Aller au contenu principal

GraphQL Security

30 hours 6 Modules 15+ Labs Intermediate

Course Description​

GraphQL APIs are increasingly common and have unique vulnerabilities. Learn to test GraphQL endpoints professionally.

Learning Objectives​

  1. Enumerate GraphQL schemas
  2. Exploit introspection queries
  3. Bypass authorization controls
  4. Perform injection attacks
  5. Execute DoS attacks
  6. Test batching vulnerabilities

Course Structure​

Modules​

Module 1: GraphQL Fundamentals (4h)​

  • GraphQL vs REST
  • Schema basics
  • Queries and mutations
  • Subscriptions

Module 2: Reconnaissance (5h)​

  • Introspection queries
  • Schema extraction
  • Field discovery
  • Type enumeration

Module 3: Authorization Attacks (6h)​

  • IDOR in GraphQL
  • Field-level authorization
  • Nested query abuse
  • Broken access control

Module 4: Injection Attacks (6h)​

  • SQL injection in GraphQL
  • NoSQL injection
  • OS command injection
  • SSRF via GraphQL

Module 5: DoS & Batching (5h)​

  • Query complexity attacks
  • Circular queries
  • Batching abuse
  • Resource exhaustion

Module 6: Advanced Attacks (4h)​

  • Alias abuse
  • Fragment attacks
  • Mutation exploitation
  • Subscription attacks

Tools​

ToolPurpose
GraphQL VoyagerSchema visualization
InQLBurp extension
AltairGraphQL client
graphql-copSecurity scanner