Malware on Steroids – Part 2: Evading Antivirus in a Simulated Organizational Environment

Recap In the previous post, we wrote a simple CMD Reverse Shell over TCP. However, in a real-life scenario, things would be pretty different. In this post, we will be focusing on Evading Antivirus and covering the following topics: Creating a Simulated Environment using Windows Active Directory, DNS, Proxy and Firewall. Writing C/C++ code for […]

UserAssist Revisited!

By Chetan Gupta, NII Consulting In my previous article on Userassist, I had mentioned how UserAssist records user access of specific objects on the system and how it would greatly aid forensic investigations. Although, I had shown how to decrypt the keys, the important thing that was missing was how to interpret the 16 bytes […]

The top 100 security tools

Penetration Testing Fyodor’s back with his top 100 security tools for 2006. One of the most significant, but not surprising, entries is that of Metasploit Framework at #5 on the list. Since the launch of the 2.0 series, Metasploit has become one of the most popular security tools out there. The 3.0 series is a […]


By Chetan Gupta, NII Consulting A supposedly nightmarish tool for the investigator community! Recently this tool was released at the metasploit anti-forensics site and is available here. Like the website mentions, this tool can be a headche for any forensic investigator and a handy tool for any mischevious since it has the ability to change […]