How One Man Hacked Hypixel...

[@ۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥ]

here since 27.1k

[@ۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥۥ]

yay my comment got pinned and hearted!!

[@ryann2298]

nuh uh

[@mckayshirou]

Interestingly i once saw this as an opportunity to bypass the "login lobbies" of semi-premium servers but at the time (aroun 2018) i wasn't savy enough to know how to breach those defenses, this was a very good documentary...

[@niicespiice]

how do semi-premium servers work? i'm interested because i currently have a cracked server and it has security issues

[@hashinemiretsien9920]

@@niicespiice Idk if it's these ones, but basically, through cracked clients you could just enter with a name you choose and then make a password if the name's not taken. If you were to be premium, logging in with your name if it's not already taken gives you the option to first make ur password and then "turn" your account into premium status, so once you log in you don't need to use ur password and such, usual premium login.

[@Shizkeb]

@@niicespiice fed

[@gobedits]

@@Shizkeb XD

[@TheRroganShow]

@@niicespiice smei premium auto logs u in to the server without needing the /login command. if you have a premium mc account

[@Jankoekepannekoek]

I can't believe Hypixel made themselves vulnerable to the exploit that normally only occurs on all the 10yo kids first bungee networks.

[@adrian-pr4tn]

it's because they thought that a firewall is enough, an error on the backend caused for the firewall to reset

[@silent4198]

@@adrian-pr4tn in this case it would be enough if it wasn't reset

[@Timongcraft]

​@@adrian-pr4tnThat's why you don't only have 1 layer

[@adrian-pr4tn]

@@Timongcraft i'm just explaining

[@enterprofilname9625]

@@Timongcraft If they have more than one, that would lead to more lag for the server (and you know they are already horrible)

[@dalton191]

As a server owner, and developer for MC Mods/Plugins you did an amazing job explaining all of the systems talked about in this video! Great video for those who want to learn about the basics of Bungeecord security & networking works as well! I also loved the small jab at Eclipse LMAO 11:28

[@_thomas]

intellij my beloved ❤️

[@X5up0_]

True I am a cyber security student and he explained the Asymmetric authentication part really really well

[@Jwolf0]

Yeah I don’t know how anything works and this video honestly helped me understand how all this works, this also explains why once I got a warning by bungee cord and no one explained what the hell it was

[@MC-GOD-BEDWARS]

Yea i also known that why bungecord can only connect to different server

[@das_9677]

As someone with extensive experience in system administration and Spigot plugin development, I think that this was a nice explanation of the exploit. However, I have one correction to make: Velocity is NOT a fork of Bungeecord, but an independent project serving as an alternative to PaperMC's now discontinued "Waterfall" Bungeecord fork that aims for higher performance and security

[@Kristibek]

I thought Velocity is the discontinued fork and Waterfall was the independent one made from scratch

[@das_9677]

@@Kristibek Nope, it's the other way around. Velocity is more modern and the only proxy the PaperMC team is maintaining at the moment

[@_thomas]

this is correct (kinda embarrassing since I was building plugins for both 4 years ago)

[@vaniemsky8571]

i work in IT, that guy explained async cryptography technology better than some teachers at my university.

[@mrdragonboi]

To be fair, its a good thing he disclosed said method which this guy could be considered a Grey hat hacker, since he didn't do it with permission, but seeing as he helped the admins and devs, well - he technically got away. I would prefer to use a White hat method, but obviously I would only use "burner" accounts (with permission) and tell the admins about such. This is part of cybersecurity, and can be known as other names, especially ethical hacking. Although some countries deem it as a grey area, it is what it is.

[@andrewkvk1707]

He also stole discord accounts so I am thinking they only disclosed the exploit to reduce their punishment, more black hat with the hypixel instance itself being grey.

