Black Hat GraphQL

Jul 7, 2026

Black Hat GraphQL delivers a security-focused deep dive into how GraphQL works and how attacks are performed across the API lifecycle. The book starts with GraphQL foundations, then guides readers in building a GraphQL security lab using common tools and vulnerable targets. It systematically covers attack surface discovery, denial-of-service techniques, information disclosure through schema and errors, authentication and authorization bypasses, multiple injection classes, and request forgery/hijacking scenarios, ending with real-world disclosed vulnerabilities and exploits.

LanguageEnglish

CategoryTechnology

FormatPDF

Pages414

Reading Time17 h 23 min

Introduction

Who This Book Is For

What’s in This Book

A Primer on GraphQL

The Schema

Queries and Resolvers

GraphQL APIs vs. REST APIs

Setting Up a GraphQL Security Lab

Installing Kali and Web Clients

Deploying DVGA

Installing GraphQL Hacking Tools

The GraphQL Attack Surface

Queries, Mutations, and Subscriptions

Introspection

Common Weaknesses

Reconnaissance

Detecting GraphQL and Endpoints

Introspection and Fingerprinting

Denial of Service

GraphQL DoS Vectors

Defenses and Mitigations

Information Disclosure

Schema Extraction and Disabled Introspection

Error Messages and GET-Based Queries

Authentication and Authorization Bypasses

Authentication Testing

Authorization Testing

Injection

SQL Injection, Command Injection, and XSS

Request Forgery and Hijacking

CSRF, SSRF, and WebSocket Hijacking

CONTENTS IN DETAIL TITLE PAGE COPYRIGHT ABOUT THE AUTHORS FOREWORD ACKNOWLEDGMENTS INTRODUCTION Who This Book Is For The Book’s Lab and Code Repository What’s in This Book CHAPTER 1: A PRIMER ON GRAPHQL The Basics Origins Use Cases Specification How Do Communications Work? The Schema Queries The Query Parser and Resolver Functions What Problems Does GraphQL Solve? GraphQL APIs vs. REST APIs The REST Example The GraphQL Example Other Differences Your First Query Summary CHAPTER 2: SETTING UP A GRAPHQL SECURITY LAB Taking Security Precautions Installing Kali Installing Web Clients Querying from the Command Line with cURL Querying from a GUI with Altair Setting Up a Vulnerable GraphQL Server Installing Docker Deploying the Damn Vulnerable GraphQL Application Testing DVGA Installing GraphQL Hacking Tools Burp Suite Clairvoyance InQL Graphw00f BatchQL Nmap Commix graphql-path-enum EyeWitness GraphQL Cop CrackQL Summary CHAPTER 3: THE GRAPHQL ATTACK SURFACE What Is an Attack Surface? The Language Queries, Mutations, and Subscriptions Operation Names Fields Arguments Aliases Fragments Variables Directives Data Types Objects Scalars Enums Unions Interfaces Inputs Introspection Validation and Execution Common Weaknesses Specification Rule and Implementation Weaknesses Denial of Service Information Disclosure Authentication and Authorization Flaws Injections Summary CHAPTER 4: RECONNAISSANCE Detecting GraphQL Common Endpoints Common Responses Nmap Scans The typename Field Graphw00f Detecting GraphiQL Explorer and GraphQL Playground Scanning for Graphical Interfaces with EyeWitness Attempting a Query Using Graphical Clients Querying GraphQL by Using Introspection Visualizing Introspection with GraphQL Voyager Generating Introspection Documentation with SpectaQL Exploring Disabled Introspection Fingerprinting GraphQL Detecting Servers with Graphw00f Analyzing Results Summary CHAPTER 5: DENIAL OF SERVICE GraphQL DoS Vectors Circular Queries Circular Relationships in GraphQL Schemas How to Identify Circular Relationships Circular Query Vulnerabilities Circular Introspection Vulnerabilities Circular Fragment Vulnerabilities Field Duplication Understanding How Field Duplication Works Testing for Field Duplication Vulnerabilities Alias Overloading Abusing Aliases for Denial of Service Chaining Aliases and Circular Queries Directive Overloading Abusing Directives for Denial of Service Testing for Directive Overloading Object Limit Overriding Array-Based Query Batching Understanding How Array-Based Query Batching Works Testing for Array-Based Query Batching Chaining Circular Queries and Array-Based Query Batching Detecting Query Batching by Using BatchQL Performing a DoS Audit with GraphQL Cop Denial-of-Service Defenses in GraphQL Query Cost Analysis Query Depth Limits Alias and Array-Based Batching Limits Field Duplication Limits Limits on the Number of Returned Records Query Allow Lists Automatic Persisted Queries Timeouts Web Application Firewalls Gateway Proxies Summary CHAPTER 6: INFORMATION DISCLOSURE Identifying Information Disclosure Vectors in GraphQL Automating Schema Extraction with InQL Overcoming Disabled Introspection Detecting Disabled Introspection Exploiting Non-production Environments Exploiting the type Meta-field Using Field Suggestions Understanding the Edit-Distance Algorithm Optimizing Field Suggestion Use Considering Security Developments Using Field Stuffing Type Stuffing in the type Meta-field Automating Field Suggestion and Stuffing Using Clairvoyance Abusing Error Messages Exploring Excessive Error Messaging Enabling Debugging Inferring Information from Stack Traces Leaking Data by Using GET-Based Queries Summary CHAPTER 7: AUTHENTICATIO

FAQs

What core GraphQL concepts does the book cover before moving to security testing?

It covers GraphQL basics, the schema, how queries and resolvers work, and how GraphQL differs from REST APIs, including practical examples like the first query and communication flow.

How does the book guide readers to set up a GraphQL security lab?

It provides step-by-step instructions for taking security precautions, installing Kali and web clients, querying via command line and GUI tools, deploying a deliberately vulnerable GraphQL server (DVGA) using Docker, and installing common GraphQL hacking tools.

Which vulnerability classes are analyzed in depth for GraphQL systems?

The book examines denial of service, information disclosure (including schema extraction and error leakage), authentication and authorization bypasses, injection vulnerabilities (SQLi, command injection, XSS), and request forgery/hijacking such as CSRF, SSRF, and WebSocket hijacking.

Jul 7, 2026

Upload by Olivia Brown