The newest GraphQL resources are on the GraphQL page. For a reading order instead of a date order, see the GraphQL learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2026-04-10 2026 | Common Attacks on REST APIs and GraphQL APIs beginner API Sec | Common Attacks on REST APIs and GraphQL APIs |
| 2026-04-10 2026 | GraphQL API Security: Common Vulnerabilities and Exploits beginner API Sec | GraphQL API Security: Common Vulnerabilities and Exploits |
| 2026-04-10 2026 | GraphQL Security Testing: Introspection Abuse, Injection, and DoS intermediate 11 min read | Library for precise GraphQL API penetration testing, focusing on a phase-based methodology. It covers schema enumeration via introspection, including using GraphQL Voyager for visualization and Clairvoyance to reconstruct schemas when introspection is disabled. The guide details injection vulnerability testing, specifically for SQL/NoSQL injection in arguments, SSRF via URL-accepting fields, and stored XSS in mutations, recommending tools like Burp Suite and the InQL extension. It also addresses denial-of-service risks through nested query depth attacks and alias-based duplication. |
| 2026-04-10 2026 | Hacking (and Securing) GraphQL beginner 13 min read | Library securing GraphQL APIs against common attack vectors like SQL injection, XSS, and denial-of-service (DoS) via query batching, aliasing, duplication, and circular queries. It details how introspection queries can reveal the API schema and emphasizes the importance of input sanitization for mutations and queries to prevent injection attacks. The library also highlights Arcjet's role in analyzing requests within route handlers or middleware for enhanced security. |
| 2026-04-10 2026 | GraphQL API Vulnerabilities - PortSwigger beginner 11 min read API Sec | Library for testing GraphQL APIs, detailing common vulnerabilities like introspection enablement and insecure direct object references (IDORs). It covers techniques for discovering GraphQL endpoints, including universal queries and common endpoint names, and demonstrates how to exploit unsanitized arguments to access unauthorized data. The library also explains how to use introspection queries to gather schema information and identifies methods for probing and running full introspection queries against vulnerable endpoints. → portswigger.net |
| 2026-04-10 2026 | GraphQL Attacks and Vulnerabilities beginner 13 min read | Library for understanding GraphQL security, covering common attacks like introspection, GraphiQL exploitation, and Denial of Service (DoS) through batching, alias overloading, and field duplication. It explains how GraphQL's flexibility can be leveraged by attackers to gather information or overwhelm servers, highlighting the importance of securing these APIs against both GraphQL-specific and traditional web application threats. |
| 2026-04-10 2026 | How a GraphQL Bug Resulted in Authentication Bypass intermediate 10 min read | Library detailing an authentication bypass vulnerability in an e-commerce application's GraphQL API. The article explores how attackers can abuse GraphQL introspection and mutations, such as `Register` and `CreateAdminUser`, to gain unauthorized administrative access. It highlights the importance of proper access control for GraphQL endpoints and discusses techniques for discovering these flaws, including schema introspection and authorization checks, as explained by researcher J. Francisco Bolivar. → hackerone.com |
| 2026-04-10 2026 | Top GraphQL Security Vulnerabilities: Analyzing 1,500+ Endpoints intermediate | Top GraphQL Security Vulnerabilities: Analyzing 1,500+ Endpoints |
| 2026-04-10 2026 | GraphQL API Security Risks Every Developer Should Know beginner 9 min read | Library for GraphQL API security, focusing on mitigating risks like excessive query complexity, data over-exposure, injection attacks (SQL, command, prompt), Insecure Direct Object Reference (IDOR), denial-of-service (DoS) via query amplification and complexity bombs, schema introspection misuse, and Cross-Site Request Forgery (CSRF) on mutation operations. It recommends best practices such as field-level authorization, query whitelisting, depth limits, and query cost analysis to protect against these vulnerabilities. → wiz.io |
| 2026-04-10 2026 | GraphQL API Vulnerabilities and Common Attacks beginner 18 min read | Library detailing GraphQL API vulnerabilities, including introspection attacks, excessive error suggestions, denial of service via batching and alias overloading, and injection and broken authentication/authorization. It highlights the potential for attackers to exploit GraphQL's flexibility, schema introspection, and tools like GraphiQL for information gathering and disruption. Recommendations include disabling introspection and GraphiQL in production, masking verbose errors, and limiting or disabling query batching to mitigate these risks. → imperva.com |