[@xblxckxpxny1005]

@@mrdragonboi why are you trying your hardest to sound "cool" and "knowledgable". "gReY hAt" "wHiTe HaT aPpRoAcH" "eTHiCaL hAcKiNg"...? Cringe NPC go back to playing games and doing homework 💀 No one that honestly knows whats up talks like that 🤦‍♂️

[@mrdragonboi]

@@andrewkvk1707 Yeah fair point

[@MrMauio]

man just put the fries in the bag

[@mrdragonboi]

@@MrMauio Alright then

[@ItzYotam]

so basically, every once in a while, a genius comes and somehow hacks Hypixel. they found out they asked about it sometimes they tell, sometimes they don't and at the end they fix all and ban / wipe / punish the hackers. crazy stuff but bro has brains

[@Zedacat]

this exploit existed since forever, hypixel was only so unlucky for one of their firewalls to die and allow connections

[@DreadHalfling9]

@@ItzYotam misconfigured ports/machines are very very common and its honestly amazing the internet still functions with how poor the security is on most systems

[@ItzYotam]

@@DreadHalfling9 well yes but my point is someone finds an exploit, abuses it and then tells it, it's a cycle

[@DreadHalfling9]

@@ItzYotam usually you have to look through logs to figure out what happened when its malicious as people dont really like to share that and make themselves public when theyre bad. But yea in cases like this and in good cases its awesome to have stuff directly from the hacker, glad you found cybersecurity interesting have a good day bro :]

[@ItzYotam]

@@DreadHalfling9 alright, and thanks you too 👍

[@cor3po491]

WHY IS NOBODY TALKING ABOUT HOW ON THE MAP IN THE INTRO NZ IS JUST ROTATED UK 😭

[@_thomas]

HAHAHAHA CONGRATULATIONS you are the first person to notice

[@Ceelker]

@@_thomas Why is Africa gone?

[@Agent_Mighty]

what happend to italy…

[@teraba1696]

​@@_thomasI noticed straight away and was confused, It's where I live aswell 😂😂

[@ookinbao]

Random comment but me and my friend are currently taking a Cyber Security class studying for the SC-900. Your explanation of the encryption system genuinely taught us better than our teacher. Hope to see more of this kind of content, maybe your explanations will help us pass the SC.

[@TheWin9User]

1:51 "Your latest 2 week Minecraft phase?" He knows us good xD

[@computeroid6162]

@@TheWin9User Came here to say this too lmao, too accurate

[@xfsdark]

How da hell im i subscribed I think you hacked me

[@aathifshadow6549]

@@xfsdark bro is it me at the thumbnail

[@xfsdark]

@@aathifshadow6549 hmm , don't copyright him then

[@aathifshadow6549]

@@xfsdark I won't do it

[@TheWin9User]

8:28 A needle in a haystack in a field of haystacks.

[@Bilge-ko5qp]

I came to watch how one guy hacked Hypixel but learned the whole computer science, wtf! Amazing video dude, immediately liked and subbed!

[@teraba1696]

@@Bilge-ko5qp I decided to watch it 3 times cause I didn't expect to learn it either! Gonna be saving it to keep my mind refreshed about it

[@Bilge-ko5qp]

@@teraba1696 exactly, it's clean as water and teaches this topic very effectively, amazing!

[@jarikooper6325]

As a IT student who learns about ethical hacking. This is actually extremely smart. People like this could become a pen tester and make big bank legally. It takes a lot of skill, experience and creativity to come up with stuff like this

[@Clip_It1]

i LOVE how you explained this, its not even hard to understand with your visual examples

[@Cherrypizzasquad]

5:49 Ithlught that was gonna be a sponsorship lol

[@_thomas]

man i WISH

[@itomato8836]

@@_thomas try to actually dm the marketing representatives of certain companies that are close to the content you offer and offer them a sponsorship, this is a way to get recognized faster and it'll help you get sponsorships easier and have them as your clients.

[@PR3SVX]

i love how you so effortlessly explained asymmetric encryption in 3 minutes better than my computer science teacher did in an hour

[@Clazzette]

I've learned more Cybersecurity concepts in this video than my own college course back in the day. I love this video.

[@deadshxll]

"Cybersecurity professionals need to win every time, attackers need to win only once."

