Karim Rustom - Escape - The API Security Blog

Thinking outside the box when pentesting GraphQL

The hardest part when pentesting any system is undoubtedly answering the question: 💡How should we think of that? What is meant is "how outside-the-box thinking works?", and "how is a pentester meant to think outside the box?". Although tackling this question might seem like a near

How Gorillas's GraphQL API was leaking data from 10000 customers

German on-demand online grocery delivery company Gorillas took the industry by storm, guaranteeing delivery in under 10 minutes and gaining massive popularity throughout the pandemic. Founded in May 2020, Gorillas rapidly spread to dozens of European cities and America. After only three funding rounds, the last of which was in

GraphQL

Secure your GraphQL API within your CI/CD

Enhance CI/CD security with Escape GraphQL integration. Detect vulnerabilities early, prevent costly consequences, and turn DevOps into DevSecOps

Escape joins the GraphQL Foundation to push for a more secure ecosystem

Alongside AWS, Microsoft, META, and PayPal, Escape has joined GraphQL Foundation to lend a hand to the GraphQL community in securing their APIs. Two years have passed since Escape members dedicated their work to providing all the necessary tools, support, and information to help the GraphQL community develop the most

Pentesting GraphQL 101 Part 3 - Exploitation

This article is part of the series "Pentesting GraphQL 101". 1. Pentesting GraphQL 101 Part 1 - Discovery 2. Pentesting GraphQL 101 Part 2 - Interaction 3. Pentesting GraphQL 101 Part 3 - Exploitation Exploitation or finding vulnerabilities might not be the most crucial step in a typical

Pentesting

Pentesting GraphQL 101 Part 2 - Interaction

A Pentester is usually expected to be a higher than average user in terms of interaction with an endpoint. For that reason, I decided to add an intermediary step between "Discovery" and "Exploiting" called "Interaction." This article is part of the series "Pentesting

Pentesting

Pentesting GraphQL 101 Part 1 - Discovery

Recent statistics say that you have queried at least one GraphQL endpoint today. For me, as a Penetration tester, it is just a matter of concern, especially since high-quality Pentesting guides/articles are scarce online, which only signals that GraphQL security is still rudimentary. So I decided to start this