[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Guide for authors 📝 - Images and links?

[Assistant]
As simple as title for links and ![](path/to/image) for images.

> [!TIP]
> If there are spaces in the image path, either spaces need to be URL-encded (%20), or the following structure can be used (recommended):
> ![](<path/to/some image>)

Images can also be given a caption

``markdown
![](path/to/image)
Some caption{.caption}
`
Which will output the following

![](https://developers.elementor.com/docs/assets/img/elementor-placeholder-image.png)
Some caption{.caption}

To embed a YouTube link, use the following tag format:

`
> [!YOUTUBE] https://www.youtube.com/watch?v=example
``

This will create a clickable link that directs users to the specified YouTube video.

Which will output the following

> [!YOUTUBE] https://www.youtube.com/watch?v=dQw4w9WgXcQ

> [!WARNING]
> Ensure you provide the full YouTube link, as using a shortened link will cause the tag to malfunction.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Guide for authors 📝 - Images and links?

Response:
As simple as title for links and ![](path/to/image) for images.

> [!TIP]
> If there are spaces in the image path, either spaces need to be URL-encded (%20), or the following structure can be used (recommended):
> ![](<path/to/some image>)

Images can also be given a caption

``markdown
![](path/to/image)
Some caption{.caption}
`
Which will output the following

![](https://developers.elementor.com/docs/assets/img/elementor-placeholder-image.png)
Some caption{.caption}

To embed a YouTube link, use the following tag format:

`
> [!YOUTUBE] https://www.youtube.com/watch?v=example
``

This will create a clickable link that directs users to the specified YouTube video.

Which will output the following

> [!YOUTUBE] https://www.youtube.com/watch?v=dQw4w9WgXcQ

> [!WARNING]
> Ensure you provide the full YouTube link, as using a shortened link will cause the tag to malfunction.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Guide for authors 📝 - Images and links?

[Assistant] > [!YOUTUBE] https://www.youtube.com/watch?v=example

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Guide for authors 📝 - Images and links?

Response: > [!YOUTUBE] https://www.youtube.com/watch?v=example


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `> [!YOUTUBE] https://www.youtube.com/watch?v=example`?

[Assistant] This command is used for guide for authors 📝 - images and links. Images and links

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `> [!YOUTUBE] https://www.youtube.com/watch?v=example`?

Response: This command is used for guide for authors 📝 - images and links. Images and links


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Guide for authors 📝 - Others

[Assistant]
| Block                                                              | Description                                             |
|--------------------------------------------------------------------|---------------------------------------------------------|
| Links                | Internal links (to other articles, or to anchor points) |
| Tables | Tables (like this one)                                  |
| Emojis               | Emojis :tada:                                           |

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
| Block                                                              | Description                                             |
|--------------------------------------------------------------------|---------------------------------------------------------|
| Links                | Internal links (to other articles, or to anchor points) |
| Tables | Tables (like this one)                                  |
| Emojis               | Emojis :tada:                                           |


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out Guide for authors 📝 - Others during a pentest?

[Assistant]
| Block                                                              | Description                                             |
|--------------------------------------------------------------------|---------------------------------------------------------|
| Links                | Internal links (to other articles, or to anchor points) |
| Tables | Tables (like this one)                                  |
| Emojis               | Emojis :tada:                                           |

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out Guide for authors 📝 - Others during a pentest?

Response:
| Block                                                              | Description                                             |
|--------------------------------------------------------------------|---------------------------------------------------------|
| Links                | Internal links (to other articles, or to anchor points) |
| Tables | Tables (like this one)                                  |
| Emojis               | Emojis :tada:                                           |


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does Guide for authors 📝 - Quotes work?

[Assistant]
> "Someone said something important and it should be highlighted in the article? Please quote it and attribute it to the initial author."
>
> _(Author, date, source)_

``markdown
> "Someone said something important and it should be highlighted in the article? Please quote it and attribute it to the initial author."
>
> _(Author, date, source)_
``

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does Guide for authors 📝 - Quotes work?

Response:
> "Someone said something important and it should be highlighted in the article? Please quote it and attribute it to the initial author."
>
> _(Author, date, source)_

``markdown
> "Someone said something important and it should be highlighted in the article? Please quote it and attribute it to the initial author."
>
> _(Author, date, source)_
``


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Guide for authors 📝 - Quotes?

[Assistant]
> "Someone said something important and it should be highlighted in the article? Please quote it and attribute it to the initial author."
>
> _(Author, date, source)_

``markdown
> "Someone said something important and it should be highlighted in the article? Please quote it and attribute it to the initial author."
>
> _(Author, date, source)_
``

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Guide for authors 📝 - Quotes?

Response:
> "Someone said something important and it should be highlighted in the article? Please quote it and attribute it to the initial author."
>
> _(Author, date, source)_

``markdown
> "Someone said something important and it should be highlighted in the article? Please quote it and attribute it to the initial author."
>
> _(Author, date, source)_
``


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Guide for authors 📝 - Article template?

[Assistant] An article template is available for a quick start: Template.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is Guide for authors 📝 - Article template?

Response: An article template is available for a quick start: Template.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Guide for authors 📝 - Article template

[Assistant] An article template is available for a quick start: Template.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Guide for authors 📝 - Article template

Response: An article template is available for a quick start: Template.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Guide for authors 📝 - Highlighting contributors?

[Assistant]
For contributors to be listed, they need to be listed in the authors property of the frontmatter configuration of the corresponding page(s).

When contributing to a page, an author must add its GitHub username to it:

``markdown
---
authors: author1, author2, ...
---
``

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Guide for authors 📝 - Highlighting contributors?

Response:
For contributors to be listed, they need to be listed in the authors property of the frontmatter configuration of the corresponding page(s).

When contributing to a page, an author must add its GitHub username to it:

``markdown
---
authors: author1, author2, ...
---
``


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How do I perform Guide for authors 📝 - Highlighting contributors?

[Assistant]
For contributors to be listed, they need to be listed in the authors property of the frontmatter configuration of the corresponding page(s).

