How to Make GraphQL Security Easier with StackHawk
summary
StackHawk runs an active DAST scanner against a running GraphQL endpoint via a simple docker command and config YML, uses GraphQL introspection to enumerate 11 routes discovered, integrates into CI/CD and tools like Slack and Datadog, and averages under 10 minutes per scan. Demoed findings include high-severity issues (SQLi and a remote OS command injection (cat /etc/passwd)), with curl replay and GraphiQL repro steps provided so fixes can be triaged and verified.
AI-written summary · about
chapters (4)
- 0:00Start
- 1:17How Does Stackhawk Work
- 3:40Running the Stackhawk Scanner against a Graphql Application
- 5:27Remote Os Command Injection
related talks
07mSecurity Testing for GraphQL Backed Applications
08mModern GraphQL API Security Testing
09mAutomated Application Security Testing with StackHawk
09mAutomated Application Security Testing
15mDev-first API and application security testing
09mAutomated Application Security Testing with StackHawk
08mAutomated Security Testing for JS Apps & Underlying APIs
09mAutomated Application Security Testing