Apisecure, 14 & 15 March 2023 - Parth Shukla, Security Analyst at Cequence Security.
summary
Demonstrates concrete GraphQL attacks and fixes: uses ffuf to find endpoints, GraphQL Voyager to map introspection output, and a batch testing tool to show how batching vulnerability plus enabled mutations lets an attacker read customer emails and cart values and change product prices (a live POC that earned a four‑digit bounty). Shows directive overloading and injection proofs, measures query execution growth, and proves mitigations that work: disable public introspection, enforce depth and rate limits, cost analysis, whitelists and pagination.
AI-written summary · about
chapters (19)
- 0:00APIsecure introduction
- 0:26What is GraphQL
- 1:30GraphQL vs REST APIs
- 3:39GraphQL API types
- 4:43GraphQL vulnerabilities
- 5:05Introspection vulnerability
- 7:13GraphQL Voyager visualization
- 9:20Introspection attacks impact
- 10:26Batching attack vector
- 12:36Batching DoS attacks
- 15:06Batching auth bypass
- 16:52Directive overloading
- 19:42Mitigating GraphQL flaws
- 22:29Disable introspection
- 23:33Prevent GraphQL injection
- 24:37Pagination for data limits
- 24:58Automated security checks
- 27:49Free security resources
- 29:58Q&A
related talks
43mBe Cool and Hack GraphQL
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
26mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs.
51mAPI Security: Securing GraphQL without going around in circles
23mGraphQL Security Vulnerabilities in the Wild
27mWhy Your GraphQL APIs Are Increasingly Under Attack
29mTop 10 GraphQL Security Checks for Every Developer
39mDon't Panic: A Developer's Guide to Building Secure GraphQL APIs