When contributing to a page, an author must add its GitHub username to it:

``markdown
---
authors: author1, author2, ...
---
``

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How do I perform Guide for authors 📝 - Highlighting contributors?

Response:
For contributors to be listed, they need to be listed in the authors property of the frontmatter configuration of the corresponding page(s).

When contributing to a page, an author must add its GitHub username to it:

``markdown
---
authors: author1, author2, ...
---
``


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain Guide for authors 📝 - Category attribute

[Assistant]
It is mandatory to specify the category of the article in the frontmatter configuration of the page (it can be ad, infra, web, etc.).

``markdown
---
category: ad
---
``

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Explain Guide for authors 📝 - Category attribute

Response:
It is mandatory to specify the category of the article in the frontmatter configuration of the page (it can be ad, infra, web, etc.).

``markdown
---
category: ad
---
``


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for Guide for authors 📝 - Category attribute

[Assistant]
It is mandatory to specify the category of the article in the frontmatter configuration of the page (it can be ad, infra, web, etc.).

``markdown
---
category: ad
---
``

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for Guide for authors 📝 - Category attribute

Response:
It is mandatory to specify the category of the article in the frontmatter configuration of the page (it can be ad, infra, web, etc.).

``markdown
---
category: ad
---
``


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Guide for authors 📝 - Variable commands?

[Assistant] When adding or editing content, please use the standardized variable names listed above to ensure a consistent experience across all documentation pages for variable commands

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is Guide for authors 📝 - Variable commands?

Response: When adding or editing content, please use the standardized variable names listed above to ensure a consistent experience across all documentation pages for variable commands


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute Guide for authors 📝 - Variable commands?

[Assistant] When adding or editing content, please use the standardized variable names listed above to ensure a consistent experience across all documentation pages for variable commands

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute Guide for authors 📝 - Variable commands?

Response: When adding or editing content, please use the standardized variable names listed above to ensure a consistent experience across all documentation pages for variable commands


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about Guide for authors 📝 - Variable Naming Standards?

[Assistant]
| Use This          | Instead Of                                      |
|-------------------|------------------------------------------------|
| $NT_HASH        | $NThash, $nthash, $Nthash                |
| $LM_HASH        | $LMhash, $lmhash, $Lmhash                |
| $ATTACKER_IP    | $attackerIP, $attacker_ip, $LHOST        |
| $TARGET         | $TARGET_IP, $targetIP, $target_ip        |
| $DOMAIN         | $domain, $DOMAIN_NAME                      |
| $DC_IP          | $dc_ip, $dcIP, $domainController         |
| $USER           | $user, $username, $USER_NAME             |
| $INTERFACE      | $interface, $network_interface             |

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about Guide for authors 📝 - Variable Naming Standards?

Response:
| Use This          | Instead Of                                      |
|-------------------|------------------------------------------------|
| $NT_HASH        | $NThash, $nthash, $Nthash                |
| $LM_HASH        | $LMhash, $lmhash, $Lmhash                |
| $ATTACKER_IP    | $attackerIP, $attacker_ip, $LHOST        |
| $TARGET         | $TARGET_IP, $targetIP, $target_ip        |
| $DOMAIN         | $domain, $DOMAIN_NAME                      |
| $DC_IP          | $dc_ip, $dcIP, $domainController         |
| $USER           | $user, $username, $USER_NAME             |
| $INTERFACE      | $interface, $network_interface             |


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for Guide for authors 📝 - Variable Naming Standards?

[Assistant]
| Use This          | Instead Of                                      |
|-------------------|------------------------------------------------|
| $NT_HASH        | $NThash, $nthash, $Nthash                |
| $LM_HASH        | $LMhash, $lmhash, $Lmhash                |
| $ATTACKER_IP    | $attackerIP, $attacker_ip, $LHOST        |
| $TARGET         | $TARGET_IP, $targetIP, $target_ip        |
| $DOMAIN         | $domain, $DOMAIN_NAME                      |
| $DC_IP          | $dc_ip, $dcIP, $domainController         |
| $USER           | $user, $username, $USER_NAME             |
| $INTERFACE      | $interface, $network_interface             |

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for Guide for authors 📝 - Variable Naming Standards?

Response:
| Use This          | Instead Of                                      |
|-------------------|------------------------------------------------|
| $NT_HASH        | $NThash, $nthash, $Nthash                |
| $LM_HASH        | $LMhash, $lmhash, $Lmhash                |
| $ATTACKER_IP    | $attackerIP, $attacker_ip, $LHOST        |
| $TARGET         | $TARGET_IP, $targetIP, $target_ip        |
| $DOMAIN         | $domain, $DOMAIN_NAME                      |
| $DC_IP          | $dc_ip, $dcIP, $domainController         |
| $USER           | $user, $username, $USER_NAME             |
| $INTERFACE      | $interface, $network_interface             |


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of Guide for authors 📝 - Implementation Tips

[Assistant]
1. When updating documentation, standardize any variable names you encounter
2. Use ALL_CAPS with underscore separators for all variables
3. For tool-specific variables, maintain consistency with our naming convention
4. Include brief comments when introducing new variables
5. Variables must be prefixed with $ to be recognized by our substitution system

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of Guide for authors 📝 - Implementation Tips

Response:
1. When updating documentation, standardize any variable names you encounter
2. Use ALL_CAPS with underscore separators for all variables
3. For tool-specific variables, maintain consistency with our naming convention
4. Include brief comments when introducing new variables
5. Variables must be prefixed with $ to be recognized by our substitution system


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on Guide for authors 📝 - Implementation Tips

[Assistant]
1. When updating documentation, standardize any variable names you encounter
2. Use ALL_CAPS with underscore separators for all variables
3. For tool-specific variables, maintain consistency with our naming convention
4. Include brief comments when introducing new variables
5. Variables must be prefixed with $ to be recognized by our substitution system

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on Guide for authors 📝 - Implementation Tips

Response:
1. When updating documentation, standardize any variable names you encounter
2. Use ALL_CAPS with underscore separators for all variables
3. For tool-specific variables, maintain consistency with our naming convention
4. Include brief comments when introducing new variables
5. Variables must be prefixed with $ to be recognized by our substitution system


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is Guide for authors 📝 - Get started :rocket:?

