Skip to main content


During assessment if you know which Anti virus is used by client then you won half battle.Because you can download trial version of that AV & install it in virtual box & try to bypass that AV. So during real assessment your payload or binary don`t get caught.Today we gonna try to detect if client has installed avast or not?

Original video is posted here. In avast their is feature of site blocking ; so if you want to block any site you can put its address in block url section of avast interface.when someone load that site they get response as shown in below image.

In above image you can see that avast logo which address is localhost:12080/$$avast-webshield$$/image001.png . So if in client machine avast is installed than that image is also located at that address , by examine image is exist or not we can know that whether avast is installed or not.

For this purpose victim should visit  our link where we can check about image.So i am gonna use my apache server ; where i put three html page. One is our link which we gonna send to victim ; if image exist it redirect to other document ; & if image does not exist it redirect to third html page.

(1)Make blank html page & give it to name avst.html & put following code in that html page.

<meta http-equiv="refresh" content="0; url=">

(2)Now make second html page & give it to name ntavst.html & put same code in that page. 

<meta http-equiv="refresh" content="0; url=">

(3)Make third & final html page and give it to name exp.html & put following code.

<div dir="ltr" style="text-align: left;" trbidi="on">

<img src="$$avast-webshield$$"/image001.png" onload="document.location=''" onerror="document.location=''" />

Note:- Change your i.p in above code.

Now put these all document in /var/www/ folder.And send link of exp.html to victim

So if avast installed then it redirect to avast.html page & finally redirect to & if it does not installed then it will redirect to ntavst.html page & then redirect to

Now check your apache been visited or ntavst.html page.log file from \var\log\apache2\log ; you can check if avst.html page has 

PS: You can use cobalt strike `s system profiler which get you os version;  browser detail; java version ; adobe reader  version & flash version.


Popular posts from this blog

How to restrict access to files/folders using cmd

Hello friends! You might have many software on the internet which is used to lock the files and folders. Also you might have seen batch programs that also does the same job. Today I am going to tell you a basic cmd command that can be used to restrict access to files and folders. You must have administrative access for doing this.

Open websites using command prompt

Have you ever tried to open websites through command prompt in Windows......Yes it is possible to open a website through command prompt. There are many ways which i will discuss today....


Today we are gonna talk about Veil-Catapult.Veil-Catapult is payload delivery for when metasploit’s psexec getting caught by AV.It utilizes Veil-Evasion to generate AV-evading binaries, impacket to upload/host the binaries, and the passing-the-hash toolkit to trigger execution.It officially supported on kali linux only.I`m going to show you how to install Veil-Catapult in backtrack?