[@TankieBoi]

Hypixel's lucky this wasn't a malicious hacker, in this guy's position I'd start Mass-Banning Hypixel moderators on the spot because I find their staff team corrupt as hell

[@Snoozzei]

on god. there system sucks too. i've been banned for like 7 years for something i did when i didn't know any better i was like 16 then

[@TankieBoi]

@@Snoozzei Yes. They will ban based on personal bias, such as flagging a Soviet Flag "Inappropriate" in build battle, despite it, to my knowledge, not being considered an offensive symbol (And making stupid unrelated things to the theme isn't against any rules). I stopped playing Hypixel years ago for various reasons, some unrelated to the server itself, and can't say I'll miss too much about it. I liked build battle and Farm Hunt and maybe sometimes come back to visit it but with the generation of the Skibidi Bedrock children upon us and the Java players outgrowing Minecraft, Hypixel definitely has an unpredictable future

[@Proboizzgamerz]

Same with fakepixel network

[@zonkedmc]

never interacted with em. never even heard from em bc i don't cheat. you sound mad

[@TankieBoi]

@@zonkedmc I haven't played the server in years, I was simply stating my distaste towards Hypixel due to their poor staff team

[@deez-kun]

bro just explained half of my computer science syllabus

[@dirtismyolduser]

amazing video- great balance of technical detail and accessibility to everyone. Keep up the great work!

[@_raptor4070]

I did not expect to be reminded of my networking classes in a Minecraft video of all places. Very high quality production, keep it up!

[@TheElderReal]

In just 2 hours There is already someone who archived it In Way back machine This video Is really Great.

[@DreadHalfling9]

Techy people like stuff like this and theyre usually the ones who use wayback :)

[@TheElderReal]

@@DreadHalfling9 Yes sadly The video Is not Registered.

[@hito1988]

im impressed, never saw this channel and having "minecraft/hypixel" and "hacked" in a video title doesnt sound promising (theres too many fake "i griefed server XY" or "i hacked server XY" on this plattform). but im really surprised, this is a really informative video and im glad i stumbled over it. thanks for taking your time to educate us 👍

[@locipro9937]

insane quality and attention to detail from an underrated channel

[@WaterMelonFive]

Woah, so that explains that being able to join Hypixel using any account exploit that happened a year or two ago that everyone was talking about. This explanation is very good, I learned more here than in my computer science class! Good video!

[@Rohan.Reddy.Bandi.]

as someone tryna get into cybersecurity and also love minecraft, this was the best video i have ever seen

[@infinite_bed]

Very well done explanations! Just finished a proxy system for my server, and I had to learn everything you explained so will by myself. If only I had these videos a week earlier!

[@_thomas]

@@infinite_bed damn! if only I had posted this video more than a week ago... 😔

[@NewRodin]

Really well explained. I'm pretty familiar with pentesting and how that stuff works (I work with it and daily drive BlackArch and Qubes) and I love how you ELI5'd it so well so people can understand easily. That hacker was an absolute legend, found the backdoor and responsibly just said what it was so they could patch it, and didn't abuse it for his monetary gains. That's how we do it. Thanks for making this video, it was definitely a good watch. Definitely subscribed!

[@user-wb7ot7kt3x]

The fact that you have to install a seperate plugin so the backend servers can validate the authenticity of the bungeecord server is insane. Like the whole authentication is handled by bungeecord. Applications like this should be secure by default.

[@TlMEL0RD]

15:04 Being a government hacker on you're goverment's side is a job.

[@goktughatipoglu436]

Actually most of the times there are no decryption. Usually this token check works like encrypting the data you gave us and checking if they both have same hash script. Since we have the hash on our database, we can compare them and check if they match

[@DataDerp]

Bungeecord in this sense could be also called a load balancer. I guess reverse proxies are all load balancers if configured to do so. Side note: great video, wasnt expecting such s low subscriber count with this quality.