[Assistant]
1. Fork the repository (https://github.com/The-Hacker-Recipes/The-Hacker-Recipes/fork)
2. (optional) create a new branch in your fork, if you plan on working on different topics
3. Create your content using this guide, and the template if needed
4. Make sure the content builds fine with npm install && npm run docs:dev
5. Make a Pull Request (https://github.com/The-Hacker-Recipes/The-Hacker-Recipes/compare)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is Guide for authors 📝 - Get started :rocket:?

Response:
1. Fork the repository (https://github.com/The-Hacker-Recipes/The-Hacker-Recipes/fork)
2. (optional) create a new branch in your fork, if you plan on working on different topics
3. Create your content using this guide, and the template if needed
4. Make sure the content builds fine with npm install && npm run docs:dev
5. Make a Pull Request (https://github.com/The-Hacker-Recipes/The-Hacker-Recipes/compare)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do Guide for authors 📝 - Get started :rocket:

[Assistant]
1. Fork the repository (https://github.com/The-Hacker-Recipes/The-Hacker-Recipes/fork)
2. (optional) create a new branch in your fork, if you plan on working on different topics
3. Create your content using this guide, and the template if needed
4. Make sure the content builds fine with npm install && npm run docs:dev
5. Make a Pull Request (https://github.com/The-Hacker-Recipes/The-Hacker-Recipes/compare)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do Guide for authors 📝 - Get started :rocket:

Response:
1. Fork the repository (https://github.com/The-Hacker-Recipes/The-Hacker-Recipes/fork)
2. (optional) create a new branch in your fork, if you plan on working on different topics
3. Create your content using this guide, and the template if needed
4. Make sure the content builds fine with npm install && npm run docs:dev
5. Make a Pull Request (https://github.com/The-Hacker-Recipes/The-Hacker-Recipes/compare)


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Explain 🛠 Dropper

[Assistant]
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

As for the loader, it is also possible to make a simple one, but the more complex it is, the more likely it is that the anti-virus will not see it

Knowing that an anti-virus compares the signature of our program and the signature of the functions with those of the malware, it is up to the attacker to use his imagination to disguise his program.

In the example below, the anti-virus will raise an alert:

``cpp
static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}
`

But, if a sub function is added to create a thread as follow:

`cpp
static void CRT()
{
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 CRT()
}
``

By using the previous source code the anti-virus will have more difficulty to understand what is happening. The Russian doll technique can be a good trick to hide a malicious function.

> [!CAUTION]
> The fact of compiling several times will not give us a new signature, only the modification of the code has an impact

> [!CAUTION]
> Once the binary is ready to be executed, access to the internet should be cut in the test environment in order not to send the signature of the bypass to Microsoft or to the editor.

To optimize the probability

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

As for the loader, it is also possible to make a simple one, but the more complex it is, the more likely it is that the anti-virus will not see it

Knowing that an anti-virus compares the signature of our program and the signature of the functions with those of the malware, it is up to the attacker to use his imagination to disguise his program.

In the example below, the anti-virus will raise an alert:

``cpp
static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}
`

But, if a sub function is added to create a thread as follow:

`cpp
static void CRT()
{
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 CRT()
}
``

By using the previous source code the anti-virus will have more difficulty to understand what is happening. The Russian doll technique can be a good trick to hide a malicious function.

> [!CAUTION]
> The fact of compiling several times will not give us a new signature, only the modification of the code has an impact

> [!CAUTION]
> Once the binary is ready to be executed, access to the internet should be cut in the test environment in order not to send the signature of the bypass to Microsoft or to the editor.

To optimize the probability


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute 🛠 Dropper?

[Assistant]
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

As for the loader, it is also possible to make a simple one, but the more complex it is, the more likely it is that the anti-virus will not see it

Knowing that an anti-virus compares the signature of our program and the signature of the functions with those of the malware, it is up to the attacker to use his imagination to disguise his program.

In the example below, the anti-virus will raise an alert:

``cpp
static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}
`

But, if a sub function is added to create a thread as follow:

`cpp
static void CRT()
{
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 CRT()
}
``

By using the previous source code the anti-virus will have more difficulty to understand what is happening. The Russian doll technique can be a good trick to hide a malicious function.

> [!CAUTION]
> The fact of compiling several times will not give us a new signature, only the modification of the code has an impact

> [!CAUTION]
> Once the binary is ready to be executed, access to the internet should be cut in the test environment in order not to send the signature of the bypass to Microsoft or to the editor.

To optimize the probability

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

As for the loader, it is also possible to make a simple one, but the more complex it is, the more likely it is that the anti-virus will not see it

Knowing that an anti-virus compares the signature of our program and the signature of the functions with those of the malware, it is up to the attacker to use his imagination to disguise his program.

In the example below, the anti-virus will raise an alert:

``cpp
static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}
`

But, if a sub function is added to create a thread as follow:

`cpp
static void CRT()
{
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 CRT()
}
``

By using the previous source code the anti-virus will have more difficulty to understand what is happening. The Russian doll technique can be a good trick to hide a malicious function.

> [!CAUTION]
> The fact of compiling several times will not give us a new signature, only the modification of the code has an impact

> [!CAUTION]
> Once the binary is ready to be executed, access to the internet should be cut in the test environment in order not to send the signature of the bypass to Microsoft or to the editor.

To optimize the probability


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the static command to 🛠 dropper

[Assistant]
static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Response:
static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for 🛠 Dropper

[Assistant]
static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for 🛠 Dropper

Response:
static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `static void Main(string[] args)`?

[Assistant] This command is used for 🛠 dropper. 🛠 Dropper

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `static void Main(string[] args)`?

Response: This command is used for 🛠 dropper. 🛠 Dropper


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the static command to 🛠 dropper

[Assistant]
static void CRT()
{
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 CRT()
}

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Response:
static void CRT()
{
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 CRT()
}


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for 🛠 Dropper?

