Notice: As of 2024, the exploit has (mostly) been patched - sending invites with a spoofed skill group and country code is still possible, but won't fill the entire screen and will reveal the bot account!
This tool is used to send Counter-Strike lobby invites to any user currently playing the game. The tool is controlled with a custom Discord bot, supports multiple Steam accounts allowing multiple users to use the application simultaneously, as well as supports spoofing the skill group of the bot sending the invite as well as its location (country code).
The tool works by emulating a headless Counter-Strike game client and manually sending the network traffic packets (protobufs) used to connect to the internal Steam- & Counter-Strike Game Coordinator APIs, creating a lobby with the spoofed data and inviting users to said lobby.
Due to the tool directly communicating with the Game Coordinators, it allows any value to be provided and used due to a lack of data validation in the Coordinators. The key feature of this lack of validation is the possibility of adding Unicode characters to the lobby location, allowing the use of line break characters.
The lobby location is usually designed to be the two-letter country code of the person inviting, but due to the direct access to the Game Coordinators, it is possible to provide any value. By adding line break characters to this location, the in-game user interface when receiving invites expands vertically. This results in, with enough line breaks, the received invite filling up the entire screen, blocking the friend's list of the invitee and making it impossible to interact with the invite.
Due to the Looking to Play feature of Counter-Strike, which allows players to find people who they are not friends with and invite them to their lobby to play with, Counter-Strike is by default configured to receive and display lobby invitations from any user. This feature allows the tool to invite any user, as long as you have their steam64 ID. The tool includes a profile URL resolver to extract the steam64 ID from any profile URL or custom vanity ID.
I started development on this tool well over two years ago and have been keeping it for myself until now. I have over the years used this tool for personal use and have one time used it to invite every single actively playing CS:GO player. During this time I have been asked for access to the tool but recognized the tool could have the potential for harm if it got into the wrong hands (for example very convincing phishing).
As of 2024, the exploit has mostly been patched by Valve, making full-screen invites and therefore convincingly promoting links close to impossible, hence why the tool has been released.
- Node.js
- At least one PRIME (Premium) spare Counter-Strike account used as the invite bot
- A Discord application registered from the Discord Developer Portal with a:
- Application Bot Token
- Application Client ID
- A Steam Web API key
- A Discord server where your bot will run in
-
Clone the repository locally
-
Rename
.env-exampleto.envand fill in the required values:DISCORD_TOKEN: The login token of your Discord botDISCORD_CLIENT_ID: The Client ID of your Discord applicationSTEAM_API: Your Steam Web API keyDEVELOPMENT_GUILD_ID: The ID of your Discord server
-
Rename
bots-example.txttobots.txtand fill in the login information of your bot Steam accounts (one account per line). The format is as follows:-
If you have a Shared Secret (2FA code generator):
USERNAME:PASSWORD:SHARED_SECRET -
If you DON'T have a Shared Secret (requires inputting 2FA code on every restart if the account has Steam Guard enabled):
USERNAME:PASSWORD
-
-
Invite your Discord bot to your server (To avoid dealing with permission issues, make sure your bot has
Administratorprivileges when generating the invite URL) -
Install the required packages with
npm i -
Run the tool with
npm start
The bot currently only features two commands:
-
/generate-info: Generates an info embed showing a short explanation of the functionality and commands of the Discord bot. -
/invite [profile] [message] (rank) (time) (gamemode): Starts a new invite session with your parameters. The parameters are as follows:-
profile: The profile to invite. This can be a Steam64, vanity ID or profile URL -
message: The message to include in the invites (max 60 characters) -
rank: (Optional) The rank shown in the invite.- If the selected gamemode is Premiere, the rank will be shown as a CS Rating and goes between 1 - 99,999.
- If the selected gamemode is Wingman, the rank will show as the classic CS Skill Groups and goes between 1 - 18.
Defaults to CS Rating 99,999 (Premiere) or The Global Elite (Wingman)
-
time: (Optional) The time to invite for. Defaults to 5 minutes -
gamemode: (Optional) The gamemode of the rank. Defaults to Premiere
-
Despite myself never having gotten banned for using this for well over two years and having invited thousands of people, I cannot guarantee the same won't happen to you. This tool does not initialize VAC and therefore VAC-bans should not be possible, but manual bans (such as a Community Ban or a manual Game Ban) could still occur. Use this tool at your own risk and only use Steam bot accounts you would be willing to potentially lose.
Despite the tool automatically hiding the Steam bot account by making the name invisible and the location expanding making it impossible to interact with the invite (and see the account that is inviting you), it is still possible in a very unlikely scenario for somebody to dump the network packets and find your account.
Dumped protobufs are taken from the SteamDatabase Protobufs repository. If anything breaks it might be possible to update the provided protobufs with a newer version to fix the problem.