This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP ZSC Tool Project"
(→Usage of shellcodes) |
(→Why use OWASP ZSC ?) |
||
| Line 39: | Line 39: | ||
====Why use OWASP ZSC ?==== | ====Why use OWASP ZSC ?==== | ||
| + | |||
| + | Another good reason for obfuscating files or generating shellcode with ZSC is that it can be used during your pen-testing. Malicious hackers use these techniques to bypass anti-virus and load malicious files in systems they have hacked using customized shellcode generators. | ||
| + | Anti-virus work with signatures in order to identify harmful files. When using very well known encoders such as msfvenom, files generated by this program might be already flagged by Anti-virus programs. | ||
| + | |||
| + | Our purpose is not to provide a way to bypass anti-virus with malicious intentions, instead, we want to provide pen-testers a way to challenge the security provided by Anti-virus programs and Intrusion Detection systems during a pen test.In this way, they can verify the security just as a black-hat will do. | ||
| + | |||
According to other shellcode generators same as metasploit tools and etc, OWASP ZSC using new encodes and methods which antiviruses won't detect. | According to other shellcode generators same as metasploit tools and etc, OWASP ZSC using new encodes and methods which antiviruses won't detect. | ||
OWASP ZSC encoderes are able to generate shell codes with random encodes and that allows you to generate thousands of new dynamic shellcodes with same job in just a second,that means, you will not get a same code if you use random encodes with same commands, And that make OWASP ZSC one of the best! | OWASP ZSC encoderes are able to generate shell codes with random encodes and that allows you to generate thousands of new dynamic shellcodes with same job in just a second,that means, you will not get a same code if you use random encodes with same commands, And that make OWASP ZSC one of the best! | ||
Revision as of 16:02, 1 August 2016
OWASP ZSC Tool ProjectShare this:
What is OWASP ZSC ?
OWASP ZSC is an open source software in python language which lets you generate customized shellcodes and convert scripts to an obfuscated script. This software can be run on Windows/Linux/OSX under python.
DescriptionUsage of shellcodesShellcodes are small codes in assembly which could be use as the payload in software exploitation. Other usages are in malwares, bypassing antiviruses, obfuscated codes and etc. DISCLAIMER: OWASP ZSC does not encourage the use of this tool for the purpose of software exploitation, but instead as a save way for Pen-testers to use already publicised exploits with the correct Shellcode or avoid exploits with malicious shellcode. Generating you own shellcode is safe and also you can limit the shellcode to a benign action such as just popping a calculator or print a message. Usage of Obfuscate CodesCan be use for bypassing antiviruses , code protections , same stuff etc … Why use OWASP ZSC ?Another good reason for obfuscating files or generating shellcode with ZSC is that it can be used during your pen-testing. Malicious hackers use these techniques to bypass anti-virus and load malicious files in systems they have hacked using customized shellcode generators. Anti-virus work with signatures in order to identify harmful files. When using very well known encoders such as msfvenom, files generated by this program might be already flagged by Anti-virus programs. Our purpose is not to provide a way to bypass anti-virus with malicious intentions, instead, we want to provide pen-testers a way to challenge the security provided by Anti-virus programs and Intrusion Detection systems during a pen test.In this way, they can verify the security just as a black-hat will do. According to other shellcode generators same as metasploit tools and etc, OWASP ZSC using new encodes and methods which antiviruses won't detect. OWASP ZSC encoderes are able to generate shell codes with random encodes and that allows you to generate thousands of new dynamic shellcodes with same job in just a second,that means, you will not get a same code if you use random encodes with same commands, And that make OWASP ZSC one of the best! During the Google Summer of Code we are working on to generate Windows Shellcode and new obfuscation methods. We are working on the next version that will allow you to generate OSX . LicensingGNU GENERAL PUBLIC LICENSE , Version 3, 29 June 2007Copyright (C) 2007 Free Software Foundation, Inc. http://fsf.org/ Everyone is permitted to copy and distribute verbatim copies of this license document, but changing it is not allowed. Click to see the full license
The OWASP Security Principles are licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one. |
Project LeadersContributors & Main Developers
LinksShellcode GeneratingWith using OWASP ZSC you would be able to generate any customized Shellcode in your mind including encodes,and Disassembly code in few seconds. Be an OWASP ZSC developerLast Tricks in HomeRelated links |
Quick DownloadNews and Events
DocsClassifications
| ||||||
