Escape Workshop: Discovering GraphQL Vulnerabilities in the Wild
summary
A team scans 1.2 million domains (filtered for API or graphql), validates ~2,450 public GraphQL endpoints and fully scans ~1,600+, finding an average of ~30 security alerts per endpoint including ~500 SSRF cases and widespread information leaks (AWS tokens, private keys, emails). They build and use graph finder and a faster Go rewite goktopus, run a feedback‑driven API exploration to bypass validation, and publish fixes and a library called graphql armor.
AI-written summary · about
chapters (24)
- 0:00Introduction
- 1:06Escape and GraphQL security
- 2:34What is GraphQL
- 3:37GraphQL attack risks
- 5:25Finding GraphQL endpoints
- 7:34Automated GraphQL discovery
- 9:40Automated testing challenges
- 11:26Feedback-driven API exploration
- 13:14GraphQL structure vulnerabilities
- 14:19Scan results 1600+ APIs
- 15:23Common GraphQL vulnerabilities
- 17:54GraphQL complexity risks
- 19:43Directive overloading risks
- 20:48Recursive fragments leaks
- 21:54Introspection risks
- 24:29Sensitive data leaks
- 26:38Unauthenticated queries
- 27:40Conclusion and recommendations
- 29:50Q&A: Penetration tools
- 30:31Q&A: Why GraphQL security
- 32:23Q&A: GraphQL vs OWASP Top 10
- 33:49Q&A: Vulnerability severity
- 35:36Q&A: Escape research and tools
- 36:40Q&A: Escape learning center
related talks
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
32mDecoding GraphQL: How to Map Hidden...
23mGraphQL Security Vulnerabilities in the Wild
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
27mWhy Your GraphQL APIs Are Increasingly Under Attack
37mIs your GraphQL API safe? Let’s find out
32mMind your GraphQL APIs: how to reduce their attack surface
29mDamn GraphQL - Defending and Attacking APIs