The newest GraphQL resources are on the GraphQL page. For a reading order instead of a date order, see the GraphQL learning path.
| Date Added | Link | Excerpt |
|---|---|---|
| 2023-10-05 2023 | Mastering the Realm of GraphQL Exploitation advanced | The content titled "Mastering the Realm of GraphQL Exploitation" likely delves into advanced techniques for exploiting vulnerabilities in GraphQL implementations. It may cover topics such as security risks, common attack vectors, and strategies for securing GraphQL APIs. The content is likely aimed at individuals looking to deepen their understanding of GraphQL security and improve their ability to identify and mitigate potential exploits in GraphQL applications. |
| 2023-05-29 2023 | Slides: GraphQL Hacking beginner Talks | Slides: GraphQL Hacking https://ift.tt/oLqt1GD |
| 2022-05-11 2022 | Favorite tweet by @harshbothra_ beginner | Favorite tweet: 7 Free Practice Labs to Master GraphQL Attacks 🧵 — Harsh Bothra (@harshbothra_) May 11, 2022 |
| 2022-01-08 2022 | Damn Vulnerable GraphQL Application beginner 2 min read API Sec | Library for practicing GraphQL security, DVGA is an intentionally vulnerable implementation designed to teach and test for various flaws including Injections, Code Executions, Bypasses, and Denial of Service attacks. It offers Beginner and Expert modes and covers exploitation techniques such as Batch Query, Deep Recursion, and Authorization Bypass. DVGA supports common installation via Git or Docker and requires Python3, Flask, and Graphene. |
| 2021-09-06 2021 | Exploiting GraphQL news 6 min read | Tool for auditing GraphQL endpoints. BatchQL identifies introspection query support, schema suggestions, potential CSRF, query name based batching, and JSON list based batching. It can perform batch queries and mutations, potentially bypassing rate limiting for sensitive functionalities like password resets. The tool also aids in discovering GraphQL schemas, a crucial step for understanding the attack surface. |
| 2020-02-25 2020 | doyensec/graph-ql: GraphQL Security Research Material intermediate 3 min read | Tool for GraphQL security testing, InQL offers a Scanner to auto-generate queries and mutations, a Points of Interest analysis for vulnerability detection, and circular reference detection. It seamlessly integrates with Burp for enhanced interactions, supports custom headers, and allows batch GraphQL attacks. InQL also includes an engine fingerprinting scanner to retrieve backend server technology information and can recreate schemas even when introspection is disabled. |
| 2020-01-19 2020 | Facebook GraphQL CSRF – These aren't the access_tokens you're looking for intermediate CSRF | A CSRF bug in business.instagram.com allowed unauthorized GraphQL calls. The bug was discovered in the View the Assigned Roles and Emails of an Instagram Account feature. Users without an Instagram Business account encountered an error page during login. This issue highlights a potential security vulnerability in Facebook's GraphQL system. |
| 2020-01-13 2020 | GraphQL IDOR leads to information disclosure - Eshan Singh - Medium intermediate IDOR | Eshan Singh, also known as R0X4R, discusses a recent discovery of an Insecure Direct Object Reference (IDOR) vulnerability in GraphQL that led to information disclosure. The article likely delves into the impact and implications of this vulnerability in GraphQL systems. |