Advanced Techniques in Offensive Security
Discover advanced offensive security techniques such as AV evasion, payload testing, encoding, and more. Learn about tools, code caves, Metasploit evasion modules, and bypass methods. Stay ahead in the world of cybersecurity with these strategies.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
You are allowed to download the files provided on this website for personal or commercial use, subject to the condition that they are used lawfully. All files are the property of their respective owners.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author.
E N D
Presentation Transcript
AV Evasion Offensive Security
AV Many different vendors Signature, Heuristic, Behavioral, Cloud based Testing against known samples Cloud String detection Offensive Security Running code URL/IP Reputation 2
Testing Payloads Check if payloads are caught prior to pushing to target Local setup Online tools Yara VirusTotal BE AWARE!! Network connection with local Online services Offensive Security YOU NO LONGER CONTROL THAT DATA 3
Old School Back in the day Different types of encoding would bypass AV Offensive Security Not anymore 4
Techniques Encoding Encrypting Killing AV process/Disable service Changing functionality Changing how a function is called Direct call vs Pointer to function Offensive Security 5
Techniques DLL vs EXE Reflectively loading Script payloads Custom code Code caves Anti-emulation Offensive Security Many more 6
Tools Popular Veil AVET SpookFlare Syringe CradleCrafter Shellter Etc.. Offensive Security More on Github Custom? 7
Code Caves Unused place in program Large series of null bytes Backdoor Factory Takes normal binaries and places shellcode in them Offensive Security 8
Metasploit Evasion Modules New evasion modules Announced Derbycon 2018 Support for authors to build new modules Offensive Security 9
Other Bypasses Required? Windows Anti-malware scan interface (AMSI) Application Whitelisting Offensive Security 10
