Damn GraphQL - Defending and Attacking APIs
summary
Claims that GraphQL often exposes an introspection dump and always returns 200 while embedding errors, and that field suggestions are enabled by default. Demonstrates an exploit against WordPress GraphQL (10k active installs) where batching plus duplicated fields and no cost analysis lets an attacker send 10,000 duplicates batched 100 times from 300 threads to trigger MySQL OOM in ~10 seconds. Releases DVGA (Damn Vulnerable GraphQL Application) for hands‑on practice and recommends NSE nmap scripts and Voyager for discovery and visualization.
AI-written summary · about
chapters (5)
related talks
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
27mWhy Your GraphQL APIs Are Increasingly Under Attack
32mMind your GraphQL APIs: how to reduce their attack surface
43mBe Cool and Hack GraphQL
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs
30mTechniques to Protect Your GraphQL API
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
37mIs your GraphQL API safe? Let’s find out