[Assistant]
static void CRT()
{
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 CRT()
}

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
static void CRT()
{
 IntPtr hThread = CreateRemoteThread(MyTests, xxxxxx);
}

static void Main(string[] args)
{
 byte[] buf = new byte[xxx]{ 0x27, 0x3B, 0x38, 0x7D, 0xF4, 0x44 }
 IntPtr MyTests = OpenProcess(PROCESS_ALL_ACCESS, false, processId);
 IntPtr addr = VirtualAllocEx(MyTests, IntPtr.Zero, (uint)buf.Length, (MEM_RESERVE | MEM_COMMIT), PAGE_EXECUTE_READWRITE);
 WriteProcessMemory(MyTests,xxxxx);
 CRT()
}


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `static void CRT()`?

[Assistant] This command is used for 🛠 dropper. 🛠 Dropper

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `static void CRT()`?

Response: This command is used for 🛠 dropper. 🛠 Dropper


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of (AV) Anti-Virus - Theory

[Assistant]
Most of the anti-virus vendors do not communicate much about the rules they put in place to block malicious software. Consequently, there are 3 main possible options to understand the underground process of an anti-virus:

1. reverse the anti-virus binary
2. search on the internet if there are any open source AVs that implement certain rules
3. do regular monitoring

Nevertheless, here is a list of known techniques used by anti-viral protections on the market:

* Static analysis: analysis of instructions and control statements in the code to detect known malware signatures.
* Dynamic analysis: code execution in a virtual environment to detect suspicious behavior.
* Heuristics: analysis of code characteristics to detect suspicious behavior.
* Sandboxing: execution of code in a virtual environment to detect suspicious behavior.
* Signature checking: comparison of suspicious files signature with a database of known malware signatures.
* Fingerprinting: comparison of suspicious files with a database of known malware fingerprints.
* Behavioral check: analysis of suspicious behavior of the executed code.
* Network monitoring: analysis of suspicious network communications.
* URL control: analysis of suspicious URLs.
* File control: analysis of suspicious files.

> [!CAUTION]
> Some AVs have a browser extension that parses the html code for malicious code, be careful during red team operations

> [!TIP]
> Moreover, depending on the anti-virus installed on the victim's computer, it is possible that some techniques do not work and others do.
>
> Therefore, it is strongly advised to set up a virtual machine as close as possible to the victim's computer.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of (AV) Anti-Virus - Theory

Response:
Most of the anti-virus vendors do not communicate much about the rules they put in place to block malicious software. Consequently, there are 3 main possible options to understand the underground process of an anti-virus:

1. reverse the anti-virus binary
2. search on the internet if there are any open source AVs that implement certain rules
3. do regular monitoring

Nevertheless, here is a list of known techniques used by anti-viral protections on the market:

* Static analysis: analysis of instructions and control statements in the code to detect known malware signatures.
* Dynamic analysis: code execution in a virtual environment to detect suspicious behavior.
* Heuristics: analysis of code characteristics to detect suspicious behavior.
* Sandboxing: execution of code in a virtual environment to detect suspicious behavior.
* Signature checking: comparison of suspicious files signature with a database of known malware signatures.
* Fingerprinting: comparison of suspicious files with a database of known malware fingerprints.
* Behavioral check: analysis of suspicious behavior of the executed code.
* Network monitoring: analysis of suspicious network communications.
* URL control: analysis of suspicious URLs.
* File control: analysis of suspicious files.

> [!CAUTION]
> Some AVs have a browser extension that parses the html code for malicious code, be careful during red team operations

> [!TIP]
> Moreover, depending on the anti-virus installed on the victim's computer, it is possible that some techniques do not work and others do.
>
> Therefore, it is strongly advised to set up a virtual machine as close as possible to the victim's computer.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through (AV) Anti-Virus - Theory

[Assistant]
Most of the anti-virus vendors do not communicate much about the rules they put in place to block malicious software. Consequently, there are 3 main possible options to understand the underground process of an anti-virus:

1. reverse the anti-virus binary
2. search on the internet if there are any open source AVs that implement certain rules
3. do regular monitoring

Nevertheless, here is a list of known techniques used by anti-viral protections on the market:

* Static analysis: analysis of instructions and control statements in the code to detect known malware signatures.
* Dynamic analysis: code execution in a virtual environment to detect suspicious behavior.
* Heuristics: analysis of code characteristics to detect suspicious behavior.
* Sandboxing: execution of code in a virtual environment to detect suspicious behavior.
* Signature checking: comparison of suspicious files signature with a database of known malware signatures.
* Fingerprinting: comparison of suspicious files with a database of known malware fingerprints.
* Behavioral check: analysis of suspicious behavior of the executed code.
* Network monitoring: analysis of suspicious network communications.
* URL control: analysis of suspicious URLs.
* File control: analysis of suspicious files.

> [!CAUTION]
> Some AVs have a browser extension that parses the html code for malicious code, be careful during red team operations

> [!TIP]
> Moreover, depending on the anti-virus installed on the victim's computer, it is possible that some techniques do not work and others do.
>
> Therefore, it is strongly advised to set up a virtual machine as close as possible to the victim's computer.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through (AV) Anti-Virus - Theory

Response:
Most of the anti-virus vendors do not communicate much about the rules they put in place to block malicious software. Consequently, there are 3 main possible options to understand the underground process of an anti-virus:

1. reverse the anti-virus binary
2. search on the internet if there are any open source AVs that implement certain rules
3. do regular monitoring

Nevertheless, here is a list of known techniques used by anti-viral protections on the market:

* Static analysis: analysis of instructions and control statements in the code to detect known malware signatures.
* Dynamic analysis: code execution in a virtual environment to detect suspicious behavior.
* Heuristics: analysis of code characteristics to detect suspicious behavior.
* Sandboxing: execution of code in a virtual environment to detect suspicious behavior.
* Signature checking: comparison of suspicious files signature with a database of known malware signatures.
* Fingerprinting: comparison of suspicious files with a database of known malware fingerprints.
* Behavioral check: analysis of suspicious behavior of the executed code.
* Network monitoring: analysis of suspicious network communications.
* URL control: analysis of suspicious URLs.
* File control: analysis of suspicious files.

