Escape - Application Security & Offensive Security Blog
Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.
Filters
GraphQL Vulnerability
SQL Injection in GraphQL
You receive a call in the middle of the night from the SRE team:
All production data has been deleted from your company's various relational databases.
Many of the company's internal services are therefore down. You absolutely need to fix the problem immediately and identify the
5 min read
GraphQL Vulnerability
File Inclusion and Directory Traversal in GraphQL
Back at the office, you try to connect to one of your application's servers. But for some reason, your account is no longer granted access.
Anyway. You have a backup so you can restore it to a previous state in a minute. Still, you have to figure out
5 min read
GraphQL Vulnerability
How to prevent data leaks with HTTPS
HTTP is the text protocol that has been running the web, but its upgraded version HTTPS should always be preferred to avoid data leaks. Read more to understand the risk and how you can implement the security fix in your GraphQL framework of choice.
5 min read
GraphQL Vulnerability
Understanding and Dealing with Cross-Site Request Forgery Attacks (CSRF) in GraphQL
CSRF (Cross-Site Request Forgery) is one of the top 3 most common vulnerabilities of web applications. It forces authenticated users to perform unwanted actions. In this post, we explain how it works and how to remediate it in your GraphQL API.
5 min read
Startup Security
Demeter's Hymn to Cybersecurity: Consequences of Cyberattacks on Scale-Ups
How many entrepreneurs feel a filial connection with their business, such as Demeter’s passion for Persephone? If Hades abducted Persephone on his golden chariot drawn by immortal horses, the infants of start-up founders are threatened by a more nebulous danger: cyberattacks.
7 min read
Tutorial
Building a type-safe Fullstack Application with GraphQL codegen
There are two approaches to defining your schema in GraphQL: schema-first and code-first.
When using Typescript, you might find yourself having to write types again and again.
Enters GraphQL codegen: your schema file becomes the single source of truth.
6 min read
Startup Security
SaaS Startup Security 101 - A quick guide for building secure SaaS
Why should you care about security in a SaaS Startup?
1) To avoid expensive Data Leaks 🥷
A common misconception among startups is that only big corporations, or large scale-ups, are targeted by cyberattacks. Unfortunately, startups of all sizes can be targeted: from the 139 Million records leaked by Canva in
4 min read
Startup Security
The Russo-Ukrainian War: How the Fight for Democracy translates into Web API Security
In Ukraine, web APIs have demonstrated their value to achieve democratic progress through e-governance. Nonetheless, API security has revealed its vital nature in light of the cyberattacks launched by Russian state-sponsored hackers.
12 min read
Tutorial
How to Test your GraphQL Endpoints
Testing your GraphQL API is critical to ensure that your software's business logic is running as expected.
Tests will reveal bugs and vulnerabilities before they make it to production.
In this tutorial, we go through the practical steps to write unit and integration tests for your GraphQL API.
6 min read
DevSecOps
DevSecOps 101 Part 3: Scanning Live Web Applications with Nuclei scanner
This article is part of a series about integrating security tooling in the development process. You can find the rest of the articles here:
* Part 1: Detecting Insecure Dependencies (SCA)
* Part 2: Detecting Insecure Source Code (SAST)
* Part 4: Scanning Docker Images With Trivy
Note: This tutorial is based on
4 min read
Open Source
Introducing 🪝 Mookme 🪝, a git hook manager for monorepos
Ever had troubles managing your git hooks in a monorepository ? We did too, so we created Mookme to solve our problems. Here is a git hook manager for dealing with different projects and languages, automated filtering, ease of configuration and setup.
5 min read
Don’t let your vulnerabilities escape.
Ready to multiply your force, not just noise?
Book a demo
Book a demo