Search

Escape - Application Security & Offensive Security Blog

Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.

Filters

Achieving end-to-end type safety in a modern JS GraphQL stack – Part 1

Achieving end-to-end type safety in a modern JS GraphQL stack – Part 1

In this article, we will create a simple GraphQL application, a message board, by combining many recent open-source technologies. This article aims to be a showcase of technologies that work well together rather than a complete tutorial on project setup. It is however a long read, so we decided to split it in two parts to make it easier to read. What is end-to-end type safety? Type safety is the property of a program that guarantees that all value types are known at build time. It prevents

Gautier Ben Aïm

Gautier Ben Aïm

7 min read

GraphQL Pentesting: Thinking Outside the Box

Pentesting

GraphQL Pentesting: Thinking Outside the Box

The hardest part when pentesting any system is undoubtedly answering the question: 💡How should we think of that? What is meant is "how outside-the-box thinking works?", and "how is a pentester meant to think outside the box?". Although tackling this question might seem like a near impossible task, but a good approach would be giving an example of a vulnerability that required "out of box" thinking, dissecting the thought process behind it while trying to answer the "why?" that might pop up.

Karim Rustom

Karim Rustom

3 min read

Code quality controls in our Node.js monorepo

Code quality controls in our Node.js monorepo

A concrete overview of our setup for code quality tools: This highlights how we lint/format code, with a clear focus configuration management through two primary tools: Eslint and Prettier.

Maxence Lecanu

Maxence Lecanu

3 min read

Escape and Snyk officially partner to make GraphQL Security accessible to all developers!

Escape and Snyk officially partner to make GraphQL Security accessible to all developers!

Snyk and Escape provide developers with the ability to secure their GraphQL applications during the development lifecycle through an industry-leading end-to-end AppSec approach that includes SAST, DAST, and Cloud Security. SAST and DAST for GraphQL Applications Integrating Escape with Snyk means that a dynamic application security testing tool (DAST) and a static application security testing (SAST) tool have to discuss with each other. 💡Want to learn more about the advantages of combining

Maxence Lecanu

Maxence Lecanu

3 min read

Access Control and Data Segregation in multi-tenant GraphQL applications

Access Control and Data Segregation in multi-tenant GraphQL applications

If you have ever worked with GraphQL, you must know that ensuring proper data segregation and access control is implemented correctly is a nightmare, especially in multi-tenant environments. Access control and data segregation are critical aspects of any multi-tenant application where multiple customers or tenants share the same application instance. In such environments, ensuring that each tenant's data is isolated and segregated from other tenants' data is crucial. In GraphQL, this is even m

Antoine Carossio

Karim Reda, Antoine Carossio

6 min read

How Gorillas's GraphQL API was leaking data from 10000 customers

How Gorillas's GraphQL API was leaking data from 10000 customers

German on-demand online grocery delivery company Gorillas took the industry by storm, guaranteeing delivery in under 10 minutes and gaining massive popularity throughout the pandemic. Founded in May 2020, Gorillas rapidly spread to dozens of European cities and America. After only three funding rounds, the last of which was in October 2021, the startup was valued at 1 billion dollars, making it the fastest German startup to reach unicorn status (after only nine months). But in our eyes, this w

Karim Rustom

Karim Rustom

3 min read

Securing GraphQL Endpoints in the Full Development Lifecycle

Securing GraphQL Endpoints in the Full Development Lifecycle

I have been working on software development for a year, and I noticed that the essential thing in this process is getting results, not the development process itself. During development, developers usually integrate many different technologies into the project. For example, let's say we are developing a graphQL application. The first technology we need to incorporate into this application is the library that the developer will use to build the graphQL endpoint. Another technology that the develo

Karim Reda

4 min read

GraphQL Security: How to Prevent Data Breaches

GraphQL

GraphQL Security: How to Prevent Data Breaches

Manage your sensitive data in GraphQL applications (PII, passwords, secrets…) We released a new feature in Escape that enables you to detect and fix data leaks with GraphQL. 🚫 The GraphQL Access Control issue, what is it? Access control is the restriction that tells the user who or what can be accessed in your application. When a user can access a forbidden resource, there is an access control vulnerability. Your GraphQL application has a schema that defines the relationship between object

