One of the biggest challenges that a penetration tester can face is antivirus evasion.
The payloads that you generate in the previous section are for learning purposes, right?
So I don't care about you being caught by antivirus software.
In fact, that might even mean you did it right.
However, in a real penetration test, if your payload is detected, then it is going to be useless
and sometimes as embarrassing and it makes it look like you have no idea what you're doing.
So on this section, I'm going to explain some concepts and some solutions that will remove antivirus
is from ever being an issue.
Now, this is very cool.
So most antivirus software use signature based detection engines to verify if a file on disk is malicious
or not.
So basically, AV software scans the storage and compares a signature of a suspicious file with its
signature database.
And of course, if a match is found, then Avy Alert's and marks that object to take certain steps against.
And basically, that's how antivirus software works.
But the system doesn't fit.
It has scaling problems, and if there's no match for a signature, a malicious program won't encounter
any protection mechanism.
As you might imagine, this method is not good enough to trust 100 percent.
Antivirus companies also think that so they'll invest in many new methods, create new products, use
EHI machine learning, everything they can throw at it.
However, most of them still work this way.
Now, do you remember what we were saying earlier about M�tis Boit payloads?
They're basically designed to run in memory, so they never write data to the disk.
So when you send a payload using an export, most antivirus programs won't even detect that has been
run on the target.
However, during a compromise, you're often going to perform certain actions that will modify, add
or delete files on the targets file system, so that already implies that your actions can be traced
and detected by antivirus software.
So you're just going to need to be a little stealthier by playing in a different way to beat those antivirus.