FREE TOOL

Backdoor Scanner

Downloaded a free, cracked or leaked resource? Drop it here before it touches your server. Every Lua file is scanned for the patterns real backdoors use — obfuscated \x strings, hidden loaders, HTTP exfiltration, os.execute and known malware-panel signatures. Nothing is uploaded — the scan runs in your browser.

Drop a resource folder here

or CHOOSE FOLDER · a single .lua file also works

A clean result is not a guarantee — it means none of the known patterns were found. Always review resources you do not trust.

How server backdoors hide — and what to do

Short, plain explanations of the patterns above. Written by Dispersia; the community reference we learned the most from is credited under each item.

Obfuscated \x / hex strings

Malware rarely writes PerformHttpRequest in plain text — it hides it as "\x50\x65\x72\x66...", which Lua turns back into the real word at runtime. A normal script has no reason to spell its own function names in hex. A block of these escapes is the single strongest signal that code is trying not to be read.

What to do: decode it (this scanner does) and see what it builds. If it rebuilds load, assert, an event name or a URL, delete the resource.

Reference: JG / Yorick security notes on FiveM backdoors — docs.yorick.gg/Security/Backdoors.

load() / assert(load(...)) runtime loaders

These run code that is assembled while the script starts, so the dangerous part never appears in the file you read. assert(load(decode(...)))() is the classic backdoor shape: decode a blob, compile it, run it, all on one line. Legitimate resources almost never build and execute code from a string.

What to do: treat any load/loadstring fed by concatenation, a decoder or a downloaded string as hostile until proven otherwise.

Reference: docs.yorick.gg/Security/Backdoors.

Hidden HTTP calls (data exfiltration)

PerformHttpRequest to an address that is not the script's own update or license server is how a backdoor sends your server data — tokens, player counts, connection strings — to its owner. The Cipher panel, for example, phones home to cipher-panel.me. This scanner flags outbound HTTP and highlights that host specifically.

What to do: confirm every URL the resource contacts. One you do not recognise is a reason to remove it.

Signatures for the Cipher panel were shared within the MenanAk47 / server-owner community.

os.execute, io.open, io.popen

A FiveM resource has no legitimate need to run shell commands or read and write arbitrary files on the host. These calls let a backdoor install a persistent loader, edit other resources, or run a program on your machine.

What to do: any of these in a gameplay resource is a red flag — verify the exact use or remove it.

Reference: docs.yorick.gg/Security/Backdoors.

Events that trust the client

A server RegisterNetEvent that hands out money, items or admin rights without checking who fired it is not a hidden backdoor but an open door: any player can trigger it. This is the most common way servers get drained. It is a design flaw, not obfuscation, so read the handler, not just the name.

What to do: every money/item/permission event must verify the source server-side. Never trust values the client sends.

Reference: docs.yorick.gg security notes.

This scanner matches known patterns; it cannot prove a resource is safe, only flag the signs of the common ones. Deep obfuscation can still hide. When in doubt, do not run untrusted code on a live server.