How does Leaf Mod Analyzer detect Discord_Webhook?

Leaf Mod Analyzer performs static analysis of JVM bytecode and decompiled AST structures matching The detector searches string constants in the class constant pool (`CONSTANT_Utf8`) for patterns matching Discord incoming webhook endpoints: - Plaintext URLs: `discord.com/api/webhooks/\d+/` or `discordapp.com/api/webhooks/\d+/`. - Common Unicode-escaped patterns (`\u0068\u0074\u0074\u0070\u0073\u003a\u002f\u002f\u0064\u0069\u0073\u0063\u006f\u0072\u0064`) frequently produced by simple string obfuscators. The detection flags the presence of the webhook URL string directly in the class file. A key technical limitation is that the scanner checks string literals; if a mod decrypts the webhook endpoint from an encrypted byte array at runtime or downloads it dynamically from an external paste service, this rule will not trigger without prior string deobfuscation. in an isolated environment without executing untrusted JAR files.

Can server anticheats block Discord Webhook Exfiltration?

Server-side anticheats monitor movement and packet anomalies, while static analysis with Leaf Mod Analyzer identifies hostile and unfair code before mods are loaded.

Discord Webhook Exfiltration

🎮 Minecraft Gameplay Impact

Discord incoming webhooks allow external applications to post formatted JSON messages and attachments to specific text channels via HTTP POST requests without running a full bot user.

Discord_Webhook flags mods containing hardcoded webhook URLs. In malicious scenarios, Discord webhook endpoints can be used as an automated exfiltration route for sensitive files and credentials found on the player's system (such as session tokens from launcher profiles, browser cookies, or system credentials) using standard HTTP client APIs like HttpURLConnection. Because traffic to Discord domains is commonly allowed through network firewalls, outbound webhook requests often pass without triggering perimeter alerts.

While some development utilities or server crash-reporters legitimately send error notifications to Discord channels, embedding incoming webhook endpoints in client-side mods exposes the webhook token to extraction and abuse by anyone who inspects the archive.

🔍 Functions & APIs Analyzed

ConstantPool CONSTANT_Utf8

String literal containing a Discord incoming webhook URL pattern.

💻 Mod Implementation (Dev Source / Mapped)

package com.example.notifier;

import java.io.OutputStream;
import java.net.HttpURLConnection;
import java.net.URL;
import java.nio.charset.StandardCharsets;

public class WebhookNotificationSender {
    private static final String WEBHOOK_URL = "hxxps://discord[.]com/api/webhooks/123456789012345678/<redacted>";

    public static void postMessage(String messageText) {
        try {
            URL url = new URL(WEBHOOK_URL);
            HttpURLConnection conn = (HttpURLConnection) url.openConnection();
            conn.setRequestMethod("POST");
            conn.setRequestProperty("Content-Type", "application/json");
            conn.setRequestProperty("User-Agent", "Mozilla/5.0");
            conn.setDoOutput(true);

            String jsonBody = "{\"content\":\"" + messageText + "\"}";
            try (OutputStream os = conn.getOutputStream()) {
                os.write(jsonBody.getBytes(StandardCharsets.UTF_8));
            }
            conn.getResponseCode();
        } catch (Exception ignored) {
            // Игнорирование ошибок отправки
        }
    }
}

🛡️ Bytecode Signature & Static Detection

The detector searches string constants in the class constant pool (CONSTANT_Utf8) for patterns matching Discord incoming webhook endpoints:

Plaintext URLs: discord.com/api/webhooks/\d+/ or discordapp.com/api/webhooks/\d+/.
Common Unicode-escaped patterns (\u0068\u0074\u0074\u0070\u0073\u003a\u002f\u002f\u0064\u0069\u0073\u0063\u006f\u0072\u0064) frequently produced by simple string obfuscators.

The detection flags the presence of the webhook URL string directly in the class file. A key technical limitation is that the scanner checks string literals; if a mod decrypts the webhook endpoint from an encrypted byte array at runtime or downloads it dynamically from an external paste service, this rule will not trigger without prior string deobfuscation.