example... Creating non-vulnerable data is almost impossible to do task

@Bluebird_YT 24 күн бұрын

@@lisiasty688 I mean the new snapshots for 1.20.5 and 1.21 not the old version 1.2.5

@ItsCre3per 25 күн бұрын

2b2t players being traumatized by the string on the thumbnail

@Stormie21 24 күн бұрын

Why

@nikolaideianov5092 24 күн бұрын

@@Stormie21i think is goddamn log4j

@Stormie21 24 күн бұрын

@@nikolaideianov5092 oh

@azuree.nekowo 25 күн бұрын

8:52 quick correction: BungeeCord is a proxy/server software, not a standalone plugin.

@flipflops99 25 күн бұрын

blud really said "erm actually... 🤓☝"

@WFly101 25 күн бұрын

@@flipflops99blud really said "I'm 12 and project my insecurities online"

@flooploops4589 25 күн бұрын

UHGMMMM ACHUTTTTTTLLLYYYY 🤓🤓🤓🤓

@azuree.nekowo 25 күн бұрын

@@flooploops4589 honestly I'm laughing at how insecure and immature you are.

@tbrickman 25 күн бұрын

Eeerm ACKtuallY ☝🏻🤓

@AcornAnnihilators 24 күн бұрын

I literally had the book method done to my server last year, great vid

@vanry6839 24 күн бұрын

your videos are always my go to night watch content

@flameflyer7798 25 күн бұрын

The biggest exploit is having KZfaq rank on hypixel... ...talking about you, no lag back

@unnamed7430 25 күн бұрын

esp the second one, you can just climb up walls to escape from mobs and other players.

@WFly101 25 күн бұрын

Bagels are kinda hard

@CitriTea 24 күн бұрын

mods can't even ban you for this overpowered exploit smh

@youboring 24 күн бұрын

lf yt rank no wd routes

@bakubaku4333 25 күн бұрын

back then, I believed someone was actually Notch on a server because they were able to appear as his account. Things were just different back then.

@Someone-me1tx 25 күн бұрын

Did he drop an apple when killed?

@rubiitoxic 25 күн бұрын

@@Someone-me1tx probably

@ThePaperKhan 23 күн бұрын

Maybe he was Notch.

@fwfy_ 25 күн бұрын

Hello. I'm from PlanetMinecraft. Can I please become moderator on your KZfaq channel to test some permissions?

@ItsEka-929jfm 18 күн бұрын

Obv

@StarKayC 24 күн бұрын

The Handshake exploit brought back some memories. I remember seeing it posted and taking the risk of downloading it as people thought it was a login stealer. You could literally join any server with any username without any problem. Assumed it was more known.

@CZghost 24 күн бұрын

The Log4j vulnerability was actually FAR WORSE than just being a technique to gain an OP on a server. The vulnerability is dubbed Log4shell, and it is what it is. Being it that the library is widely used across the Internet in many popular Java apps and in many industry environments, the vulnerability that gives you an ability to remotely execute any arbitrary code (it is an RCE vulnerability), exploiting it is far more dangerous than just a silly Minecraft hack. Hackers were able to penetrate powerplants for example with this simple exploit. It's actually really scary that this vulnerability was found, and we still have no idea how much and how long it was exploited in the wild. Because the vulnerability was there for quite some time before it was discovered. It is patched now, but god knows how many machines were not only exposed with this vulnerability, but also actively exploited and penetrated. It's not just a silly Minecraft hack, that was a VERY serious deal.

@Samin2207_ 25 күн бұрын

How are you making videos so fast!?! Love your videos ♥, its great that you've been getting much more active recently!!! I know I've already said this but , I like the vibe that your videos give me , high quality , nice and relaxing videos. Also , what do you use to edit your videos? 🤔

@juanitoalcachofa3485 25 күн бұрын

Let’s gooo, the mister epic upload ! 🐐

@uncheck 25 күн бұрын

FINALLY the op login to any acc released. I've been wondering how it was done

@kirbykraftgames 25 күн бұрын

I feel like I’ve watched this before… I don’t know why, but I feel like I’ve watched this before

@JustYourLocalfnaffan198 25 күн бұрын

Same lol.

@WFly101 25 күн бұрын

J cole comes out as a trans billy eilish

@WFly101 25 күн бұрын

Lōl

@MD-df7if 25 күн бұрын

Removed?

@WFly101 25 күн бұрын

@@MD-df7ifno it was bungee corded into outer millenials are soacey hahaha Tool reference

@arcane_spark 24 күн бұрын

I commented about this in the last video so thanks for mentioning it

@kremsnita446 25 күн бұрын

when its sunday and you remember you have to go to school tomorrow but misterepic uploads

@that_guy1211 22 күн бұрын

i've made a couple of force ops for fun, the type that is a spawn egg that just summons and runs a armor stand that has /op {my_name} on it, ofc, it doesn't work if command blocks are off, but they're quite fun to make

@endurofurry 22 күн бұрын

ironicly the only one of these i have heard of was the log4j and the handshake I had no idea there is little info about it

@dispersegg 25 күн бұрын

Perfect timing, bedtime 👍🏻

@CDZ1309 25 күн бұрын

This was posted 7 minutes ago, gonna watch it now

@railworksamerica 17 күн бұрын

7 days ago now

@supericeg5913 23 күн бұрын

From experience from writing my own game, race conditions (talked about at 12:32) probably took away 2 months of debugging, they're a nightmare to debug.