Sophie Boulaaouli

Sophie Boulaaouli

3 min read

Escape joins the GraphQL Foundation to push for a more secure ecosystem

Escape joins the GraphQL Foundation to push for a more secure ecosystem

Alongside AWS, Microsoft, META, and PayPal, Escape has joined GraphQL Foundation to lend a hand to the GraphQL community in securing their APIs. Two years have passed since Escape members dedicated their work to providing all the necessary tools, support, and information to help the GraphQL community develop the most secure endpoints. Escape has taken a new step towards this goal. I am excited to announce that we are now a member of GraphQL Foundation. Our team can’t wait to help the Foundatio

Karim Rustom

Karim Rustom

1 min read

Introducing PyMultiAuth - The ultimate Python Authentication Toolkit

Introducing PyMultiAuth - The ultimate Python Authentication Toolkit

Nowadays, whenever you enter a web application, chances are that it uses some API (REST or GraphQL). Why? Simply because APIs are very beneficial and cost-effective, but despite the numerous advantages that APIs bring to the table, there is one disadvantage that to me as a cyber security engineer outweighs all others: security. When it comes to APIs, security is the number one concern that developers face. This concern is due to the multiple moving parts that they contain. What is more annoying

Karim Reda

7 min read

Pentesting GraphQL 101 Part 3 - Exploitation

Pentesting GraphQL 101 Part 3 - Exploitation

This article is part of the series "Pentesting GraphQL 101". 1. Pentesting GraphQL 101 Part 1 - Discovery 2. Pentesting GraphQL 101 Part 2 - Interaction 3. Pentesting GraphQL 101 Part 3 - Exploitation Exploitation or finding vulnerabilities might not be the most crucial step in a typical pentesting process. Yet, it is what glues the whole pentesting process together through being the unified goal that all other efforts build up to, giving meaning to the entire process. I think exploitation

Karim Rustom

Karim Rustom

6 min read

Find your way in GraphQL applications - Paths explained

Find your way in GraphQL applications - Paths explained

One GraphQL benefit over REST is that you can define a generic backend to serve applications. GraphQL defines its data schema, explicitly providing which object lives in the current application and operations to query these objects. Introduction Let's start with an example schema. type User { name: String! organization: String! } type Query { getUser(name: String!): User } // Query getUser -> User Here, we created a User data structure and made it accessible through the query g

Swan Beaujard

Swan Beaujard

3 min read

Announcing GraphQL Armor support for GraphQL Yoga 2 - Bringing security by default to GraphQL

Announcing GraphQL Armor support for GraphQL Yoga 2 - Bringing security by default to GraphQL

We are utterly excited to introduce GraphQL Armor compatibility with Yoga 2. When the GraphQL Ecosystem encounters Security A few weeks ago, we released GraphQL Armor, an open-source middleware to add a security layer on top of GraphQL endpoints and mitigate common attacks. GraphQL Armor blocks abusive requests by putting reasonable and clever limits on Queries. It was designed as the go-to solution for building secure production GraphQL APIs. We also wanted it to be universal, but it was y

Antoine Carossio

Antoine Carossio

2 min read

Forging GraphQL Bombs, the 2022 version of Zip Bombs

Forging GraphQL Bombs, the 2022 version of Zip Bombs

Zip Bombs are a thing of the past, but the concept behind them is still relevant nowadays. Indeed, your GraphQL application might be vulnerable to what we'll call GraphQL Bombs in this article. Read on to know if you're vulnerable and how to secure your GraphQL application! How do zip bombs work? Before diving into the topic, let's take a moment to understand the concept behind zip bombs. Zip files are lossless compressed archives whose most common compression algorithm is named deflate.

Gautier Ben Aïm

Gautier Ben Aïm

5 min read

Using Rate Limiting to protect your GraphQL API against Brute Force Attacks

Using Rate Limiting to protect your GraphQL API against Brute Force Attacks

For several days now, your users have been complaining about losing access to your web service. If at first you thought it was a simple coincidence and certainly a fault of the users, the incident starts to be strongly repeated and noticed. You rush to your monitors and notice an abnormal rate of requests for a number of days. If you had any doubts before, it is now clear: you are undergoing a brute force attack. Fortunately, this article is here to help you avoid this. What is a Bruteforce a

