- One of the goals
of a Pentesting engagement is to maintain stealth
and try to evade and circumvent any
security controls that the organization may have in place.
There are several tools and techniques
that can be used for evasion.
We're going to cover a few here.
The first one is veal.
Veal is a framework that can be used with Metasploit.
To evade antivirus checks
and other security controls.
You can download veal at the GitHub repository
that I'm actually sharing in the screen.
Another tool that is used for evasion is Tor.
And many people actually use Tor for privacy.
It is a free tool that enables users
to serve the web anonymously.
Tor stands for the onion router.
Now Tor works by routing IP traffic
through a free worldwide network
consists of thousands of Tor relays.
It constantly changes the way that
it routes traffic in order to obscure
and user's location from anyone monitoring the network.
Now, some type of malware also use Tor
to cover their tracks, right?
That's actually a very popular by real attackers,
you know nowadays.
Now, Tor enables users to evade or
circumvent security monitoring
and control because it is actually very hard
to attribute and trace back the traffic to the user.
The Tor client actually encrypts the data
multiple times and that is censored
through a network or a circuit
that includes randomly selected Tor relays.
Then each of the relays decrypt a layer of the onion
to reveal only the next release.
So that they actually remaining,
you know, encrypted data can be routed through it.
Now here, I'm actually just showing the Tor Browser,
And you can see that the Tor
Browser actually,
communicate it to several nodes in this tours circuit
when the user actually access the art of hacking.org,
you know, from the Tor Browser.
Now one concept that I want you to know about Tor,
is the concept of a Tor exit node.
And a Tor exit node is
basically the last node or the gateway
where the Tor encrypted traffic exits to the internet.
Now at Tor exit node can be targeted to monitor it
Tor traffic in the organization.
So many organizations actually
blocked Tor exit nodes in their environment.
And even the Tor project has a
dynamic list of all the Tor exit nodes
that makes this tax a little bit easier
for people that actually just want to
Block tour.
Now another tool
that can be used for evasion is called proxy chains.
And proxy chains can be used for evasion
because it actually forces any TCP connection
that is made by a specific application
to use Tor or any others sucks for sucks
five HTTP or HTTPS proxies.
You can download proxy chains from the GitHub repository
that I'm highlighting in this screen.
Now one last evasion tool or technique
that I would like to actually highlight
is the use of encryption.
Now as you know,
encryption has great benefits for security and privacy.
But in the world of instant response
and forensics, it can actually present several challenges.
Even law enforcement agencies
have been actually fascinating with the
dual the nature of encryption.
Nowadays, threat actors use encryption as a
preferred method of evasion and obfuscation.
Most of the malware and
malicious communication
nowadays use some type of encryption