GraphQL Exploitation: Secondary Context Attacks and Business Logic
summary
GraphQL servers commonly forward client input into internal REST calls so path traversal via ID/string input lets attackers pivot into backend APIs; real assessments chain that with a leaked GUID and perform blind SQL injection to exfiltrate database rows and with path-reversal plus hard-coded BFF auth to access other users’ accounts and cross‑tenant data (examples include large breaches and a 100M-customer blog case). Tooling used includes Burp (custom burp parser plugin), Clairvoyance and timing attacks, and fixes like strict typed scalars.
AI-written summary · about
chapters (13)
- 0:00GraphQL exploitation intro
- 1:03Secondary context attacks
- 6:19GraphQL design patterns
- 7:22Real-world exploitation example
- 11:12Testing methodology
- 14:27GraphQL case study
- 17:39Scalers and input risks
- 20:49Discovery tooling
- 24:22Secure by default
- 27:58Offensive testing
- 30:02Defensive recommendations
- 31:44Detection challenges
- 32:06Q&A
related talks
43mBe Cool and Hack GraphQL
23mGraphQL Security Vulnerabilities in the Wild
15mNavigating GraphQL Vulnerabilities: SRE / DevSecOps
27mWhy Your GraphQL APIs Are Increasingly Under Attack
32mMind your GraphQL APIs: how to reduce their attack surface
37mIs your GraphQL API safe? Let’s find out
29mDamn GraphQL - Defending and Attacking APIs
33mApisecure, 14 & 15 March 2023 - Parth Shukla, Security Analyst at Cequence Security.