| 2026-04-10 2026 | Exploiting Broken Access Control on GraphQL intermediate 4 min read | Writeup detailing the exploitation of broken access control and IDOR vulnerabilities in GraphQL. It explains how to leverage GraphQL introspection, aided by tools like Burp's InQL extension and GraphQL Voyager, to identify and access sensitive data from other tenants. The writeup outlines a practical scenario involving pivoting from a project's assigned roles to another company's user data, emphasizing the need for robust authentication, authorization, and role-based access controls to prevent such breaches. → vaadata.com |
| 2026-04-10 2026 | GraphQL Security: 7 Common Vulnerabilities and Mitigations beginner 5 min read | Guide detailing seven common GraphQL vulnerabilities including introspection attacks, GraphiQL exploitation, excessive error suggestions, denial-of-service attacks (batching, alias overloading, field duplication, directive overloading, circular queries, pagination bypass), injection attacks (SQL, XSS, OS command), server-side request forgery (SSRF), and broken authentication/authorization. It outlines mitigations like disabling introspection, limiting verbose errors, implementing query complexity limits, validating/sanitizing inputs, using parameterized queries, and enforcing fine-grained access controls. |
| 2026-04-10 2026 | GraphQL Security Flaws and Exploitation intermediate | GraphQL Security Flaws and Exploitation → infosecwriteups.com |
| 2026-04-06 2026 | GraphQL Security Vulnerabilities Guide - SecPortal beginner | GraphQL Security Vulnerabilities Guide - SecPortal |
| 2026-04-06 2026 | GraphQL Security: How I Found and Exploited Critical IDOR and Authorization Bypass intermediate IDOR | GraphQL Security: How I Found and Exploited Critical IDOR and Authorization Bypass → infosecwriteups.com |
| 2026-04-03 2026 | GraphQL Security Testing Guide (2026) beginner 37 min read | Library for continuous GraphQL security testing, essential for enterprises due to flexible, client-defined queries enabling excessive data exposure, broken authorization, and denial-of-service risks. It addresses the visibility gap created by GraphQL's single endpoint and dynamic structures, which traditional API security tools struggle to detect. The library helps validate authentication, authorization, query complexity, and data exposure, assessing runtime behavior beyond static controls to identify vulnerabilities like excessive data exposure and broken object-level authorization before exploitation. |
| 2026-04-03 2026 | GraphQL Security Complete Guide | Payload Playground beginner | GraphQL Security Complete Guide | Payload Playground |
| 2026-04-03 2026 | GraphQL Vulnerabilities and Common Attacks Seen in the Wild | Imperva beginner | Library for identifying GraphQL vulnerabilities and common attacks seen in the wild. It covers common attack vectors such as introspection abuse, denial-of-service, and unauthorized data exposure, offering insights into how these vulnerabilities are exploited in real-world scenarios. The library aims to aid developers and security professionals in understanding and mitigating risks associated with GraphQL implementations. → imperva.com |
| 2026-04-03 2026 | GraphQL API Vulnerabilities, Common Attacks & Security Tips beginner 15 min read | Library detailing GraphQL API security, covering its structure, common attacks, and defensive measures. It explains the schema, object types, queries, and mutations, then delves into pentesting methodologies and tools. Key areas include endpoint discovery using fuzzing and wordlists like Seclists, schema enumeration, and leveraging GraphQL's introspection feature to reveal API structure. The resource highlights vulnerabilities inherent to APIs while emphasizing GraphQL-specific attack vectors. → vaadata.com |
| 2026-04-03 2026 | Hacking GraphQL Endpoints in Bug Bounty Programs | YesWeHack intermediate 8 min read | Library for identifying and exploiting GraphQL vulnerabilities, this guide details techniques such as abusing introspection queries and field suggestions, and performing mutation manipulation and batching attacks. It covers common vulnerabilities like information disclosure, IDOR, and improper access control, recommending tools such as GraphQL Voyager, InQL, Clairvoyance, and GraphQLmap for both introspection and fuzzing attacks when introspection is disabled. → yeswehack.com |
