This document discusses attacking GraphQL APIs. It begins with an overview of GraphQL, how it differs from REST APIs, and key GraphQL concepts like queries, mutations, and introspection. It then explains how introspection can be dangerous by revealing an API's schema. Various vulnerabilities are covered like information disclosure, IDOR, injections, and authorization bypass. Tools for analyzing GraphQL APIs are also listed. The document concludes with examples of exploiting common vulnerabilities like stored XSS, authorization bypass, and OS command injection.

1. Attacking GraphQL
Kavisha Sheth

2. What to Expect
● What is GraphQL
● How GraphQL differs from Rest API
● How does GraphQL works
● GraphQL Terminologies
● Introspection
● Why Introspection can be dangerous
● Tools
● Common vulnerabilities & how to exploit them

3. What is GraphQL?
GraphQL is query language used by APIs to access data from the database
through a single endpoint and it make this possible by using a defined schema
which specifies exactly what we want to access.

4. How GraphQL differs from Rest API ?
❖ Rest API
● It fetches all data, whether required or not ( “over-fetching”).
● It makes multiple network requests to get multiple resources.
❖ GraphQL
● GraphQL allows multiple resource requests in a single query call
● Saves time and bandwidth
● Increased complexity == more error

5. https://www.apollographql.com/blog/how-do-i-graphql-
2fcabfc94a01/

6. Where to find endpoints?
GraphQL usually located at specific endpoints
● /graphql
● /qql
● /graphiql
● /graphql/console
● /graph
● /graphql.php
Also, look for request and response referencing for queries and mutations

7. GraphQL Terminologies
● Query : To fetch the data
● Mutations: To modify the data
● Fields: It’s specify that exactly what data we want to receive.
● Node : Object containing the data
● Edge : Connect two nodes

8. Query

9. Mutation

10. Introspection
GraphQL server supports introspection over its schema using the same GraphQL query language.
A server exposes the following introspection queries on the Query operation type.
● __schema : Which enable us to fetch whole schema
● __type : What types schema has
● __queryType : What are the operation available in the schema

11. Introspection
Query

13. https://apis.guru/graphql-voyager/

14. Using Introspection for evil purpose
● Get all Queries
● Get all mutations
● Look for error message/ stack trace
● Look for sensitive informations

15. Enumeration using error message
It reveals actual
value

16. Tools
● InQL burp extension
● GraphQL IDE
● Altair Graphql IDE
● GraphQL map
● graphql-path-enum

17. Attacking GraphQL

18. Vulnerabilities worth looking for !!
● Information Disclosure
● IDOR
● Injections
● Denial of Service
● Authorization Bypass
● Business Logic

19. Injection :: Stored Cross Site Scripting

22. Authorization Bypass :: GraphQL Interface Protection Bypass

24. Code Execution :: OS Command Injection

26. Thank you