GraphQL - Escape - Application Security & Offensive Security Blog (Page 2)

Pentesting

GraphQL Pentesting 101: Part 2-Interaction Explained

A Pentester is usually expected to be a higher than average user in terms of interaction with an endpoint. For that reason, I decided to add an intermediary step between "Discovery" and "Exploiting" called "Interaction." This article is part of the series "Pentesting GraphQL 101". 1. Pentesting GraphQL 101 Part 1 - Discovery 2. Pentesting GraphQL 101 Part 2 - Interaction 3. Pentesting GraphQL 101 Part 3 - Exploitation Today's article contains three real-life examples that hopefully provid

Karim Rustom

July 29, 2022 5 min read

Postman

How to Use GraphQL with Postman: A Complete Guide

If you're building an API, you need tools to query it. Postman is the go-to tool for querying APIs, whether using the Postman GraphQL client or the Postman HTTP request interface. It allows you to create and send requests to your endpoints and so much more. Postman has loads of built-in parameters and features, such as custom cookies, environment variables, scripting, testing, and exporting requests to HTTP clients (curl, fetch, python, axios...). Postman also allows you to share and collaborat

Nohé Hinniger-Foray

July 26, 2022 5 min read

Pentesting

GraphQL Discovery: Pentesting GraphQL 101 Part 1

Recent statistics say that you have queried at least one GraphQL endpoint today. For me, as a Penetration tester, it is just a matter of concern, especially since high-quality Pentesting guides/articles are scarce online, which only signals that GraphQL security is still rudimentary. So I decided to start this series of articles: Pentesting GraphQL 101, where I try to share my GraphQL security experience from an attacker/pentester point of view; each piece will handle a, dare I say, chronologic

Karim Rustom

July 19, 2022 6 min read

Announcement

GraphQL Postman Collection: Generate Instantly with GraphMan

While querying, developing, and testing your GraphQL APIs with postman is easy and convenient, it has a big caveat: if you want to cover an endpoint with all its queries and mutations entirely, it will take you hours and repetitive steps to create every request, and you'll almost surely miss queries, arguments or fields. However, GraphQL APIs can provide their schema, which describes the complete endpoint exhaustively, and this can be exploited for many things: autocompletion, type-safety, etc.

Nohé Hinniger-Foray

July 11, 2022 3 min read

AppSec

GraphQL Security: 9 Best Practices You Need to Know

GraphQL has no security by default. All doors are open for the most basic attacks. Read more to learn about the exact threats and some simple strategies you can implement to get your users' data under lock and key 🔐

Achraf Ait Sidi Hammou

March 11, 2022 8 min read