Penetration Testing

Chapter 12. Bypassing Antivirus Applications

Your pentesting clients will most likely be running some sort of antivirus solution. So far in this book we’ve avoided having any of our malicious executables deleted by antivirus applications, but antivirus program avoidance is a constantly changing field. Typically you will be more likely to avoid detection by using a memory-corruption exploit and loading your payload directly into memory—that is, by never touching the disk. That said, with the attack landscape shifting to emphasize client-side and social-engineering attacks, it may not always be possible to avoid writing your payload to disk. In this chapter we’ll look at a few techniques for obscuring our malware to try to avoid detection ...