# GraphQL API Security Testing

## GraphQL Penetration Testing Resources

### Blogs

{% embed url="https://deepstrike.io/blog/graphql-api-vulnerabilities-and-common-attacks" %}

### Books

* **GraphQL BlackHat Book**

### Cheat Sheets and Guides

* **OWASP GraphQL Cheat Sheet:** [Link](https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html)
* **HackTricks GraphQL by Carlos Polop:** [Link](https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/graphql)
* **API Security Empire by Momen Eldawakhly:** [Link](https://github.com/cyprosecurity/API-SecurityEmpire)
* **Doyensec's "GraphQL—Security Overview" by Paolo Stagno:** [Link](https://blog.doyensec.com/2018/05/17/graphql-security-overview.xhtml)
* **YesWeHack's "How to Exploit GraphQL Endpoint":** [Link](https://blog.yeswehack.com/yeswerhackers/how-exploit-graphql-endpoint-bug-bounty)
* **0xn3va’s "GraphQL Vulnerabilities" Cheat Sheet:** [Link](https://0xn3va.gitbook.io/cheat-sheets/web-application/graphql-vulnerabilities)

### Practice Labs

* **TryHackMe GraphQL Security Room:** [TryHackMe](https://tryhackme.com)
* **AttackDefense GraphQL Labs:** [AttackDefense](https://attackdefense.com/challengedetailsnoauth?cid=1991)
* **GraphQL Security 101 by David3107:** [GitHub](https://github.com/david3107/graphql-security-labs)
* **HackMeGraph by 0xbigshaq:** [GitHub](https://github.com/0xbigshaq/hackmegraph)
* **poc-graphql by Righettod:** [GitHub](https://github.com/righettod/poc-graphql)

### Videos

* **"Finding Your Next Bug: GraphQL" by Katie Paxton-Fear:** [YouTube](https://www.youtube.com/watch?v=jyjGneKJynk)
* **"GraphQL API Testing" by Arun S.:** [YouTube](https://www.youtube.com/watch?v=Wb0BO8J7024)
* **"Hacking GraphQL for Beginners" by Farah Hawa:** [YouTube](https://www.youtube.com/watch?v=OQCgmftU-Og)
* **"Abusing GraphQL Infrastructure" by Matt Szymanski:** [YouTube](https://www.youtube.com/watch?v=NPDp7GHmMa0)
* **"Introduction to GraphQL Security" by Christina Hastenrath:** [YouTube](https://www.youtube.com/watch?v=aI-wI14D1nw)
* **"Damn GraphQL: Defending and Attacking APIs" by Dolev Farhi:** [YouTube](https://www.youtube.com/watch?v=EVRf708-zq4)
* **"Access Control Vulnerabilities in GraphQL APIs" by Nikita Stupin:** [YouTube](https://www.youtube.com/watch?v=bCfKqPnt_8Y)
* **"GraphQL APIs from a Bug Hunter's Perspective" by Nikita Stupin:** \[YouTube]\(https
