One of the challenges we face with client-side testing is that there (more than likely) will be endpoint protections in place, so there is a good chance of not only getting caught, but also having our vector deleted by the host protections. As with any signature-based detection, there is a database that contains the signatures of the different viruses and their variants that have been discovered. When we look at the techniques we used throughout this chapter, we will need to see whether the payload we developed is going to be detected by antivirus software.

We can upload our potential payload and see whether it is detected by the antivirus. An example of the https.exe file that we created earlier in this chapter is shown in the following screenshot:

As the previous screenshot shows, 34 out of 51 antivirus products detect the file. That is about 67 percent and is not a very good detection...