Simulating the Target Environment
When preparing for an engagement, we ideally want to mirror the target system
in our local environment to verify the effectiveness of our tools.
However, even if we could predict the target environment,
re-creating it could be costly as we would have to purchase a variety of software licenses
Instead, we could test our payloads against multiple antivirus engines
at once with various online services.
The most popular service is VirusTotal,
which scans against more than fifty antivirus engines
The major disadvantage of this approach is that VirusTotal distributes
its findings with all associated antivirus vendors,
which may divulge your tools and techniques before you deploy them.
Alternatively, we could use AntiScan.Me,
which provides a similar virus scanning service without distributing the results.
However, this tool only scans against twenty-six antivirus engines
and only offers limited free scans per day
before requiring a reasonable per-scan paid registration.
With our use cases in mind, let’s move onward
to the first antivirus bypassing hurdle.