diff --git a/.gitbook/assets/image (6) (3) (1).png b/.gitbook/assets/image (6) (3) (1).png new file mode 100644 index 000000000..c56912d64 Binary files /dev/null and b/.gitbook/assets/image (6) (3) (1).png differ diff --git a/.gitbook/assets/image (6) (3).png b/.gitbook/assets/image (6) (3).png index c56912d64..0a386abf4 100644 Binary files a/.gitbook/assets/image (6) (3).png and b/.gitbook/assets/image (6) (3).png differ diff --git a/.gitbook/assets/image (6).png b/.gitbook/assets/image (6).png index 0a386abf4..6522f6120 100644 Binary files a/.gitbook/assets/image (6).png and b/.gitbook/assets/image (6).png differ diff --git a/network-services-pentesting/pentesting-web/graphql.md b/network-services-pentesting/pentesting-web/graphql.md index 2f8f61334..e0b76a21e 100644 --- a/network-services-pentesting/pentesting-web/graphql.md +++ b/network-services-pentesting/pentesting-web/graphql.md @@ -14,7 +14,7 @@ ## Introduction -GraphQL is a data query language developed by Facebook and was released in 2015. GraphQL acts as an alternative to REST API. Rest APIs require the client to send multiple requests to different endpoints on the API to query data from the backend database. With graphQL you only need to send one request to query the backend. This is a lot simpler because you don’t have to send multiple requests to the API, a single request can be used to gather all the necessary information. +GraphQL acts as an alternative to REST API. Rest APIs require the client to send multiple requests to different endpoints on the API to query data from the backend database. With graphQL you only need to send one request to query the backend. This is a lot simpler because you don’t have to send multiple requests to the API, a single request can be used to gather all the necessary information. ## GraphQL @@ -27,8 +27,10 @@ When performing your directory brute force attacks make sure to add the followin * _/graphql.php_ * _/graphql/console_ -Once you find an open graphQL instance you need to know what queries it supports. This can be done by using the introspection system, more details can be found here: [**GraphQL: A query language for APIs.**\ -\_It’s often useful to ask a GraphQL schema for information about what queries it supports. GraphQL allows us to do so…\_graphql.org](https://graphql.org/learn/introspection/) +
+ +Once you find an open graphQL instance you need to know **what queries it supports**. This can be done by using the introspection system, more details can be found here: [**GraphQL: A query language for APIs.**\ +It’s often useful to ask a GraphQL schema for information about what queries it supports. GraphQL allows us to do so…](https://graphql.org/learn/introspection/) ### Fingerprint diff --git a/windows-hardening/av-bypass.md b/windows-hardening/av-bypass.md index 5bb851e5f..b88195304 100644 --- a/windows-hardening/av-bypass.md +++ b/windows-hardening/av-bypass.md @@ -72,7 +72,7 @@ Whenever it's possible, always **prioritize using DLLs for evasion**, in my expe As we can see in this image, a DLL Payload from Havoc has a detection rate of 4/26 in antiscan.me, while the EXE payload has a 7/26 detection rate. -

antiscan.me comparison of a normal Havoc EXE payload vs a normal Havoc DLL

+

antiscan.me comparison of a normal Havoc EXE payload vs a normal Havoc DLL

Now we'll show some tricks you can use with DLL files to be much more stealthier.