During a penetration test, establishing initial access often requires navigating around defensive technologies. This guide covers techniques for evading common security controls—like antivirus software, web application firewalls (WAF), and operating system protections—so you can simulate realistic, advanced threat scenarios.

The Evasion Mindset

The goal of the exploitation phase is not a noisy "smash and grab" attempt using every exploit available. Instead, you should aim for a precision strike.

Whenever possible, enumerate the target's countermeasures before launching an exploit. By understanding whether you are facing a Host-Based Intrusion Prevention System (HIPS), a WAF, or standard antivirus, you can tailor your attack vector for the highest probability of success while remaining stealthy.

flowchart TD
    A["Identify Target Asset"] --> B{"Countermeasure Present?"}
    B -- "Yes" --> C["Enumerate Control (AV, WAF, OS)"]
    B -- "No" --> D["Deploy Standard Exploit"]
    C --> E["Select Evasion Technique"]
    E --> F["Test in Local Lab"]
    F --> G["Execute Precision Strike"]

Evading Anti-Virus and EDR

Anti-virus (AV) and Endpoint Detection and Response (EDR) platforms look for known malicious signatures and behaviors. To bypass these, you need to alter how your payload looks or how it executes.

Payload Obfuscation

Altering the payload on disk is the most common way to evade basic signature detection.

Memory-Resident Attacks

Writing files to a disk is risky because it triggers file-system scans. The most effective evasion strategies avoid the disk entirely.

• Purely Memory Resident: By executing your payload directly in memory, you bypass the majority of traditional AV scanners that only inspect files written to the hard drive.

• Process Injection: This involves injecting your malicious code into an already running, legitimate process (like explorer.exe). This hides your activity within a trusted application, making it difficult for defensive tools to spot the anomaly.

• Whitelist Bypass: Many environments only allow pre-approved applications to run. Because whitelisting tools rarely monitor real-time memory space, memory-resident payloads or process injection can often bypass these restrictions.

Bypassing Operating System Protections

Modern operating systems include built-in safeguards to prevent malicious code execution. You will frequently encounter these two protections during buffer overflow or memory corruption exploits:

1. Data Execution Prevention (DEP): Prevents code from being executed in certain areas of memory (like the stack). If you overwrite memory and try to execute your shellcode, DEP will stop it.

2. Address Space Layout Randomization (ASLR): Randomizes the memory locations of application components, making it incredibly difficult to hardcode memory addresses in your exploits.

Customizing Public Exploits

Exploits found on public databases rarely work perfectly out of the box. An exploit written for Windows XP SP2 will likely crash a Windows XP SP3 machine due to changing memory addresses.

To ensure success and avoid crashing the target service, you must tailor your exploits:

1. 1

   Replicate the Target Environment

   Set up a local virtual machine that matches the target's operating system, service pack, and installed applications as closely as possible.

2. 2

   Analyze the Public Exploit

   Review the exploit code to understand how it triggers the vulnerability and what memory addresses it relies on.

3. 3

   Adjust Memory Offsets

   Using a debugger in your lab environment, find the correct memory addresses (such as the JMP ESP instruction) for your specific target version and update the exploit code.

4. 4

   Swap the Payload

   Replace the default payload (which might just open a calculator) with your preferred evasion payload, such as a reverse shell encoded to bypass the target's AV.

Alternative Attack Vectors

Sometimes the easiest way past a firewall is to not go through it at all. If direct technical exploitation is too risky or heavily defended, consider alternative avenues.