> [!CAUTION]
> Some AVs have a browser extension that parses the html code for malicious code, be careful during red team operations

> [!TIP]
> Moreover, depending on the anti-virus installed on the victim's computer, it is possible that some techniques do not work and others do.
>
> Therefore, it is strongly advised to set up a virtual machine as close as possible to the victim's computer.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about (AV) Anti-Virus - Droppers, loaders, stagers, handlers?

[Assistant]
When working with malwares, the are multiple components that have specific tasks. These components usually allow for better antivirus evasion and/or easier control over the malware's behavior (e.g. being able to control it from a Command & Control).

| Component | Role |
| --- | --- |
| Dropper | Download/deliver a malicious payload to the victim's computer.Once the dropper has successfully installed the malware on the victim's computer, it may also attempt to establish a persistent presence on the system, such as by adding registry entries or creating hidden files. |
| Loader | Load another program or code into memory. Often used to load the main payload of the malware into memory, after which the payload can execute and carry out its activities.Will often implement process injection techniques to inject the malicious code (i.e. shellcode) into a legitimate process running on a victim's system, with the intention of evading antivirus and other security solutions. |
| Stager | Type of loader that loads the main payload of a malware program in multiple stages. Initial stage usually small and responsible for downloading additional stages of the malware from a remote server, or hiding the subsequent stages within the system. |
| Handler | Receive and execute commands from a command and control (C&C) server. |

> [!TIP]
> Simple malwares can sometimes merge the dropper and loader parts into a single piece.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What should I know about (AV) Anti-Virus - Droppers, loaders, stagers, handlers?

Response:
When working with malwares, the are multiple components that have specific tasks. These components usually allow for better antivirus evasion and/or easier control over the malware's behavior (e.g. being able to control it from a Command & Control).

| Component | Role |
| --- | --- |
| Dropper | Download/deliver a malicious payload to the victim's computer.Once the dropper has successfully installed the malware on the victim's computer, it may also attempt to establish a persistent presence on the system, such as by adding registry entries or creating hidden files. |
| Loader | Load another program or code into memory. Often used to load the main payload of the malware into memory, after which the payload can execute and carry out its activities.Will often implement process injection techniques to inject the malicious code (i.e. shellcode) into a legitimate process running on a victim's system, with the intention of evading antivirus and other security solutions. |
| Stager | Type of loader that loads the main payload of a malware program in multiple stages. Initial stage usually small and responsible for downloading additional stages of the malware from a remote server, or hiding the subsequent stages within the system. |
| Handler | Receive and execute commands from a command and control (C&C) server. |

> [!TIP]
> Simple malwares can sometimes merge the dropper and loader parts into a single piece.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for (AV) Anti-Virus - Droppers, loaders, stagers, handlers

[Assistant]
When working with malwares, the are multiple components that have specific tasks. These components usually allow for better antivirus evasion and/or easier control over the malware's behavior (e.g. being able to control it from a Command & Control).

| Component | Role |
| --- | --- |
| Dropper | Download/deliver a malicious payload to the victim's computer.Once the dropper has successfully installed the malware on the victim's computer, it may also attempt to establish a persistent presence on the system, such as by adding registry entries or creating hidden files. |
| Loader | Load another program or code into memory. Often used to load the main payload of the malware into memory, after which the payload can execute and carry out its activities.Will often implement process injection techniques to inject the malicious code (i.e. shellcode) into a legitimate process running on a victim's system, with the intention of evading antivirus and other security solutions. |
| Stager | Type of loader that loads the main payload of a malware program in multiple stages. Initial stage usually small and responsible for downloading additional stages of the malware from a remote server, or hiding the subsequent stages within the system. |
| Handler | Receive and execute commands from a command and control (C&C) server. |

> [!TIP]
> Simple malwares can sometimes merge the dropper and loader parts into a single piece.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for (AV) Anti-Virus - Droppers, loaders, stagers, handlers

Response:
When working with malwares, the are multiple components that have specific tasks. These components usually allow for better antivirus evasion and/or easier control over the malware's behavior (e.g. being able to control it from a Command & Control).

| Component | Role |
| --- | --- |
| Dropper | Download/deliver a malicious payload to the victim's computer.Once the dropper has successfully installed the malware on the victim's computer, it may also attempt to establish a persistent presence on the system, such as by adding registry entries or creating hidden files. |
| Loader | Load another program or code into memory. Often used to load the main payload of the malware into memory, after which the payload can execute and carry out its activities.Will often implement process injection techniques to inject the malicious code (i.e. shellcode) into a legitimate process running on a victim's system, with the intention of evading antivirus and other security solutions. |
| Stager | Type of loader that loads the main payload of a malware program in multiple stages. Initial stage usually small and responsible for downloading additional stages of the malware from a remote server, or hiding the subsequent stages within the system. |
| Handler | Receive and execute commands from a command and control (C&C) server. |

> [!TIP]
> Simple malwares can sometimes merge the dropper and loader parts into a single piece.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is (AV) Anti-Virus - Staged vs. stageless?

[Assistant]
Staged malware is like a series of stepping stones where the initial piece of code downloads additional stages of the malware from a remote server.

Stageless malware, on the other hand, is more of a single file that contains all the malicious code and can execute directly on the victim's computer without needing to download additional stages.

> [!TIP]
> While staged malware is theoretically more likely to be caught, because it consists in more steps and actions than a stageless one, it could be designed in a way that each action appears benign or inconspicuous, hence evading antivirus software.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is (AV) Anti-Virus - Staged vs. stageless?

Response:
Staged malware is like a series of stepping stones where the initial piece of code downloads additional stages of the malware from a remote server.

Stageless malware, on the other hand, is more of a single file that contains all the malicious code and can execute directly on the victim's computer without needing to download additional stages.