[@Timongcraft]

Nah, you have load balancing on top, one BungeeCord instance isn't enought and also if that would fail it would be catastrophic

[@DataDerp]

@@Timongcraft Exactly, there would be load balancing at DNS level (correct me if I'm wrong but I think multiple SRV records) which could point to a different bungeecord instance depending on 'priority' (I think) of the SRV records. I never had to do this, this is based off general system administration knowledge. Then each bungeecord instance works together to route the player across those mini servers.

[@Timongcraft]

@@DataDerp Ig and they probably either have Bungee in Bungee or some other proxy like HA Proxy too after that.

[@leenderz]

Shodan scans the entire public IPv4 internet every 4 minutes, and offer an API to plug that dataset directly into your attack tools. Cybersecurity is crazy nowadays.

[@x4dam]

Bro is so underrated. I learnt more from this than in computing class.

[@SuperNuketown2025]

As per US laws, this almost certainly wouldn’t constitute hacking, because the “hacker” in this case never entered any kind of password or secret, and didn’t abuse known a software bug to bypass such authentication. Misconfiguring a server and giving someone access because you didn’t properly authenticate them is, in fact, not a violation of the computer fraud and abuse act.

[@ceruleanshep]

Some dude finds an exploit to hack the largest MC server in the world. And yet I get banned for accidently using a harmless exploit that no one told me I shouldn't be able to do. I think I'm still salty about it.

[@asawski]

what u did

[@KastrujeDzieciNozyczkami]

we have to know what dirrr you do

[@ceruleanshep]

@@KastrujeDzieciNozyczkami So people were flying around in the skywars lobby, and after accidently hitting the space bar twice, I realized I could fly too. After about 5 minutes of flying, I was kicked for "blacklisted mods". I tried to appeal, but was denied, and now I can't appeal again. Literally no one will hear me out. This was back in 2014.

[@KastrujeDzieciNozyczkami]

@@ceruleanshep XD thats funny and sad because its their fault

[@ceruleanshep]

@@KastrujeDzieciNozyczkami After much prying, apparently flying in the lobby was only available for those who donated a certain amount to the server. But NO ONE TOLD ME OR STOPPED ME

[@Zilkenian_Davenport]

I like the way you explained all of this. I work with servers, and IPs, ports, proxies, firewalls and backend servers are something I deal with on a daily basis, but took me a long time to understand when I started. Would have loved to have your video back then.

[@thatfridayfeeling5490]

moyang

[@proook3606]

Yangmo

[@terrariapro147]

agmnoy

[@timeblade]

gnaymo

[@Nitrogen_Dioxide]

Who unpinned this man.

[@_thomas]

moyang!

[@ndbass09]

I'm amazed at how simply you communicated all the computer/security/cryptography concepts.

[@Icepropuppy]

The way you say "moyang" is so disturbing by me but overall good video.

[@t.j.f.1]

it's how you say it

[@DeIexo]

I learned more cybersecurity in this video then my actual class- IN 15 MINUTES.

[@nadavgill975]

i havent played minecraft for over 2 years already but i stayed through the whole video to learn the cybersecurity and network terms you presented just like those ill be tested about in a few months for getting into an intelligence unit in the army, keep up the great work

[@Tomakins]

It's wild that you kept my attention while describing how logins work

[@charliegolf2730]

I've heard of proxies before and had some form of understanding of what they do, but your explanation was so stupidly simple it finally clicked

[@redsox.]

Wow I remember the players with level 5,000+ and had no idea this is what took place. I’m pretty sure hypixel covered it up at the time, claiming they abused some bug

[@rune7894]

"against your countries server policies" LMAO

[@NvroIshere]

That's crazy. As someone who has been doing server development and some pentesting myself over at least a decade now, I'm surprised as to how easy of an exploit went unnoticed for so long. I've actually done this before as a test on some smaller servers I worked on as well. Crazy dude. Edit: The fact that they were still using Legacy Bungeecord as well is insane.. but, it makes sense seeing that the server itself is really old and has thousands of players that still play today.

[@RealCenti]

Here Before 25k! (Pls pin lol)

[@myfatherwent1111]

Same

[@melon64_]

Here as well!