| 2026-04-03 2026 | PayloadsAllTheThings - GraphQL Injection intermediate 9 min read | Library detailing GraphQL injection techniques, including schema dumping via introspection queries and tools like GraphQLmap, inql, and clairvoyancex for pentesting. It covers common endpoint paths, HTTP method usage (GET/POST), error message analysis, and schema traversal for identifying access paths to types like User and Admin, utilizing resources such as the graphql-threat-matrix and Escape-Technologies/graphql-wordlist. |
| 2026-04-03 2026 | GraphQL | HackTricks beginner 21 min read | Reference detailing GraphQL security vulnerabilities and enumeration techniques. It covers discovering GraphQL endpoints via common paths and identifying the engine with tools like `graphw00f`. The document explains how to leverage introspection with queries like `{__typename}` and `{__schema}` to map out schemas, identify data types, and extract sensitive information from exposed `flags` or `users` fields, recommending JSON for POST requests to prevent CSRF. → book.hacktricks.xyz |
| 2026-04-03 2026 | GraphQL Cheat Sheet | OWASP beginner 14 min read | Cheatsheet from OWASP detailing security considerations for GraphQL APIs. It addresses common vulnerabilities like injection, DoS, and authorization abuse. The guide emphasizes strict input validation, disabling insecure defaults (introspection, excessive errors), and implementing query depth and amount limiting. It also covers preventing DoS through timeouts, query cost analysis, and rate limiting, with specific recommendations and examples for various implementations, including graphql-java and JavaScript. → cheatsheetseries.owasp.org |
| 2026-04-03 2026 | GraphQL Security from a Pentester's Perspective | AFINE intermediate 27 min read | Library for identifying and exploiting GraphQL vulnerabilities, detailing techniques for detecting endpoints and abusing introspection to enumerate schemas. The resource examines common weaknesses such as GraphQL Injection, DoS attacks via batching or recursive queries, and authorization flaws, providing example payloads and tools like Burp Suite extensions, GraphQLmap, InQL, and GraphQL Raider for testing Apollo Server, Hasura, and Graphene implementations. |
| 2026-03-25 2026 | Escape-Technologies/awesome-graphql-security: A curated list of awesome GraphQL Security frameworks, libraries, software and resources beginner 4 min read API Sec | Library of curated GraphQL security resources, including frameworks like GraphQL Shield and GraphQL Armor, testing tools such as Escape, GraphQL Cop, InQL (Burp Extension), and Graphw00f, clients like Postman and Altair, and educational materials covering vulnerabilities like IDOR, CSRF, SQL Injection, and cyclic queries. This list also features guides on access control, schema validation with GraphQL Inspector and GraphQL Visualizer, and resources for discovering GraphQL endpoints. |
| 2025-12-30 2025 | Teycir/BurpAPISecuritySuite: Burp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and automated reconnaissance. Supports REST/GraphQL/SOAP APIs with Nuclei, Turbo Intruder, and external tool integration. OWASP API Top 10 coverage. intermediate 38 min read API Sec Burp Fuzzing | Library of Burp Suite extensions offering comprehensive API security testing, including 15 attack types and over 108 payloads. It features intelligent fuzzing, BOLA/IDOR detection, AI integration, and automated reconnaissance for REST, GraphQL, and SOAP APIs. The suite integrates with Nuclei, Turbo Intruder, and other external tools, providing broad coverage of OWASP API Top 10 vulnerabilities and advanced techniques like differential analysis and token lineage tracking. |
| 2025-11-24 2025 | A Terminal client for HTTP/GraphQL/gRPC with support for SSH tunnels, WebSockets, SSE, workflows, profiling, OpenAPI and response diffs. beginner | #golang https://t.co/sDSO3DWkkl |
| 2025-08-14 2025 | Mastering the Realm of GraphQL Exploitation advanced | The content is titled "Mastering the Realm of GraphQL Exploitation" and appears to focus on the topic of exploiting GraphQL. It suggests a deep dive into understanding and potentially exploiting GraphQL, a query language for APIs. The title implies that the content may cover advanced techniques or strategies for manipulating GraphQL queries to gain unauthorized access or extract sensitive information. → infosecwriteups.com |