@Elian504 24 күн бұрын

In 2013 I was the co-owner/admin for a server of a friend. There was another admin that had way too many permissions but I couldn't do anything about it because it was the owners decision, that admin fell for the planetminecraft scam. When I saw it happening in the console I deopped both the admin and the griefer and rolled everything back with coreprotect. Teached the admin a lesson through server broadcast lmao

@AttsRealm 25 күн бұрын

I think we need more info on that last Java security vulnerability… it sounded wild and very interesting

@Gildfesh 25 күн бұрын

There is actually a lot of information online if you look up "Log4Shell", a lot of videos covering it even use Minecraft as the example. I really suggest looking it up if you are even slightly interested because it was insane. Simply put, the tool that Minecraft uses to log things (such as crash reports) had a vulnerability in it which would allow someone to run any code they wanted if they could get a specific string of text into the logs of an affected program. Minecraft makes it easy to do this just by sending a chat message which meant that you could run any code you wanted on the computer of any connected player or even the server itself. The exploit being in the most commonly used logging library meant lots of websites, servers and random programs were vulnerable to the exploit, it just happened that Minecraft was one of the things impacted.

@gem3763 24 күн бұрын

You can find plenty of info about it online, as it was a huge security issue and had lots of real-world ramifications

@Dullahan00 24 күн бұрын

I remember back on my brother's first attempt at running a server for his friends someone came in and destroyed the world with this exploit, Ender Dragons and Withers left and right. On his way out he turned on the whitelist as a parting gift and show my brother how to stop someone else from coming in to grief the world again.

@epicgamer13370 25 күн бұрын

8:18 this segment sounds like you spitting bars lmao

@beastaadigamer6415 24 күн бұрын

Yo what is the music you used in the timestamp 9:05 its so cool, i'd like to know the name of it. Please ??

@RayTraces 25 күн бұрын

I force opped once into a big minecraft event, i got perm banned but it was crazy

@user-jw4gx6dc9i 24 күн бұрын

@TheMisterEpic Hm? I watched LifestealSMP some time before, and didn't spoke use the Handshake method to get OP on the server? Or was it just a similar glitch?

@vf8vo31 25 күн бұрын

If you joined like hypixel with the handshake exploit, wuldnt you be invincible from the bans?

@synkstar9921 24 күн бұрын

Ive seen someones server get messed up by the bungee method because they didn't have the backends firewalled off. I had a good laugh from that.

@cowshu 24 күн бұрын

i think the most substantial exploits arent the ones limited to the game but the ones taht give you privelages on the server backend or user machines

@Rakesh37187 24 күн бұрын

Man i remember using Session Stealer. I was shocked when it worked

@ThenamesC 25 күн бұрын

(on the oldest anarchy server in Minecraft....)

@WFly101 25 күн бұрын

Just call my name

@WFly101 25 күн бұрын

Ωμ×∞∆››

@steyok 24 күн бұрын

Its a good day when a new duping video lands on the internet

@ButterFromDiscord 22 күн бұрын

How do you make the enchantment glint look like that please I need it

@Sodisna 24 күн бұрын

Felt like this was talked about before.

@Tantalium1 25 күн бұрын

The history of ratting in Hypixel skyblock is insane

@KillByHundreds 23 күн бұрын

me and a friend managed to use the handshake exploit back in the day and we RARELY got it to work, out of the thousand attempts we only got it to work maybe 3 times. Interesting to know how it worked, we just installed it with 0 knowledge and ran with it lol

@akurasubject9617 24 күн бұрын

Yet minecraft still want to stick to java...

@Cakeytoo 14 күн бұрын

This guy needs to make a movie of minecraft news would be so good 😂

@railworksamerica 17 күн бұрын

9:37 how would I do this? Investigating this to fix my setup

@Kuid 23 күн бұрын

3:00 I remember writing that over 8 years ago

@susimogus 20 күн бұрын

LOL

@polarace420 25 күн бұрын

day 1 of asking TheMisterEpic to oil up

@befera124 25 күн бұрын

Cool video!

@ncsr9675 24 күн бұрын

14:04 i would love a video about creative plot worlds and their history/what happened Its rare to find any of these servers today. i used to play alot in a brazilian server called SkyCraft, it was the most fun i had with multplayer

@SanMaster17 25 күн бұрын

Force OPPA GANGNAM STYLE

@phantom_sy 24 күн бұрын

Anarchy players abusing vulnerabilities that could pose as a national threat, so they can steal someone’s base coords:

@avi 25 күн бұрын

wait i just watched this video earlier today why reupload

@AbouChakar 24 күн бұрын

cuz u found this you dont have to milk it out along 3 vids.

