>>18fileless execution of payload can be much simpler. consider this: a client sends a GET request to a server over TLS. server responds with a list of batch commands which are then passed to the
system()
function. this is of course fairly primitive and easy to detect, so consider my idea of vulnerability-as-backdoor: what if your're are client has a beingn functionality which is implemented with batch commands, but the function which executes them has a shell injection vulnerability?
>>19that's a very broad set of questions, but you can learn answers to many of them by reading malware analysis and reverse engineering articles, there's plenty of those on the internet. then you can try experimenting with malware - writing your own but also reversing what already exists. it's not like finding a sample virus for analysis is difficult