Kali Linux detection bypass

Because we are running Pacu on Kali Linux, we are presented with an extra message about our user agent after the help output, similar to what is shown in the following screenshot:

We can see that Pacu has detected that we are running Kali Linux and modified our user agent as a result. GuardDuty is one of the many security services that AWS offers, and it is used to detect and alert to suspicious behavior going on in an AWS environment. One thing that GuardDuty checks for is if you are making AWS API calls that originate from Kali Linux (https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_pentest.html#pentest1). We want to trigger as few alerts as possible in an account we are attacking, so Pacu has it built-in to automatically bypass this security measure. GuardDuty checks the user agent of whoever is making the API call to see if it recognizes Kali Linux from it, and alerts to it if it does. Pacu modifies our user agent to a generic user agent that does not look suspicious to GuardDuty.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.117.196.217