> [!TIP]
> While staged malware is theoretically more likely to be caught, because it consists in more steps and actions than a stageless one, it could be designed in a way that each action appears benign or inconspicuous, hence evading antivirus software.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through (AV) Anti-Virus - Staged vs. stageless

[Assistant]
Staged malware is like a series of stepping stones where the initial piece of code downloads additional stages of the malware from a remote server.

Stageless malware, on the other hand, is more of a single file that contains all the malicious code and can execute directly on the victim's computer without needing to download additional stages.

> [!TIP]
> While staged malware is theoretically more likely to be caught, because it consists in more steps and actions than a stageless one, it could be designed in a way that each action appears benign or inconspicuous, hence evading antivirus software.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through (AV) Anti-Virus - Staged vs. stageless

Response:
Staged malware is like a series of stepping stones where the initial piece of code downloads additional stages of the malware from a remote server.

Stageless malware, on the other hand, is more of a single file that contains all the malicious code and can execute directly on the victim's computer without needing to download additional stages.

> [!TIP]
> While staged malware is theoretically more likely to be caught, because it consists in more steps and actions than a stageless one, it could be designed in a way that each action appears benign or inconspicuous, hence evading antivirus software.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about 🛠 Loader

[Assistant]
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

The following piece of C code is a simple example of DLL loader, where the DLL holds the malicious shellcode.

``c
#include
#include

int main(void) {
 HMODULE hMod = LoadLibrary("shellcode.dll");
 if (hMod == nullptr) {
 cout << "Failed to load shellcode.dll" << endl;
 }

 return 0;
}
``

Once the payload is completed, pe-sieve can be used to identify if it is stealthy or not.

![](./assets/ps-sieve.png)

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

The following piece of C code is a simple example of DLL loader, where the DLL holds the malicious shellcode.

``c
#include
#include

int main(void) {
 HMODULE hMod = LoadLibrary("shellcode.dll");
 if (hMod == nullptr) {
 cout << "Failed to load shellcode.dll" << endl;
 }

 return 0;
}
``

Once the payload is completed, pe-sieve can be used to identify if it is stealthy or not.

![](./assets/ps-sieve.png)


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute 🛠 Loader?

[Assistant]
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

The following piece of C code is a simple example of DLL loader, where the DLL holds the malicious shellcode.

``c
#include
#include

int main(void) {
 HMODULE hMod = LoadLibrary("shellcode.dll");
 if (hMod == nullptr) {
 cout << "Failed to load shellcode.dll" << endl;
 }

 return 0;
}
``

Once the payload is completed, pe-sieve can be used to identify if it is stealthy or not.

![](./assets/ps-sieve.png)

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

The following piece of C code is a simple example of DLL loader, where the DLL holds the malicious shellcode.

``c
#include
#include

int main(void) {
 HMODULE hMod = LoadLibrary("shellcode.dll");
 if (hMod == nullptr) {
 cout << "Failed to load shellcode.dll" << endl;
 }

 return 0;
}
``

Once the payload is completed, pe-sieve can be used to identify if it is stealthy or not.

![](./assets/ps-sieve.png)


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] How do I use include for 🛠 loader?

[Assistant]
#include
#include

int main(void) {
 HMODULE hMod = LoadLibrary("shellcode.dll");
 if (hMod == nullptr) {
 cout << "Failed to load shellcode.dll" << endl;
 }

 return 0;
}

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Response:
#include
#include

int main(void) {
 HMODULE hMod = LoadLibrary("shellcode.dll");
 if (hMod == nullptr) {
 cout << "Failed to load shellcode.dll" << endl;
 }

 return 0;
}


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for 🛠 Loader

[Assistant]
#include
#include

int main(void) {
 HMODULE hMod = LoadLibrary("shellcode.dll");
 if (hMod == nullptr) {
 cout << "Failed to load shellcode.dll" << endl;
 }

 return 0;
}

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for 🛠 Loader

Response:
#include
#include

int main(void) {
 HMODULE hMod = LoadLibrary("shellcode.dll");
 if (hMod == nullptr) {
 cout << "Failed to load shellcode.dll" << endl;
 }

 return 0;
}


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What should I know about 🛠 Obfuscation?

[Assistant]
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on 🛠 Obfuscation

[Assistant]
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
> [!WARNING]
> This is a work-in-progress. It's indicated with the 🛠 emoji in the page name or in the category name. Wanna help? Please reach out to me: @_nwodtuhs


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of 🛠 Obfuscation - Theory

[Assistant] Obfuscation is a way to hide a shellcode. generally symmetric algorithms are used

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of 🛠 Obfuscation - Theory

Response: Obfuscation is a way to hide a shellcode. generally symmetric algorithms are used


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Explain the practical steps for 🛠 Obfuscation - Theory

[Assistant] Obfuscation is a way to hide a shellcode. generally symmetric algorithms are used

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Explain the practical steps for 🛠 Obfuscation - Theory

Response: Obfuscation is a way to hide a shellcode. generally symmetric algorithms are used


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is 🛠 Obfuscation - Manual obfuscation?

[Assistant]
Below is a list of ways that allow you to go under the radar of anti-virus software, so put all the chances on your side and use several techniques.\
You should also change the logo of the binary as well as its description and its creation date (sandboxes check that the binary is not too recent).

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What is 🛠 Obfuscation - Manual obfuscation?

Response:
Below is a list of ways that allow you to go under the radar of anti-virus software, so put all the chances on your side and use several techniques.\
You should also change the logo of the binary as well as its description and its creation date (sandboxes check that the binary is not too recent).


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do 🛠 Obfuscation - Manual obfuscation

[Assistant]
Below is a list of ways that allow you to go under the radar of anti-virus software, so put all the chances on your side and use several techniques.\
You should also change the logo of the binary as well as its description and its creation date (sandboxes check that the binary is not too recent).

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do 🛠 Obfuscation - Manual obfuscation

Response:
Below is a list of ways that allow you to go under the radar of anti-virus software, so put all the chances on your side and use several techniques.\
You should also change the logo of the binary as well as its description and its creation date (sandboxes check that the binary is not too recent).


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of 🛠 Obfuscation - Shellcode encoding

[Assistant]
For this part the principle is simple: camouflaged its active load, to do this you will need to code a function to encode, but also to decode, free to choose algorithm this technique works particularly well for static bypass.

