lscript - The LAZY script will make your life easier, and of course faster.

•    Shell

---

I AM NOT RESPONSIBLE HOW YOU USE THIS TOOL.BE LEGAL AND NOT STUPID. This script will make your life easier, and of course faster.

kali-scripts kali-linux shell-script payload-generator payload wifi-testing penetration-testing pentesting pentest-tool wifi-password wpa2-handshake wpa-cracker pixie-dust metasploit-framework eternalblue-doublepulsar-metasploit wifiphisher antivirus-evasion bypass-av bypass-antivirus sqlinjection

Veil-Evasion - Veil Evasion is no longer supported, use Veil 3.0!

•    Python

---

Veil-Evasion is a tool designed to generate metasploit payloads that bypass common anti-virus solutions. NOTE: ./setup/setup.sh should be re-run on every major version update. If you receive any major errors on running Veil-Evasion, first try re-running this script to install any additional packages and update the common configuration file.

veil-evasion antivirus antivirus-evasion veil

SpookFlare - Loader, dropper generator with multiple features for bypassing client-side and network-side countermeasures

•    Python

---

SpookFlare has a different perspective to bypass security measures and it gives you the opportunity to bypass the endpoint countermeasures at the client-side detection and network-side detection. SpookFlare is a loader/dropper generator for Meterpreter, Empire, Koadic etc. SpookFlare has obfuscation, encoding, run-time code compilation and character substitution features. So you can bypass the countermeasures of the target systems like a boss until they "learn" the technique and behavior of SpookFlare payloads. Special thanks to the following projects and contributors.

av-bypass loader dropper av-evasion endpoint-bypass antivirus-evasion antivirus-testing obfuscation bypass

rustdsplit - At some point, I learned about a method to perform a binary search on a file in order to identify its AV signature and change it to bypass signature-based AV

•    Rust

---

Several years ago, the tool "DSplit" was released by class101 which was used to demonstrate how some AV signatures could be bypassed by finding and modifying one byte within the binary. Unfortunately, the original file (and source code?) is no longer available for download by the author. During OSCE's AV bypass module, I recalled learning about the method described in the linked post and using DSplit to bypass signature based AV detection. I wanted to play around with it using the OSCE labs. I proceeded to search for DSplit and came to the same conclusion as the above author, what can be found looks rather janky.

antivirus ctp antivirus-evasion osce osce-prep