@anotheryoutubeaccount5259 22 күн бұрын

TheMisterMilkMan

@GamingCeo420 25 күн бұрын

The most recent force op exploit was fumbled by people who didn’t know the potential

@eXe_goof 24 күн бұрын

I was already wondering when a video about the log4j exploit would be released.

@zerozero_73 24 күн бұрын

I remember using something similar to this back in the day 😅

@Kellysg126 23 күн бұрын

Oh man i remember that icanhasgrief video like yesterday!

@tipicaljd-8410 22 күн бұрын

You have miniature testing ???

@AOOA926 25 күн бұрын

Minecraft has more vulnerabilities than I have braincells 💀

@inconsistenttutorialuploader 24 күн бұрын

stolen

@drrockstar4040 25 күн бұрын

So how is your first youtube video a patreon exclusive?

@sentakuugaming 17 күн бұрын

i remember doing the book forceop it was fun sadly i got banned shortly after then every admin know about it they were just playing around and yep got ban :D it was still fun

@lukasplaycs2 13 күн бұрын

Btw that not all force ops , u forgot about aka - plugin called backdoor:)

@Zearez 25 күн бұрын

No idea what this is but I'll watch you never the less :)

@ltstheprogamer 25 күн бұрын

Those are truly game breaking

@creeptitan 13 күн бұрын

The Sign ForceOP was actually stolen by the Wurst Client developer, he was not the one to discover it. A youtuber who i forgot the name of even made a video exposing the Wurst Client developer for blatantly copying his method, but i have never seen anybody talk about this or credit the original finder.

@BloodravenRivers 24 күн бұрын

hold up now, u sped thru that last lil bit there about the command u could type that would give u op and control of a persons computer. idk i think it was log4j ik its probably very limited info on that particular method n probably less you could actually speak of on here, but of all the methods u described in these videos that very last one was very obscure, ive never heard about that one in it peaked my interest because something with that level of control to exert would be very dangerous exploit indeed, not just for servers, alot of these hacks and exploits most pertain to in game control, but one like that, just imagine u know we got old people running our countries u know their grandkids play minecraft how long before some anarchy player gets into REAL trouble for getting into the wrong computer

@0qerq15 24 күн бұрын

wait is this is a re-upload??

@thechef7633 25 күн бұрын

I liked my own like

@WFly101 25 күн бұрын

I commented on your own comment

@thechef7633 25 күн бұрын

@@WFly101 i liked your comment on my own comment

@WFly101 25 күн бұрын

@@thechef7633 I ate your dumpster

@nikolaideianov5092 24 күн бұрын

2649

@syedismail-co1wq 25 күн бұрын

What’s good nice video .

@spaceaus4 25 күн бұрын

21 minutes early lets go and the video is edited nice

@Sunnyshithispants 25 күн бұрын

I never heard this before *what*

@ImMrquesadillaman 25 күн бұрын

yummy video sad there was no quesadillas

@lukasjetu9776 25 күн бұрын

the mister epic videos

@YouTubeName-hw1uk 24 күн бұрын

On Minecraft Wii U it's basically the average day to get someone to force op themselves.

@Elmer545 24 күн бұрын

isnt this a re-upload? i swear i've seen this video already

@sleepycCh 24 күн бұрын

Not only was nodus the biggest hacked client of all time, it was so big it was synonymous with hacking

@MATOMTU 24 күн бұрын

I love the part where the mister epic force opped all over the place

@so_s_ 24 күн бұрын

I remember ForceOP, destroyed one of my favourite servers

@kryzethx 24 күн бұрын

Is this a reupload? I could have sworn that this video was already posted...

@Katninja956 25 күн бұрын

15 sec ago hello is anyone here? Just me? Ok (refreshes) never mind i guess

@Jacktherippa84 25 күн бұрын

At least use the full version of Space Valk 3 if all you're going to do is get B-roll of it. The incomplete version from years ago makes me sad : (

@LowSkillMac 24 күн бұрын

Space valk 3 is so hard to fully load

@Jacktherippa84 24 күн бұрын

@@LowSkillMac He can clearly do it, and you can fully load stuff easily and render it silky smooth if you use replay mod.

@whit1722_playz 25 күн бұрын

Hi mister epic

@SpigotRCE 25 күн бұрын

8:55 bungeecord is a proxy not a plugin

@GabeDoGames 25 күн бұрын

One hour gang

@uzundeprem5743 17 күн бұрын

nice dota ost

@ilayb 24 күн бұрын

Most of the video you didn't even talked about log4j and I'd like a video specifically about it.

@heretichazel 24 күн бұрын

Damn, i used the sign exploit once aages ago