Here is a link that will allow you to understand and write your first program:

https://www.ired.team/offensive-security/code-injection-process-injection/writing-custom-shellcode-encoders-and-decoders

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of 🛠 Obfuscation - Shellcode encoding

Response:
For this part the principle is simple: camouflaged its active load, to do this you will need to code a function to encode, but also to decode, free to choose algorithm this technique works particularly well for static bypass.

Here is a link that will allow you to understand and write your first program:

https://www.ired.team/offensive-security/code-injection-process-injection/writing-custom-shellcode-encoders-and-decoders


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How would I carry out 🛠 Obfuscation - Shellcode encoding during a pentest?

[Assistant]
For this part the principle is simple: camouflaged its active load, to do this you will need to code a function to encode, but also to decode, free to choose algorithm this technique works particularly well for static bypass.

Here is a link that will allow you to understand and write your first program:

https://www.ired.team/offensive-security/code-injection-process-injection/writing-custom-shellcode-encoders-and-decoders

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How would I carry out 🛠 Obfuscation - Shellcode encoding during a pentest?

Response:
For this part the principle is simple: camouflaged its active load, to do this you will need to code a function to encode, but also to decode, free to choose algorithm this technique works particularly well for static bypass.

Here is a link that will allow you to understand and write your first program:

https://www.ired.team/offensive-security/code-injection-process-injection/writing-custom-shellcode-encoders-and-decoders


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about 🛠 Obfuscation - Indirect syscall

[Assistant] the principle of this method is to call directly the memory addresses instead of using the API functions an article which explains things very well is this one.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about 🛠 Obfuscation - Indirect syscall

Response: the principle of this method is to call directly the memory addresses instead of using the API functions an article which explains things very well is this one.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute 🛠 Obfuscation - Indirect syscall?

[Assistant] the principle of this method is to call directly the memory addresses instead of using the API functions an article which explains things very well is this one.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute 🛠 Obfuscation - Indirect syscall?

Response: the principle of this method is to call directly the memory addresses instead of using the API functions an article which explains things very well is this one.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does 🛠 Obfuscation - Delayed execution work?

[Assistant]
In order to compromise the machine discreetly, sleeps are also used a lot, There are several methods: WaitForSingleObjectEx, Foliage, Ekko, Deathsleep.

A good part of them are very well explained at the following address : https://evasions.checkpoint.com/techniques/timing.html#delayed-execution

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

How does 🛠 Obfuscation - Delayed execution work?

Response:
In order to compromise the machine discreetly, sleeps are also used a lot, There are several methods: WaitForSingleObjectEx, Foliage, Ekko, Deathsleep.

A good part of them are very well explained at the following address : https://evasions.checkpoint.com/techniques/timing.html#delayed-execution


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on 🛠 Obfuscation - Delayed execution

[Assistant]
In order to compromise the machine discreetly, sleeps are also used a lot, There are several methods: WaitForSingleObjectEx, Foliage, Ekko, Deathsleep.

A good part of them are very well explained at the following address : https://evasions.checkpoint.com/techniques/timing.html#delayed-execution

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on 🛠 Obfuscation - Delayed execution

Response:
In order to compromise the machine discreetly, sleeps are also used a lot, There are several methods: WaitForSingleObjectEx, Foliage, Ekko, Deathsleep.

A good part of them are very well explained at the following address : https://evasions.checkpoint.com/techniques/timing.html#delayed-execution


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Tell me about 🛠 Obfuscation - Disable ETW

[Assistant]
There are several ways to disable logging, either via nt!EtwpStopTrace, or advapi32!EventWrite but also ntdll!ETWEventWrite.

To better understand these keywords, I invite you to read this article: https://www.binarly.io/posts/Design_issues_of_modern_EDRs_bypassing_ETW-based_solutions/index.html.

Another great resource : https://www.mdsec.co.uk/2020/03/hiding-your-net-etw/.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Tell me about 🛠 Obfuscation - Disable ETW

Response:
There are several ways to disable logging, either via nt!EtwpStopTrace, or advapi32!EventWrite but also ntdll!ETWEventWrite.

To better understand these keywords, I invite you to read this article: https://www.binarly.io/posts/Design_issues_of_modern_EDRs_bypassing_ETW-based_solutions/index.html.

Another great resource : https://www.mdsec.co.uk/2020/03/hiding-your-net-etw/.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for 🛠 Obfuscation - Disable ETW?

[Assistant]
There are several ways to disable logging, either via nt!EtwpStopTrace, or advapi32!EventWrite but also ntdll!ETWEventWrite.

To better understand these keywords, I invite you to read this article: https://www.binarly.io/posts/Design_issues_of_modern_EDRs_bypassing_ETW-based_solutions/index.html.

Another great resource : https://www.mdsec.co.uk/2020/03/hiding-your-net-etw/.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for 🛠 Obfuscation - Disable ETW?

Response:
There are several ways to disable logging, either via nt!EtwpStopTrace, or advapi32!EventWrite but also ntdll!ETWEventWrite.

To better understand these keywords, I invite you to read this article: https://www.binarly.io/posts/Design_issues_of_modern_EDRs_bypassing_ETW-based_solutions/index.html.

Another great resource : https://www.mdsec.co.uk/2020/03/hiding-your-net-etw/.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe 🛠 Obfuscation - Automatic obfuscation in the context of penetration testing

[Assistant]
Depending on your needs, you can use tools available for the most part on github, they are sorted by category below.

:information_source: You can also find all the tools in the mindmap section.

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe 🛠 Obfuscation - Automatic obfuscation in the context of penetration testing

Response:
Depending on your needs, you can use tools available for the most part on github, they are sorted by category below.

:information_source: You can also find all the tools in the mindmap section.


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Give me a guide on 🛠 Obfuscation - Automatic obfuscation

[Assistant]
Depending on your needs, you can use tools available for the most part on github, they are sorted by category below.

:information_source: You can also find all the tools in the mindmap section.

