Hacking GraphQL Applications: Part 1

The Birth of a New API Paradigm

Picture this: It's 2012 at Facebook's headquarters. Engineers are struggling with their mobile application, which is essentially just a wrapper around HTML5 web views. The app is painfully slow, crashes frequently, and drains phone batteries at an alarming rate. Mark Zuckerberg would later call this approach Facebook's "biggest mistake."

A small team including Lee Byron and Nick Schrock is tasked with rebuilding the Facebook app from scratch using native technologies. But they quickly hit a roadblock: the backend APIs were designed for web interfaces, returning HTML instead of structured data. Even worse, these APIs required multiple round trips over slow mobile networks to load a simple news feed.

"We were frustrated with the differences between the data we wanted to use in our mobile apps and the server queries they required," Lee Byron would later explain. Their solution? A revolutionary approach they initially called "SuperGraph" —a query language that would let clients specify exactly what data they needed in a single request.

Fast forward to 2015, and Facebook open-sourced this technology as GraphQL. Today, it powers APIs at companies like GitHub, Twitter, Airbnb, and Shopify, with a market footprint spanning over $4.7 trillion in combined market cap.

But with this power comes a whole new class of security challenges that traditional API security tools weren't designed to address.

Why GraphQL Changes Everything

To understand GraphQL's security implications, we first need to understand what makes it fundamentally different from the RESTful APIs that dominated before it.

Imagine you walk into a restaurant hungry for dinner. You have two options:

The REST Approach: The Fixed Menu Restaurant

With REST, you're at a restaurant with a fixed menu system. Want a burger? Go to the burger counter. Want fries? That's at the fries station. Need a drink? You'll have to visit the beverage bar.

If you want a complete meal, you're making three separate trips. And at each station, you get exactly what the kitchen prepared – maybe your burger comes with pickles you don't want, or your drink is larger than you need.

In API terms, REST requires:

• Multiple endpoints for different resources (/users, /posts, /comments)
• Multiple requests to get related data
• Accepting whatever data structure the server provides

The GraphQL Approach: Your Personal Chef

With GraphQL, it's like having a personal chef. You submit a single order describing exactly what you want – a medium-rare burger without pickles, a small portion of fries, and just a half glass of soda – and the chef prepares precisely that, delivering everything in one trip.

In API terms, GraphQL offers:

• A single endpoint for all operations
• The ability to request multiple resources in one query
• Control over exactly which fields you receive

Let's see this in action with a real-world example:

# A single GraphQL query that replaces multiple REST requests
query {
  user(id: "123") {
    name
    email
    posts(last: 3) {
      title
      commentCount
    }
  }
}

This single request retrieves a user's information, their three most recent posts, and the comment count for each post – data that might require 4 or more separate requests with REST.

The GraphQL Security Paradox

Here's where things get interesting from a security perspective: the very features that make GraphQL powerful also create unique security challenges.

In 2024, a comprehensive scan of 160 public GraphQL endpoints revealed a staggering 13,720 security issues, with 4,527 classified as highly critical. Over 4,000 exposed secrets were found in GraphQL responses, and 69% of services were vulnerable to denial of service attacks.

Let's explore why GraphQL presents such difficult security challenges:

1. The Single Endpoint Problem With REST, security controls can be applied to individual endpoints – perhaps requiring admin privileges for /admin/users but allowing public access to /public/posts.

GraphQL's single endpoint means all operations flow through the same URL, requiring more sophisticated authorization logic at the resolver level.

2. The Introspection Dilemma GraphQL provides introspection – the ability to query the API about its own capabilities:

{
  __schema {
    types {
      name
      fields {
        name
      }
    }
  }
}

This feature is incredibly useful during development but can reveal your entire API structure to attackers if left enabled in production.

A real-world example: security researchers discovered a vulnerable logistics company API through introspection. They were able to export the entire schema to Postman and discover endpoints lacking proper authentication, ultimately gaining unauthorized access to customer data.

3. The Nested Query Challenge

query NestedFriendsAttack {
  user(id: 1) {
    friends {
      friends {
        friends {
          friends {
            friends {
              id
              name
            }
          }
        }
      }
    }
  }
}

If each user has 10 friends on average, this 5-level deep query could generate 10^5 = 100,000 objects, potentially bringing your server to its knees.

Setting Up Your GraphQL Security Lab

Now that you understand the unique security challenges of GraphQL, let's set up a lab environment where you can safely explore and test these concepts.