[@Rechercher]

me tooo

[@phase..33]

Hi centi (im already in ur Discord and im friends with u on discord)

[@roboicag]

Here before the children

[@CrownlessOcto]

You did a fantastic job at describing all the server security feature then some of my professors lol

[@xcaedes]

I love how all the people who do these kind of things always have the same overused NameMC skins

[@MrElectric6096]

ah yes, hack the subscribe button The subscribe button: javascript:void(0)

[@mrcavas]

15:03 hmm i guess I can start hacking now

[@bil0k74]

Я тоже (me too)

[@newusername-i4n]

@@mrcavas and me, конечно же)

[@CChickennnnnn]

And meeee my mom going buy me vape v4 ghost client IM going hack and get revenge who people who bully steve andnplayers and me BHAHAHHAHA

[@luminescentlion]

Public Private Key encryption does not work backwards. The server just makes it own private key and sends clients the public key, so they both have each other's public key. ultimately meaning that when you encrypt something with the public key only the designated receiver(Whoever has the private key that matches the public key) can recieve it.

[@_thomas]

It does, in fact, work backwards. RSA is a trapdoor permutation, works both ways!Typically you would only sign and decrypt with the private key, though, since it's not very good encryption if anyone with your public key can decrypt! The client never generates a keypair. The server never has the client's public key as: 1. the client doesn't have one and 2. it doesn't need it. The server's public key is used to encrypt the shared secret. The client generated the shared secret internally, so it doesn't need to receive any encrypted information. They then use that to talk with AES - symmetrical encryption. Read more about Minecraft's implementation here: wiki.vg/Protocol_Encryption

[@KLOCek14]

sometimes i wonder who tf programmen ts

[@guskye4826]

Ong bro😭💀

[@pontusnyfelt8096]

this is how must stuff work when it comes to securyty that there exist a flaw until someone find that flaw and then that flaw is patch and thats how the securyty gets greater and greater

[@avivam777]

2:57 = NERD ALERT

[@Niesmiesznyy]

my guy could destroy entire hypixel economy but decided to give freebies to himself and his friend and then share with the admins how he did it. What a chad

[@JOHNyt_Roblox-z2x]

14:37 he stole mine 😢😢

[@rodricbr]

well, that's why port plus cidr scanning is so important loved the video, really well explained.

[@proook3606]

U deseserve more subs 🗣🔥

[@Laggy_boi_]

Not gonna lie, this was such a good documentary. I'm surprised you only have 18.4k subs since your content is peak. Keep it up bro, earned another sub!

[@tresblo]

I don't play Hypixel a lot but this was a very cool video

[@volcanic_sloth]

niko oneshot, where's your hat

[@tresblo]

@@volcanic_sloth look, the pancakes were way too expensive

[@volcanic_sloth]

@@tresblo what are you gonna do next time, sell your scarf?

[@Jecket22]

Genuinely informative and overall well made video! It's honestly surprising that Hypixel didn't have (an equivalent of) BungeeGuard for their servers. learning something new behind big servers haha

[@myfatherwent1111]

11:48 i need that

[@Hilow714]

@@myfatherwent1111 same pal

[@kuba4ful]

If you ever get bored of Minecraft videos, please make white hat hacking/computer science explanation videos. I already knew most of the stuff here, but I was surprised at how well it was explained here. I'd love to have such videos back when I was studying this.

[@PiotrK]

And there we go guys, that's why you DON'T disclose/report the exploit to the owner (as you get NOTHING useful in exchange, absolutely nothing beside time wasted and some useless item) and why you don't make yourself OBVIOUS having it.

[@theairaccumulator7144]

Hypixel should start a bug bounty program tbh it would limit catastrophic duping in skyblock if kids know that they can get a better amount of money from hypixel itself than from selling the dupe or duping then irl trading the items.

