The script constantly loops, finds the closest enemy, moves your character onto it (clipping through parts), and sends a fake command to the server saying "I punched this dummy." More advanced scripts —they trick the server into thinking the client has permission to deal massive damage.
: Reaching specific blow counts unlocks new weapons, which help you defeat tougher dummies and bosses. Permanent vs. Map Weapons Beat Up Dummies Simulator Script