| 2025-08-14 2025 | GraphQL - Security Overview and Testing Tips · Doyensec's Blog beginner 5 min read | Reference for GraphQL security testing, this article highlights common vulnerabilities like Broken Access Controls, Insecure Direct Object References, and SQL/NoSQL Injections. It recommends tools such as `graphql-ide` and a custom Python script (`GraphQL_Introspection.py`) for enumerating schemas. The text details testing tips for identifying exposed endpoints, such as `/graphql` or `/graphql.php?debug=1`, and emphasizes the need for developers to implement robust authorization logic, as GraphQL itself does not inherently secure data. It also discusses the risks of nested queries leading to DoS attacks and information disclosure through error messages. → blog.doyensec.com |
| 2025-08-14 2025 | Facebook GraphQL CSRF – These aren't the access_tokens you're looking for intermediate CSRF | The content appears to be about a security vulnerability related to Facebook's GraphQL technology, specifically concerning Cross-Site Request Forgery (CSRF) attacks. The title suggests that access tokens may be involved in this vulnerability. It seems to warn users or developers that the access tokens they are using may not be secure or may be compromised in some way. The phrase "These aren't the access_tokens you're looking for" implies that there may be deceptive or unauthorized access tokens being used in this context. |
| 2025-08-14 2025 | gsmith257-cyber/GraphCrawler: GraphQL automated security testing toolkit beginner 2 min read | Tool for automated GraphQL endpoint security testing. GraphCrawler integrates with Escape Technology's Graphinder for endpoint discovery and can utilize Clairvoyance to brute-force schemas when introspection is disabled. It checks for enabled mutations, sensitive queries, and authentication requirements, scoring findings from 1-10. The tool also supports graphql-path-enum for deeper schema exploration. |
| 2025-08-14 2025 | Exploiting GraphQL intermediate 6 min read API Sec | Tool for auditing GraphQL APIs, BatchQL, identifies introspection query support, schema suggestions, CSRF vulnerabilities, and JSON/query name based batching. It aids in recovering GraphQL schemas using tools like Clairvoyance and Clairvoyancex, and can detect potential CSRF by sending GET and POST requests. BatchQL enables batching attacks, such as attempting all possible password reset PINs in a single query, bypassing rate limiting. |
| 2025-08-14 2025 | GraphQL introspection leads to sensitive data disclosure. intermediate | GraphQL introspection can potentially lead to the disclosure of sensitive data. Introspection allows clients to query the schema and understand the structure of the API, which can inadvertently expose sensitive information. It is important for developers to carefully manage introspection capabilities to prevent unauthorized access to confidential data. |
| 2025-08-14 2025 | GraphQL Introspection leads to Sensitive Data Disclosure. intermediate | GraphQL Introspection can potentially lead to the disclosure of sensitive data. This feature allows clients to query the schema of a GraphQL API, potentially exposing information that should be kept private. It is essential for developers to be cautious when using GraphQL Introspection to prevent unintentional disclosure of sensitive data. |
| 2025-08-14 2025 | swisskyrepo/GraphQLmap: GraphQLmap is a scripting engine to interact with a intermediate 4 min read | Tool for pentesting GraphQL endpoints, GraphQLmap offers a scripting engine to interact with APIs. It supports schema dumping, query execution for both queries and mutations, and fuzzing capabilities using placeholders like `GRAPHQL_CHARSET`, `GRAPHQL_INCREMENT`, `BATCHING_PLACEHOLDER`, and `BLIND_PLACEHOLDER`. It also includes functions for detecting SQL injection vulnerabilities like `nosqli`, `postgresqli`, and `mysqli`. |
| 2025-08-14 2025 | br3akp0int/GQLParser: A repository for GraphQL Extension for Burp Suite intermediate 2 min read | Extension for Burp Suite that automatically detects and parses GraphQL requests, presenting dynamic user input parameters in a structured format for easier payload injection. This tool simplifies the process of tampering with GraphQL queries by allowing testers to edit queries directly within Burp Suite and send them to Repeater for further analysis and vulnerability testing. It aims to integrate with Burp's Scanner to facilitate integer scanning and optimize the scanner for reduced bad requests, with ongoing development for core GraphQL vulnerability scanning. |
| 2025-08-14 2025 | doyensec/graph-ql: GraphQL Security Research Material beginner 3 min read | Tool for GraphQL security testing; InQL scans endpoints, auto-generates queries, and analyzes for vulnerabilities like circular references. It integrates with Burp for enhanced request manipulation and allows custom headers per domain. InQL also supports batch query execution for rate limit circumvention and engine fingerprinting, even when introspection is disabled, using regex pattern matching. |