What You'll Need

1. A system with Docker installed (I'll assume you're using Linux, but the commands work similarly on macOS and Windows with Docker Desktop)
2. Basic familiarity with command-line operations
3. A curious mind and willingness to break things (safely!)

Step 1: Install Docker If you don't already have Docker installed, you can install it with:

sudo apt update
sudo apt install -y docker.io
sudo systemctl enable docker --now

Verify the installation with:

sudo docker run hello-world

Step 2: Deploy the Damn Vulnerable GraphQL Application (DVGA) DVGA is an intentionally vulnerable application designed for learning GraphQL security. It simulates a Pastebin-like service where users can create and share text snippets.

# Pull the DVGA image
sudo docker pull dolevf/dvga

# Run the container
sudo docker run -t -p 5013:5013 -e WEB_HOST=0.0.0.0 dolevf/dvga

You should see output indicating that the DVGA server is running. You can now access it at http://localhost:5013 in your browser.

Step 3: Install Essential Security Testing Tools For comprehensive GraphQL security testing, you'll want to set up:

1. Altair GraphQL Client: A sophisticated GraphQL client with a user-friendly interface
2. Burp Suite: For intercepting and modifying GraphQL requests (the Community Edition is free)
3. InQL Scanner: A Burp Suite extension for GraphQL security testing

Let's install Altair:

# For Ubuntu/Debian-based systems
sudo apt update
sudo apt install -y snapd
sudo snap install altair

Burp Suite can be downloaded from portswigger.net.

Step 4: Verify Your Setup with a Basic Query Open Altair and set the URL to http://localhost:5013/graphql. Then enter this simple query:

{
  systemHealth
}

Click the "Play" button to execute. If everything is set up correctly, you should receive a response like:

{
  "data": {
    "systemHealth": "UP"
  }
}

Congratulations! Your GraphQL security lab is now operational.

Your First GraphQL Security Test: Introspection

Let's perform our first security test by exploiting DVGA's enabled introspection.

In Altair, try this query:

{
  __schema {
    queryType {
      fields {
        name
        description
      }
    }
  }
}

This query asks the API to reveal all available query operations. The response will include a list of all queries you can perform, essentially mapping out the API's capabilities.

This is just the tip of the iceberg. With introspection enabled, you could extract the entire schema, including all types, fields, mutations, and relationships – a treasure trove of information for a potential attacker.

The DVGA Playground: Learning by Breaking

DVGA includes numerous deliberately vulnerable features for you to explore:

1. Denial of Service vulnerabilities: Test batch queries, deep recursion, and field duplication
2. Information disclosure: Exploit introspection, field suggestions, and error messages
3. Code execution: Try your hand at command injection
4. Injection vulnerabilities: Explore SQL injection, XSS, and log injection
5. Authorization bypasses: Attempt to forge tokens and bypass protections

DVGA offers two difficulty modes:

• Beginner Mode: All vulnerabilities are easily exploitable
• Expert Mode: Some protections are enabled, making exploitation more challenging

You can toggle between these modes in the DVGA settings menu.

A Glimpse at What's Coming

This lab environment will be our playground throughout this five-part blog series. In the upcoming parts, we'll dive deeper into:

Part 2: Reconnaissance Techniques for GraphQL APIs How to discover and map GraphQL endpoints, extract schemas even when introspection is disabled, and fingerprint GraphQL implementations.

Part 3: Common GraphQL Vulnerabilities and Exploitation Practical techniques for exploiting authorization flaws, injection vulnerabilities, and information disclosure issues.

Part 4: Advanced GraphQL Attacks Sophisticated techniques including DoS attacks, batching vulnerabilities, and real-time subscription exploitation.

Part 5: Defending GraphQL APIs How to properly secure your GraphQL implementations, from introspection disabling to depth limiting, query analysis, and proper authorization.

Conclusion: The Path Forward

GraphQL represents a paradigm shift in API development, offering tremendous benefits but also introducing security challenges that traditional API security approaches weren't designed to address.

As we continue this journey together, you'll develop both offensive and defensive skills that will help you build and secure better GraphQL implementations.

Remember that the techniques we discuss should only be practiced in controlled lab environments like the one we've just set up. Never attempt to test or exploit systems without explicit permission.

In Part 2, we'll strap on our hacker hats and dive into reconnaissance techniques, learning how to discover, fingerprint, and map GraphQL APIs, even when they're trying to hide their capabilities.

See you in the next part of our Hacking GraphQL applications adventure!