There are many ways to do hitboxes (like what the others have mentioned), but what I usually use is raycasting due to its performance and precision.
If you were to use raycasting, I suggest using modules like ClientCast (client-side hits, better for user experience – the exploitability and ways to circumvent it can be read in the post) or RaycastHitbox4.01 (good ol’ serverside, trades user experience for safety)
But then again, raycasting isn’t a one size fits all answer – depends on your usecase.