| 2025-02-01 2025 | GraphQL - HackTricks beginner 21 min read | Library for understanding GraphQL security vulnerabilities. It details how GraphQL's efficiency in data fetching can introduce security risks if authentication is not properly implemented. The library covers common paths for discovering GraphQL endpoints, using tools like graphw00f, and leveraging introspection with queries like `query { __typename }` and `query { __schema { types { name, fields { name } } } }` to enumerate schema information and extract data. |
| 2024-10-17 2024 | 👩💻Roadmap to Cybersecurity in 2022, Full-Read SSRF, IDOR in GraphQL, GCP Pentesting, and much… intermediate SSRF | The content discusses a talk focusing on cybersecurity in 2022, covering topics such as SSRF, IDOR in GraphQL, GCP Pentesting, and more. The talk highlights the significant value, over $25 billion, that is at risk due to practical attacks on bridges. It emphasizes the importance of understanding and addressing vulnerabilities in cybersecurity to protect valuable assets. → infosecwriteups.com |
| 2024-09-14 2024 | Mastering GraphQL API Pentesting: The Ultimate Resource Guide beginner Bug Bounty | Hello! I’m Raunak Gupta, a Security Researcher, Bug Bounty Hunter, and Computer Science student from India. Today, I’m excited to share all… |
| 2023-10-05 2023 | Mastering the Realm of GraphQL Exploitation advanced | The content titled "Mastering the Realm of GraphQL Exploitation" likely delves into advanced techniques for exploiting vulnerabilities in GraphQL implementations. It may cover topics such as security risks, common attack vectors, and strategies for securing GraphQL APIs. The content is likely aimed at individuals looking to deepen their understanding of GraphQL security and improve their ability to identify and mitigate potential exploits in GraphQL applications. |
| 2023-05-29 2023 | Slides: GraphQL Hacking beginner Talks | Slides: GraphQL Hacking https://ift.tt/oLqt1GD |
| 2022-05-11 2022 | Favorite tweet by @harshbothra_ beginner | Favorite tweet: 7 Free Practice Labs to Master GraphQL Attacks 🧵 — Harsh Bothra (@harshbothra_) May 11, 2022 |
| 2022-01-08 2022 | Damn Vulnerable GraphQL Application beginner 2 min read API Sec | Library for practicing GraphQL security, DVGA is an intentionally vulnerable implementation designed to teach and test for various flaws including Injections, Code Executions, Bypasses, and Denial of Service attacks. It offers Beginner and Expert modes and covers exploitation techniques such as Batch Query, Deep Recursion, and Authorization Bypass. DVGA supports common installation via Git or Docker and requires Python3, Flask, and Graphene. |
| 2021-09-06 2021 | Exploiting GraphQL news 6 min read | Tool for auditing GraphQL endpoints. BatchQL identifies introspection query support, schema suggestions, potential CSRF, query name based batching, and JSON list based batching. It can perform batch queries and mutations, potentially bypassing rate limiting for sensitive functionalities like password resets. The tool also aids in discovering GraphQL schemas, a crucial step for understanding the attack surface. |
| 2020-02-25 2020 | doyensec/graph-ql: GraphQL Security Research Material intermediate 3 min read | Tool for GraphQL security testing, InQL offers a Scanner to auto-generate queries and mutations, a Points of Interest analysis for vulnerability detection, and circular reference detection. It seamlessly integrates with Burp for enhanced interactions, supports custom headers, and allows batch GraphQL attacks. InQL also includes an engine fingerprinting scanner to retrieve backend server technology information and can recreate schemas even when introspection is disabled. |
| 2020-01-19 2020 | Facebook GraphQL CSRF – These aren't the access_tokens you're looking for intermediate CSRF | A CSRF bug in business.instagram.com allowed unauthorized GraphQL calls. The bug was discovered in the View the Assigned Roles and Emails of an Instagram Account feature. Users without an Instagram Business account encountered an error page during login. This issue highlights a potential security vulnerability in Facebook's GraphQL system. |
| 2020-01-13 2020 | GraphQL IDOR leads to information disclosure - Eshan Singh - Medium intermediate IDOR | Eshan Singh, also known as R0X4R, discusses a recent discovery of an Insecure Direct Object Reference (IDOR) vulnerability in GraphQL that led to information disclosure. The article likely delves into the impact and implications of this vulnerability in GraphQL systems. |