Search

Escape - Application Security & Offensive Security Blog

Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.

Filters

October Spotlight: The major events not to be missed

Announcement

October Spotlight: The major events not to be missed

If you’re not yet convinced that the fall is the best season to attend cybersecurity conferences, our upcoming event lineup might change your mind! This month, we're taking our team global, from the US to Monaco, Canada to Sweden. Are you planning to soak up the sun and stay by the beach (hello, sunny San Diego 👋 )? Or are you up for a more adventurous journey to explore Montréal? Whatever your choice, we're here and excited to talk with you about all things API security! So, are you ready to

Alexandra Charikova

Alexandra Charikova

3 min read

Case Study: How Escape enhanced Shine's application security

Case Study

Case Study: How Escape enhanced Shine's application security

Shine is the online banking subsidiary of Société Générale, one of the leading financial services groups in Europe. Specifically designed for professionals with a commitment to innovation and customer satisfaction, Shine offers a range of online banking solutions tailored to the modern user. At the heart of Shine's technological infrastructure is a federated GraphQL system. This advanced system merges REST APIs and is primarily consumed by the company's first-party mobile and web applications.

Alexandra Charikova

Alexandra Charikova

4 min read

Case Study: How Thinkific has achieved enterprise-grade GraphQL security with Escape

Case Study

Case Study: How Thinkific has achieved enterprise-grade GraphQL security with Escape

Thinkific, a leading platform for creating and selling online courses, stands out for its commitment to flexibility and innovation. This dedication to innovative technologies led them to embrace GraphQL APIs as the center of their federated architecture. This system would aim to consolidate multiple existing APIs under one branch. However, achieving this goal while keeping control of the cyber risk is a hard task. Thinkific security team searched for the best solution to achieve the security of

Alexandra Charikova

Alexandra Charikova

4 min read

Using Protobuf with TypeScript

TypeScript

Using Protobuf with TypeScript

We recently moved to Protobuf to enforce consistency. Discover the pros and cons of migration to Protobuf and follow the step-by-step guide to create a tiny TypeScript-Protobuf prototype.

Gautier Ben Aïm

Gautier Ben Aïm

4 min read

CSRF vs XSS: What is the difference?

Best Practices

CSRF vs XSS: What is the difference?

Web safety matters. XSS is like sneaky bad notes, while CSRF tricks sites as if it's you. Both misuse website trust. We'll explore how they work and how to protect sites, including using CSRF tokens. Learn about online security with us!

Swan Beaujard

Swan Beaujard

8 min read

How we found a security misconfiguration in Philips' GraphQL API

Announcement

How we found a security misconfiguration in Philips' GraphQL API

It is a misconception that discovering vulnerabilities is only within the domain of developers and hackers. Jacob, an Account Executive at Escape, proves this notion wrong. What is a vulnerability disclosure? Vulnerability disclosure is the process of reporting security weaknesses in computer software or hardware. Individuals and groups such as security researchers, IT security teams, and in-house or third-party developers can report these vulnerabilities to the parties responsible for the af

Escape - Offensive Security

Escape - Offensive Security

3 min read

Escape and Xolvio officially partner to help teams secure their GraphQL APIs!

Announcement

Escape and Xolvio officially partner to help teams secure their GraphQL APIs!

Keeping APIs secure is vital. However, not all organizations have the in-house resources to tackle it effectively. Xolvio's clients can now leverage Escape's expertise in GraphQL security and performance assessments. They can also integrate it into their CI/CD pipelines, enhancing their API security

Alexandra Charikova

Alexandra Charikova

2 min read

How to set up a TypeScript Monorepo

TypeScript Monorepo

How to set up a TypeScript Monorepo

At Escape, we write our software in TypeScript because it allows us to iterate quickly without compromising on safety. While our codebase evolves a lot as we develop new features, its structure has been stable for a while now. This article aims to explain our current setup, how to put it in place and the developer experience it offers. Understanding the Benefits of a TypeScript Monorepo TypeScript, a statically-typed super-set of JavaScript, allows you to catch errors early and provide robus

Gautier Ben Aïm

Gautier Ben Aïm

6 min read

OWASP API Security TOP 10 2023: API security checklist

API Security

OWASP API Security TOP 10 2023: API security checklist

Discover the latest insights into the 2023 OWASP API Security Top 10, as we delve into the most critical vulnerabilities and best practices to protect your APIs.

Alexandra Charikova

Alexandra Charikova

15 min read

What are Insecure Direct Object References (IDOR) in GraphQL, and how to fix them

GraphQL

What are Insecure Direct Object References (IDOR) in GraphQL, and how to fix them

As developers, ensuring the security of our applications is crucial. Insecure Direct Object References (IDOR) are common security vulnerabilities that occur when a system's internal implementation is exposed to users, allowing them to manipulate references to access unauthorized data. GraphQL, a powerful data query and manipulation language for APIs, is not exempt from this vulnerability. In this blog post, we will dive in detail into what IDOR vulnerabilities are and why they pose a threat to G

Tristan Kalos

Tristan Kalos

8 min read

API Security Academy: How It Works Under the Hood

API Security

API Security Academy: How It Works Under the Hood

The API Security Academy is built upon a technology that comes straight from the future—and by that, we mean the brilliant minds at StackBlitz - WebContainers. You may already know regular containers, the ones you can run with Docker and Kubernetes, which are lightweight virtualization units that allow developers to package and run applications in isolated containers. WebContainers are containers that run directly in the browser, pre-charged with a shell and Node.js. You may run anything in the

