Try the reflection client: https://forum.moparscape.org/index.php?topic=551310.0
Most average and good servers would be guarded against this kind of attack, but I have found the odd and easy few to exploit with this. Typically they'll be <100 total member servers with a 13 year old server owner.
Basically, the way it works is that it will send a modified packet to the server saying that you should be having something. The vulnerable server would then accept that the packet is correct, and modify its own character data to reflect what you had said. For example, say you spawn a ore in a edgeville bank. ATM that is client sided, but let's say you mine that ore. Now the sent packet says "I mined this ore, and should receive a rock for this". The server would then modify its files so an ore would be located at that location (and depleted), and your character would have the rewarded rock.
A great fun to use (It says how to do this in the thread linked) is to spawn a bunch of webs, and slash them in a popular place!