[@das_9677]

Or you just remain ethical and disclose it even if you don't gain anything from it. Of course it would be better if they compensated him, but I don't think that your suggestion is a good conclusion to improper compensation

[@magoleo-pr7if]

Well, you should always do right without expecting anything back, but you also can't expect the same from others and yeah a reward for bug hunting would 100% help with the skyblock exploit problem

[@kenos911]

You can now write that as volunteer white hat penetration testing experience in your resume

[@Miiiasm]

It’s not the first time that Bungeecoord is involved with security flaws on authentication, there were quite few similiar exploits in the past and yet seems nobody even in Hypixel learned their lesson

[@Redex0104]

Under 25k!

[@Lol-ke2pw]

Amazing video bro I love how you explain everything super well

[@Spokuble]

def first so you should like this frfr

[@fruitepic9260]

that's probably the best metaphor for what a proxy is, cheers

[@dantheturtle6412]

I love the way you explained things in the video, I actually understood something for once

[@luckycatzinho]

"security is not a process, it's a state until you got pwned"

[@KyleEU]

Is there any way to watch the recording of the admin talking to them? Interested in doing a deeper dive of this with more of the technical details

[@lmnk]

Great job explaining concepts of server scaning in simple terms!

[@hi12167pies]

i remember doing this same exploit on some smaller servers, i didn't think hypixel would have ever had this issue considering how large they are.

[@scalemerald]

first video i ever watched from you- i put this on for background noise and slight bit of entertainment as i ate a bowl of cereal, praying that you wouldnt be a super quiet content creator that my eating would drown out... just to find out that you are very much not quiet and do your own subtitles.. based as hell, im def coming back here again lmao

[@monstersponge9096]

Hypixel having a max player count of 50k with an average of 30k people being on at any given time is really crazy to me. I started playing hypixel in 2015 and haven't been on since 2020. I was online when they hit the maximum connected players (555k at the time) record & sent out a server announcement through chat to thank everyone for playing. Very surprised that the new generation doesn't have much interest in playing multiplayer servers anymore.

[@gavinmorrow3328]

As someone trying to get into cyber and tech these were great explanations of all the concepts involved I really loved the port scan metaphor in particular!

[@JJTurtle4ever]

Well, you've earned a sub! Made me a little more interested in hacks since my microsoft account just got hacked... good job on the explaination!

[@Ваня12к-щ3к]

Instructions unclear, accidentally hacked Minecraft and banned Moyang. -1/-10

[@Roach606]

I made the DougDoug Minecraft Server and we actually had a guy come in and do exactly this. Nice guy just told us to get Bungeeguard

[@kemox]

Amazing representation for ports, i've always explained it to my friends as doors to a house but this was a nice well made video for sure. subbed.

[@nathantraverso2713]

Really didn’t think I’d see Thomas on my fyp haven’t seen anything since tfm

[@OURPR_]

Crazy good explanations / editing in PERFECT pace 😍✨💅😮‍💨

[@_end3rguy_]

my cousin found an exploit to ban people from entering a chunk and hypixel hired him to use it before it was patched

[@moltenlavacore]

Incredibly well explained! Good stuff

[@LeanPicachu]

taught me about asymmetric encryption better than my cybersecurity class 💀

[@jc008titan]

why can't teachers explain tokens that well?? you are the best teacher of those things!

[@mrvenzen5719]

Very good vid, story telling and explaining. Enjoyed watching it through, keep it up!

[@hardikagrawalgaming]

the problem rised with the bungeecord while it connects server it has no protection or confirmation of the player was connected to the previous lobby(main password/account checkng lobby) but i was just solved by BungeeGuard

[@darkmark7366]

If minecraft hackers and war thunder classified documents leakers used their power in anything other than videogames the internet might shut off

[@waterflows2569]

As someone studying computer science with cyber security major this is fcking nuts to me that an exploit known this long wasn't patched by Hypixel at the time

[@MaymoonahAslam]

its my exam today and i forgot all the chapters after listning this video (for fun only)

[@behasan7949]

Bro the way you explain things is crazy good

[@talksickcs]

Nice informative video on internet security and technology! Well done.

[@cornflakespaghet7661]

It actually used to be possible to steal someone's key just by having them join your fake server. Had some fun with that back in the day O7