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Give me a guide on 🛠 Obfuscation - Automatic obfuscation

Response:
Depending on your needs, you can use tools available for the most part on github, they are sorted by category below.

:information_source: You can also find all the tools in the mindmap section.


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What is 🛠 Obfuscation - Packing?

[Assistant]
```
- https://github.com/phra/PEzor
- https://github.com/klezVirus/inceptor
- https://github.com/govolution/avet
- https://github.com/Nariod/RustPacker
- https://github.com/DavidBuchanan314/monomorph
- https://github.com/upx/upx

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
```
- https://github.com/phra/PEzor
- https://github.com/klezVirus/inceptor
- https://github.com/govolution/avet
- https://github.com/Nariod/RustPacker
- https://github.com/DavidBuchanan314/monomorph
- https://github.com/upx/upx


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Show me how to do 🛠 Obfuscation - Packing

[Assistant]
```
- https://github.com/phra/PEzor
- https://github.com/klezVirus/inceptor
- https://github.com/govolution/avet
- https://github.com/Nariod/RustPacker
- https://github.com/DavidBuchanan314/monomorph
- https://github.com/upx/upx

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Show me how to do 🛠 Obfuscation - Packing

Response:
```
- https://github.com/phra/PEzor
- https://github.com/klezVirus/inceptor
- https://github.com/govolution/avet
- https://github.com/Nariod/RustPacker
- https://github.com/DavidBuchanan314/monomorph
- https://github.com/upx/upx


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Give me an overview of 🛠 Obfuscation - Office macro

[Assistant]
- https://github.com/sevagas/macro_pack
- https://github.com/optiv/Ivy
```

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Give me an overview of 🛠 Obfuscation - Office macro

Response:
- https://github.com/sevagas/macro_pack
- https://github.com/optiv/Ivy
```


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] How to execute 🛠 Obfuscation - Office macro?

[Assistant]
- https://github.com/sevagas/macro_pack
- https://github.com/optiv/Ivy
```

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

How to execute 🛠 Obfuscation - Office macro?

Response:
- https://github.com/sevagas/macro_pack
- https://github.com/optiv/Ivy
```


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe 🛠 Obfuscation - AMSI Bypass in the context of penetration testing

[Assistant]
``
- https://github.com/CCob/SharpBlock
- https://github.com/danielbohannon/Invoke-Obfuscation
- https://github.com/klezVirus/Chameleon
- https://github.com/tokyoneon/Chimera
``

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe 🛠 Obfuscation - AMSI Bypass in the context of penetration testing

Response:
``
- https://github.com/CCob/SharpBlock
- https://github.com/danielbohannon/Invoke-Obfuscation
- https://github.com/klezVirus/Chameleon
- https://github.com/tokyoneon/Chimera
``


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through 🛠 Obfuscation - AMSI Bypass

[Assistant]
``
- https://github.com/CCob/SharpBlock
- https://github.com/danielbohannon/Invoke-Obfuscation
- https://github.com/klezVirus/Chameleon
- https://github.com/tokyoneon/Chimera
``

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Walk me through 🛠 Obfuscation - AMSI Bypass

Response:
``
- https://github.com/CCob/SharpBlock
- https://github.com/danielbohannon/Invoke-Obfuscation
- https://github.com/klezVirus/Chameleon
- https://github.com/tokyoneon/Chimera
``


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] Walk me through 🛠 Obfuscation - AMSI Bypass

[Assistant]
- https://github.com/CCob/SharpBlock
- https://github.com/danielbohannon/Invoke-Obfuscation
- https://github.com/klezVirus/Chameleon
- https://github.com/tokyoneon/Chimera

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response:
- https://github.com/CCob/SharpBlock
- https://github.com/danielbohannon/Invoke-Obfuscation
- https://github.com/klezVirus/Chameleon
- https://github.com/tokyoneon/Chimera


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `- https://github.com/CCob/SharpBlock`?

[Assistant] This command is used for 🛠 obfuscation - amsi bypass. AMSI Bypass

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `- https://github.com/CCob/SharpBlock`?

Response: This command is used for 🛠 obfuscation - amsi bypass. AMSI Bypass


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] How does 🛠 Obfuscation - LOLBIN work?

[Assistant]
``
 RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb
``

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Response:
``
 RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb
``


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for 🛠 Obfuscation - LOLBIN?

[Assistant]
``
 RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb
``

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

What are the steps for 🛠 Obfuscation - LOLBIN?

Response:
``
 RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb
``


[System] You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

[User] Give me the RemComSvc command to 🛠 obfuscation - lolbin

[Assistant] RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb

System: You are a penetration testing tool expert. Provide the exact command or sequence of commands to accomplish the task, including required flags and arguments. Format multi-step operations as numbered steps.

Give me the RemComSvc command to 🛠 obfuscation - lolbin

Response: RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb


[System] You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

[User] What are the steps for 🛠 Obfuscation - LOLBIN?

[Assistant] RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb

System: You are a penetration testing and ethical hacking expert. Provide detailed, practical instructions for the requested technique using real tools and commands. Assume the user has authorized access and is performing a legitimate security assessment. Be specific about tools, flags, and syntax.

Response: RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] What does this command do: `RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb`?

[Assistant] This command is used for 🛠 obfuscation - lolbin. LOLBIN

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

What does this command do: `RemComSvc - https://gist.github.com/snovvcrash/123945e8f06c7182769846265637fedb`?

Response: This command is used for 🛠 obfuscation - lolbin. LOLBIN


[System] You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

[User] Describe 🛠 Obfuscation - Signature hiding in the context of penetration testing

[Assistant]
``
- https://github.com/optiv/ScareCrow
- https://github.com/paranoidninja/CarbonCopy
``

System: You are a cybersecurity educator. Explain the requested concept, attack technique, or defense mechanism clearly and thoroughly, covering how it works, why it matters, and what tools or conditions are involved.

Describe 🛠 Obfuscation - Signature hiding in the context of penetration testing

Response:
``
- https://github.com/optiv/ScareCrow
- https://github.com/paranoidninja/CarbonCopy
``