Gautier Ben Aïm

Gautier Ben Aïm

3 min read

API Security Academy: a smarter way to learn GraphQL security

GraphQL

API Security Academy: a smarter way to learn GraphQL security

Learning about GraphQL security is now more accessible than ever! We're excited to introduce the API Security Academy, developed by the Escape team. Escape's API Security Academy is a free and open-source collection of interactive challenges that will teach you how to secure your GraphQL applications. The challenges are designed to be fun and engaging, and they will help you learn the following: * How to identify and mitigate security vulnerabilities in GraphQL applications * How to apply Gr

Gautier Ben Aïm

Gautier Ben Aïm

3 min read

What’s new for enterprise - Escape Product Updates

Enterprise

What’s new for enterprise - Escape Product Updates

Our enterprise clients, we've got great news for you! During the last months, we worked hard on releasing new product updates to help you improve the efficiency of your business. From Single Sign-On (SSO) to Audit Logs, system status page, and RBAC (Role-Based Access Control), our goal is to empower your organization with lots of helpful features that streamline operations, enhance security, and improve the productivity of your staff. Let us tell you about them in detail! Improved au

Alexandra Charikova

Alexandra Charikova

7 min read

Top 5 Web3 security breaches: A deep dive into DApp frontend and API vulnerabilities

Web3 Security

Top 5 Web3 security breaches: A deep dive into DApp frontend and API vulnerabilities

The world is gearing more into a phase of individual ownership of data and digital assets without external interference. This metamorphosis of the web is commonly called Web3. It combines frontend technology, smart contracts, and other components of backend technology, such as indexing, querying, and database management. Smart contracts, a vital by-product (or a feature) of Web3, are at the core of many use cases. Initially, interacting with smart contracts without an interface was challenging

Escape - Offensive Security

Escape - Offensive Security

9 min read

September Spotlight: Where to find us at upcoming events

Announcement

September Spotlight: Where to find us at upcoming events

Staying in touch with the cybersecurity community is super important to us. Good news! We're heading to some exciting events in September. Get ready for various talks that are packed with insights and solutions. You're going to walk away ready to tackle any API security challenges that come your way. Our founders and engineers will dive into the chaotic world of GraphQL vulnerabilities. But here's the silver lining - they won't just highlight the problems. They'll also present some smart and p

Alexandra Charikova

Alexandra Charikova

4 min read

How to automate API Specifications for Continuous Security Testing (CT)

REST

How to automate API Specifications for Continuous Security Testing (CT)

While GraphQL APIs are growing in popularity due to their flexible query capabilities, REST currently remains the dominant architectural style for building web APIs. Unlike GraphQL, traditional REST technologies do not inherently provide an interactive schema that clients can use to explore the API. At Escape, we decided to use OpenAPI specifications or Postman Collections as input to a REST scanner instead of GraphQL schema. However, the following issue arises in this context: not all APIs hav

Younes Haddou

Younes Haddou

5 min read

GraphQL Security: Challenges & Best Practices for DApps

Web3 Security

GraphQL Security: Challenges & Best Practices for DApps

Apart from the issue of poor user experience, security is one of the greatest setbacks to global Web3. Blackhats are constantly exploiting Web3 applications to siphon funds. On the 2nd of July, 2023, Poly Network lost about $5 million to a hack. Atomic Wallet lost over $100 million to a breach in June 2023. Jimbos Protocol also lost over $7 million to a security bug. But there is a big misconception about the state of DApps security: most people think breaches happen only on smart contracts. In

Escape - Offensive Security

Escape - Offensive Security

6 min read

GraphQL Wordlist: Free Open Source for Penetration Testing

GraphQL

GraphQL Wordlist: Free Open Source for Penetration Testing

In cybersecurity, the old saying that the "best defense is a good offense" rings true. This philosophy is reflected in the approach we call offensive security. It involves actively seeking out system vulnerabilities to fix them before they can be exploited. It's about taking the initiative, keeping a step ahead of potential threats, and changing how we approach cybersecurity. TL;DR: We built the open source GraphQL wordlist for penetration testing based on 60k+ production GraphQL endpoints. It

Nohé Hinniger-Foray

Nohé Hinniger-Foray

5 min read

Goctopus: Open Source GraphQL Discovery & Fingerprinting

GraphQL

Goctopus: Open Source GraphQL Discovery & Fingerprinting

In the fast-evolving domain of APIs, GraphQL has emerged as a powerful, data-oriented language. As its adoption soars, so does the need for robust tools to discover and fingerprint these APIs. Enter Goctopus, a Golang-based solution we developed at Escape to provide comprehensive, fast, and interoperable endpoint discovery and fingerprinting for GraphQL APIs. Engineered to overcome the limitations of existing tools, Goctopus extends its arms into realms of subdomain enumeration, route brute-forc

Nohé Hinniger-Foray

Nohé Hinniger-Foray

7 min read

GraphQL Query Cost Analysis

GraphQL Query Cost Analysis

You must have understood that GraphQL is a very powerful language! Indeed, it is the query language used by the world's largest social network: Facebook (they created it in 2012 and made it public in 2015). However, these benefits and power also come with added complexity. This complexity leads to several vulnerabilities. One of them is failure to Appropriately Rate-limit. In this article, we will focus on this problem. What is rate limiting? The principle of rate limiting the API is simple.

Tristan KalosAntoine Carossio

Tristan Kalos, Antoine Carossio

5 min read