Be Cool and Hack GraphQL
summary
Demonstrates practical GraphQL attacks and defenses using tools like GraphiQL, Voyager and Burp: mapping schemas with introspection queries, intercepting and mutating requests, exploiting IDOR to read nonpublic posts, crafting nested queries to exhaust CPU/memory, and chaining SQL injection to extract a users table and password hashes. References real bug-bounty cases and OWASP GraphQL guidance, and shows mitigations such as disabling introspection, enforcing query depth limits, and applying timeouts.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 3:58GraphQL analysis tools
- 5:24GraphQL from pentester view
- 7:28GraphQL vs REST benefits
- 10:59GraphQL query methods
- 12:23Browser GraphQL console
- 13:47GraphQL introspection
- 17:22Introspection security
- 18:03Insecure Direct Object References
- 23:28Denial of Service attacks
- 27:45OWASP and GraphQL flaws
- 29:33SQL Injection in GraphQL
- 35:51GraphQL Security docs
- 36:34GraphQL testing tools
- 38:21GraphQL learning resources
- 40:49Bug bounty programs for GraphQL
- 42:55Summary and Q&A
related talks
29mDamn GraphQL - Defending and Attacking APIs
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs
33mApisecure, 14 & 15 March 2023 - Parth Shukla, Security Analyst at Cequence Security.
32mMind your GraphQL APIs: how to reduce their attack surface
27mWhy Your GraphQL APIs Are Increasingly Under Attack
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
33mGraphQL Exploitation: Secondary Context Attacks and Business Logic