GraphQL learning path

Orientation and first principles — what the bug class is and how it behaves.

1. 9 Ways To Secure your GraphQL API - Apollo Checklist
   10 min readapollographql.com2026
   Checklist of 9 security measures for GraphQL APIs, detailing strategies for authentication and authorization using JWTs, reducing attack surface area by limiting query depth with `graphql-depth-limit`, paginating list fields, improving input validation and sanitization, implementing timeouts, rate limiting, query cost analysis, and safelisting operations via automatic persisted queries. It also covers limiting API discoverability by disabling introspection in production.
2. GraphQL Discovery: Pentesting 101 Guide
   5 min readescape.tech2026
   Guide on GraphQL discovery for penetration testing, this installment of the "Pentesting GraphQL 101" series details techniques for understanding endpoint limits, determining verbosity, and fetching API schema information through methods like basic queries, mutation checks for CSRF, aliasing, and character limits. It highlights the importance of query timing and error analysis, recommending tools like Altair for interaction and leveraging introspection or "did you mean" suggestions for schema discovery, referencing the `awesome-graphql-security` list for resources.
3. The Complete GraphQL Security Guide: Fixing the 13 Most Common Vulnerabilities
   28 min readwundergraph.com2026
   Guide detailing 13 common GraphQL vulnerabilities, including parser bugs, normalization issues, and execution flaws leading to denial-of-service attacks. It emphasizes the complexity of GraphQL parsing and validation compared to URLs, highlighting the potential for exploitation due to the inherent flexibility of GraphQL operations and the lack of robust, widely adopted testing frameworks like the defunct CATS project. The guide stresses the need for rigorous testing of GraphQL libraries and frameworks to mitigate risks.
4. Hacking (and Securing) GraphQL
   13 min readblog.arcjet.com2026
   Library securing GraphQL APIs against common attack vectors like SQL injection, XSS, and denial-of-service (DoS) via query batching, aliasing, duplication, and circular queries. It details how introspection queries can reveal the API schema and emphasizes the importance of input sanitization for mutations and queries to prevent injection attacks. The library also highlights Arcjet's role in analyzing requests within route handlers or middleware for enhanced security.
5. GraphQL API Vulnerabilities - PortSwigger
   11 min readportswigger.net2026
   Library for testing GraphQL APIs, detailing common vulnerabilities like introspection enablement and insecure direct object references (IDORs). It covers techniques for discovering GraphQL endpoints, including universal queries and common endpoint names, and demonstrates how to exploit unsanitized arguments to access unauthorized data. The library also explains how to use introspection queries to gather schema information and identifies methods for probing and running full introspection queries against vulnerable endpoints.

Real testing methodology, tooling, and writeups that show the work.

1. The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
   6 min readwiz.io2026
   Library for discovering and exploiting Broken Object-Level Authorization (BOLA) vulnerabilities in GraphQL APIs. This resource details a Red Agent's autonomous exploitation of an airline's booking API, demonstrating how predictable integer identifiers combined with a lack of backend authorization checks allowed for the mass extraction and modification of sensitive passenger data, including names, dates of birth, billing addresses, masked credit cards, and live flight itineraries. The exploit achieved full read and write capabilities over active travel plans within minutes, highlighting the inadequacy of traditional security tools against such logic flaws.
2. The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
   6 min readwiz.io2026
   Library for identifying Broken Object-Level Authorization (BOLA) vulnerabilities, exemplified by an airline's GraphQL booking API exploit. The Red Agent autonomously discovered mass data extraction and write capabilities by manipulating sequential booking IDs without backend authorization checks. This bypass allows unauthenticated access to passenger details, flight itineraries, and payment information, highlighting the critical need for strict object-level access controls on API resolvers.
3. GraphQL Security Testing: Introspection Abuse, Injection, and DoS
   11 min readredteamworldwide.com2026
   Library for precise GraphQL API penetration testing, focusing on a phase-based methodology. It covers schema enumeration via introspection, including using GraphQL Voyager for visualization and Clairvoyance to reconstruct schemas when introspection is disabled. The guide details injection vulnerability testing, specifically for SQL/NoSQL injection in arguments, SSRF via URL-accepting fields, and stored XSS in mutations, recommending tools like Burp Suite and the InQL extension. It also addresses denial-of-service risks through nested query depth attacks and alias-based duplication.
4. Hacking GraphQL Endpoints in Bug Bounty Programs | YesWeHack
   8 min readyeswehack.com2026
   Library for identifying and exploiting GraphQL vulnerabilities, this guide details techniques such as abusing introspection queries and field suggestions, and performing mutation manipulation and batching attacks. It covers common vulnerabilities like information disclosure, IDOR, and improper access control, recommending tools such as GraphQL Voyager, InQL, Clairvoyance, and GraphQLmap for both introspection and fuzzing attacks when introspection is disabled.
5. Teycir/BurpAPISecuritySuite: Burp Suite extension for API security testing with 15 attack types, 108+ payloads, intelligent fuzzing, BOLA/IDOR detection, AI integration, and automated reconnaissance. Supports REST/GraphQL/SOAP APIs with Nuclei, Turbo Intruder, and external tool integration. OWASP API Top 10 coverage.
   38 min readgithub.com2025
   Library of Burp Suite extensions offering comprehensive API security testing, including 15 attack types and over 108 payloads. It features intelligent fuzzing, BOLA/IDOR detection, AI integration, and automated reconnaissance for REST, GraphQL, and SOAP APIs. The suite integrates with Nuclei, Turbo Intruder, and other external tools, providing broad coverage of OWASP API Top 10 vulnerabilities and advanced techniques like differential analysis and token lineage tracking.

Novel research, edge cases, and the techniques that push the class forward.

1. Mastering the Realm of GraphQL Exploitation
   infosecwriteups.com2025
   The content is titled "Mastering the Realm of GraphQL Exploitation" and appears to focus on the topic of exploiting GraphQL. It suggests a deep dive into understanding and potentially exploiting GraphQL, a query language for APIs. The title implies that the content may cover advanced techniques or strategies for manipulating GraphQL queries to gain unauthorized access or extract sensitive information.
2. Mastering the Realm of GraphQL Exploitation
   medium.com2023
   The content titled "Mastering the Realm of GraphQL Exploitation" likely delves into advanced techniques for exploiting vulnerabilities in GraphQL implementations. It may cover topics such as security risks, common attack vectors, and strategies for securing GraphQL APIs. The content is likely aimed at individuals looking to deepen their understanding of GraphQL security and improve their ability to identify and mitigate potential exploits in GraphQL applications.