Achraf Ait Sidi Hammou

Achraf Ait Sidi Hammou

5 min read

Introducing GraphQL Armor - Make GraphQL more Secure than REST in minutes

Introducing GraphQL Armor - Make GraphQL more Secure than REST in minutes

We released GraphQL Armor, a middleware for Apollo Server that adds a security layer to any GraphQL endpoint in minutes. ☠️ GraphQL less secure than REST, really? While being so much more convenient to use, GraphQL is known to introduce security vulnerabilities compared to most modern REST implementations. But GraphQL is not inherently less secure than REST. Usual vulnerabilities in GraphQL actually come from: * engines being misconfigured by default * lack of proper tooling for securing

Thibaud Labat

Thibaud Labat

2 min read

What auditing 1000 endpoints told us about GraphQL Security Best Practices

What auditing 1000 endpoints told us about GraphQL Security Best Practices

This post is a write-up of a talk I gave at the GraphQL San Francisco Conference. You can find the video on youtube. If you are in the bay area do not forget to also join the GraphQL SF group on meetup. It's commonly said that GraphQL is less secure than REST by default. As a company specialized in GraphQL Security, we have explored its security implications for more than a year on a wide range of production-grade endpoints. In this talk, we use data from our free tool GraphQL.Security to exp

Tristan Kalos

Tristan Kalos

9 min read

GraphQL Pentesting 101: Part 2-Interaction Explained

Pentesting

GraphQL Pentesting 101: Part 2-Interaction Explained

A Pentester is usually expected to be a higher than average user in terms of interaction with an endpoint. For that reason, I decided to add an intermediary step between "Discovery" and "Exploiting" called "Interaction." This article is part of the series "Pentesting GraphQL 101". 1. Pentesting GraphQL 101 Part 1 - Discovery 2. Pentesting GraphQL 101 Part 2 - Interaction 3. Pentesting GraphQL 101 Part 3 - Exploitation Today's article contains three real-life examples that hopefully provid

Karim Rustom

Karim Rustom

5 min read

How to Use GraphQL with Postman: A Complete Guide

Postman

How to Use GraphQL with Postman: A Complete Guide

If you're building an API, you need tools to query it. Postman is the go-to tool for querying APIs, whether using the Postman GraphQL client or the Postman HTTP request interface. It allows you to create and send requests to your endpoints and so much more. Postman has loads of built-in parameters and features, such as custom cookies, environment variables, scripting, testing, and exporting requests to HTTP clients (curl, fetch, python, axios...). Postman also allows you to share and collaborat

Nohé Hinniger-Foray

Nohé Hinniger-Foray

5 min read

GraphQL Discovery: Pentesting GraphQL 101 Part 1

Pentesting

GraphQL Discovery: Pentesting GraphQL 101 Part 1

Recent statistics say that you have queried at least one GraphQL endpoint today. For me, as a Penetration tester, it is just a matter of concern, especially since high-quality Pentesting guides/articles are scarce online, which only signals that GraphQL security is still rudimentary. So I decided to start this series of articles: Pentesting GraphQL 101, where I try to share my GraphQL security experience from an attacker/pentester point of view; each piece will handle a, dare I say, chronologic

Karim Rustom

Karim Rustom

6 min read

Monorepos, or the sedimentation of Escape across ages

Monorepos, or the sedimentation of Escape across ages

Every team at Escape works in the same repository. We decided to follow the so-called monorepo workflow. This repository is our ground; its layers are our (concise) history.

Maxence Lecanu

Maxence Lecanu

4 min read

GraphQL Postman Collection: Generate Instantly with GraphMan

Announcement

GraphQL Postman Collection: Generate Instantly with GraphMan

While querying, developing, and testing your GraphQL APIs with postman is easy and convenient, it has a big caveat: if you want to cover an endpoint with all its queries and mutations entirely, it will take you hours and repetitive steps to create every request, and you'll almost surely miss queries, arguments or fields. However, GraphQL APIs can provide their schema, which describes the complete endpoint exhaustively, and this can be exploited for many things: autocompletion, type-safety, etc.

Nohé Hinniger-Foray

Nohé Hinniger-Foray

3 min read

Introducing Secure GraphQL for Everyone

Announcement

Introducing Secure GraphQL for Everyone

Find and fix vulnerabilities in your GraphQL applications — powered by Escape's AI-enhanced business logic testing for GraphQL.

Tristan Kalos

Tristan Kalos

1 min read