Decoding GraphQL: How to Map Hidden...
summary
Scans of the top 1M domains find ~200k GraphQL endpoints with ~60k exposing introspection; automated testing using a custom reinforcement learning algorithm plus discovery tool Gtopus yields ~90 issues per service and uncovers 4,000+ leaked secrets (49 passwords, 2 credit cards, 1,396 tokens). Findings include widespread schema leaks, SSRF, broken mutation auth, batching brute force, resource exhaustion via GraphQL bombs, and a one-line middleware called GraphQL Armor that implements 10 best practices.
AI-written summary · about
chapters (7)
- 0:00Introduction and motivation
- 3:59GraphQL security challenges
- 8:37Methodology for scanning APIs
- 12:25Semantic API exploration
- 17:46Analysis of common findings
- 24:11GraphQL-specific vulnerabilities
- 29:52Remediation and tools
related talks
38mEscape Workshop: Discovering GraphQL Vulnerabilities in the Wild
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
23mGraphQL Security Vulnerabilities in the Wild
37mIs your GraphQL API safe? Let’s find out
51mAPI Security: Securing GraphQL without going around in circles
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
32mMind your GraphQL APIs: how to reduce their attack surface
29mDamn GraphQL - Defending and Attacking APIs