Escape - Application Security & Offensive Security Blog
Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.
Filters
Pentesting
GraphQL Pentesting: Thinking Outside the Box
The hardest part when pentesting any system is undoubtedly answering the question:
💡How should we think of that?
What is meant is "how outside-the-box thinking works?", and "how is a pentester meant to think outside the box?".
Although tackling this question might seem like a near
3 min read
Escape and Snyk officially partner to make GraphQL Security accessible to all developers!
Snyk and Escape provide developers with the ability to secure their GraphQL applications during the development lifecycle through an industry-leading end-to-end AppSec approach that includes SAST, DAST, and Cloud Security.
SAST and DAST for GraphQL Applications
Integrating Escape with Snyk means that a dynamic application security testing tool (DAST) and
3 min read
Access Control and Data Segregation in multi-tenant GraphQL applications
If you have ever worked with GraphQL, you must know that ensuring proper data segregation and access control is implemented correctly is a nightmare, especially in multi-tenant environments.
Access control and data segregation are critical aspects of any multi-tenant application where multiple customers or tenants share the same application instance.
6 min read
How Gorillas's GraphQL API was leaking data from 10000 customers
German on-demand online grocery delivery company Gorillas took the industry by storm, guaranteeing delivery in under 10 minutes and gaining massive popularity throughout the pandemic.
Founded in May 2020, Gorillas rapidly spread to dozens of European cities and America. After only three funding rounds, the last of which was in
3 min read
Securing GraphQL Endpoints in the Full Development Lifecycle
I have been working on software development for a year, and I noticed that the essential thing in this process is getting results, not the development process itself. During development, developers usually integrate many different technologies into the project. For example, let's say we are developing a graphQL
GraphQL
GraphQL Security: How to Prevent Data Breaches
Manage your sensitive data in GraphQL applications (PII, passwords, secrets…)
We released a new feature in Escape that enables you to detect and fix data leaks with GraphQL.
🚫 The GraphQL Access Control issue, what is it?
Access control is the restriction that tells the user who or what can be
3 min read
Escape joins the GraphQL Foundation to push for a more secure ecosystem
Alongside AWS, Microsoft, META, and PayPal, Escape has joined GraphQL Foundation to lend a hand to the GraphQL community in securing their APIs.
Two years have passed since Escape members dedicated their work to providing all the necessary tools, support, and information to help the GraphQL community develop the most
1 min read
Introducing PyMultiAuth - The ultimate Python Authentication Toolkit
Nowadays, whenever you enter a web application, chances are that it uses some API (REST or GraphQL). Why? Simply because APIs are very beneficial and cost-effective, but despite the numerous advantages that APIs bring to the table, there is one disadvantage that to me as a cyber security engineer outweighs
Pentesting GraphQL 101 Part 3 - Exploitation
This article is part of the series "Pentesting GraphQL 101".
1. Pentesting GraphQL 101 Part 1 - Discovery
2. Pentesting GraphQL 101 Part 2 - Interaction
3. Pentesting GraphQL 101 Part 3 - Exploitation
Exploitation or finding vulnerabilities might not be the most crucial step in a typical
6 min read
Find your way in GraphQL applications - Paths explained
One GraphQL benefit over REST is that you can define a generic backend to serve applications.
GraphQL defines its data schema, explicitly providing which object lives in the current application and operations to query these objects.
Introduction
Let's start with an example schema.
type User {
name: String!
organization:
3 min read
Announcing GraphQL Armor support for GraphQL Yoga 2 - Bringing security by default to GraphQL
We are utterly excited to introduce GraphQL Armor compatibility with Yoga 2.
When the GraphQL Ecosystem encounters Security
A few weeks ago, we released GraphQL Armor, an open-source middleware to add a security layer on top of GraphQL endpoints and mitigate common attacks.
GraphQL Armor blocks abusive requests by putting
2 min read
Forging GraphQL Bombs, the 2022 version of Zip Bombs
Zip Bombs are a thing of the past, but the concept behind them is still relevant nowadays. Indeed, your GraphQL application might be vulnerable to what we'll call GraphQL Bombs in this article. Read on to know if you're vulnerable and how to secure your GraphQL
5 min read
Using Rate Limiting to protect your GraphQL API against Brute Force Attacks
For several days now, your users have been complaining about losing access to your web service. If at first you thought it was a simple coincidence and certainly a fault of the users, the incident starts to be strongly repeated and noticed.
You rush to your monitors and notice an
5 min read
Introducing GraphQL Armor - Make GraphQL more Secure than REST in minutes
We released GraphQL Armor, a middleware for Apollo Server that adds a security layer to any GraphQL endpoint in minutes.
☠️ GraphQL less secure than REST, really?
While being so much more convenient to use, GraphQL is known to introduce security vulnerabilities compared to most modern REST implementations.
But GraphQL is
2 min read
What auditing 1000 endpoints told us about GraphQL Security Best Practices
This post is a write-up of a talk I gave at the GraphQL San Francisco Conference. You can find the video on youtube. If you are in the bay area do not forget to also join the GraphQL SF group on meetup.
It's commonly said that GraphQL is
9 min read
Pentesting
GraphQL Pentesting 101: Part 2-Interaction Explained
A Pentester is usually expected to be a higher than average user in terms of interaction with an endpoint. For that reason, I decided to add an intermediary step between "Discovery" and "Exploiting" called "Interaction."
This article is part of the series "Pentesting
5 min read
Postman
How to Use GraphQL with Postman: A Complete Guide
If you're building an API, you need tools to query it. Postman is the go-to tool for querying APIs, whether using the Postman GraphQL client or the Postman HTTP request interface. It allows you to create and send requests to your endpoints and so much more.
Postman has
5 min read
Pentesting
GraphQL Discovery: Pentesting GraphQL 101 Part 1
Recent statistics say that you have queried at least one GraphQL endpoint today. For me, as a Penetration tester, it is just a matter of concern, especially since high-quality Pentesting guides/articles are scarce online, which only signals that GraphQL security is still rudimentary.
So I decided to start this
6 min read
Announcement
GraphQL Postman Collection: Generate Instantly with GraphMan
While querying, developing, and testing your GraphQL APIs with postman is easy and convenient, it has a big caveat: if you want to cover an endpoint with all its queries and mutations entirely, it will take you hours and repetitive steps to create every request, and you'll almost
3 min read
GraphQL Vulnerability
GraphQL Cyclic Queries and Depth Limiting
The relational aspect of GraphQL can be a vulnerability exploited by running deep and cyclic queries causing your API to crawl under the load and crash. That's a Denial of Service. Learn how it works and how you can protect your API!
6 min read
Don’t let your vulnerabilities escape.
Ready to multiply your force, not just noise?
Book a demo
Book a demo