Dokumen ini membahas tentang kerentanan GraphQL dan eksploitasi melalui serangan traversal dalam konteks pengujian penetrasi. Pembicara, Rifqi Hilmy Zhafrant, menjelaskan konsep dasar GraphQL serta metodologi serangan yang mencakup introspeksi skema dan identifikasi rute ke bidang target. Studi kasus dari aplikasi dummy dan penggunaan skenario dunia nyata juga disajikan untuk mengilustrasikan cara kerja serangan tersebut.

1. Hunting and Exploiting
GraphQL Vulnerability
for Phun and Profit
by SecLab Indonesia IDSECCONF 2024

2. whoami
Rifqi Hilmy Zhafrant
Penetration Tester @seclab.id
Bug Bounty Hunter (@hackerone)
Student of brawijaya university
First Timer at IDSECCONF

4. GraphQL Concepts
Case Studies
Attack on dummy and real world
application.
Agenda
Schema Definition and schema introspection.
The Traversal Attack
Attack methodology.
Summary
Recap the session.

5. GraphQL Concepts

6. GraphQL

7. Defining Type
ScalarType (ID, Int, Float String, Boolean)
ObjectType
EnumType

8. used to manipulate (create, update, delete) data.
used to read data.
GraphQL Mutation
GraphQL Query
Root Operation

9. Resolver
Query Resolver

10. Query Client-Side Usage
Mutation

11. The Metadata Fields

12. Introspection Query

13. Introspection Query

14. GraphQL Voyager
Source:
https://graphql-kit.com/graphql-voyager/

15. The Traversal Attack
(I prefer “Object Chaining” Attack)

16. Traversal Attack?

17. Attack Flow
Introspect the Schema Identify and Find Route
to Target Fields
Construct and Execute
Query

18. Case Studies

19. The Dummy Application

20. The Dummy Application

21. The Dummy Application

22. Attack - Introspect the Schema

23. Attack - Introspect the Schema

24. Target
Attack - Identify and Find Route to Target Fields

25. Attack - Identify and Find Route to Target Fields

26. Attack - Identify and Find Route to Target Fields

27. Attack - Identify and Find Route to Target Fields

28. Attack - Identify and Find Route to Target Fields

29. Attack - Identify and Find Route to Target Fields

30. Attack - Identify and Find Route to Target Fields

31. Attack - Construct and Execute Query (Demo)

33. Attack - Construct and Execute Query

34. Target: OrganizationObject
Real World Scenario

35. Real Case PoC
Exploitation
Query

36. Summary

37. GraphQL Concepts
(Schema definition,
schema introspection)
Traversal Attack
(Methodology and
attack flow)
Case Studies
(Implementation)

38. Thank You
Rifqi Hilmy Zhafrant