When performing penetration testing for work, I often have to turn off Symantec Endpoint Protection in order to use certain payloads with Burp Suite and I recently had to do this for something as simple as WPScan (in a Kali VM).
Here's the error that comes up:
I am aware that I am able to disable specific security risks within Symantec, but that is honestly a total pain. I have to wait about 10 minutes for the list to load before I disable a specific tool and then I have to disable specific payloads / payload types (ex: SQL injection = payload type vs. Shellshock = payload) in order to perform tests while keeping the antivirus on.
As a security professional, the words "just turn off your anti-virus" just leave a bad taste in my mouth - but I need to be able to do my job. I have to imagine that other organizations have sensible, practical policies on how to permit penetration testers to use security tools without disabling the entire defense system on the pentester's host computer. Although our policy states that you should not just turn off your anti-virus, I see other pentesters do it all the time just so they can enter
' or 1=1-- in an HTTP request.
I know I'm not the only pentester to run into this issue. What does your organization do to permit penetration testers to perform their job functions effectively without compromising on their own defensive security measures?
I want to hear your responses not just for my own benefit, but so I can understand how penetration testers can operate effectively within a large organization. Thanks in advance!