awesome-graphql-security

GraphQL Shield

GraphQL Shield helps you create a permission layer for your application

GraphQL Authz

GraphQL authorization layer

Continuous GraphQL Security Testing for Developers. Find and fix GraphQL security flaws in the CI/CD

GraphQL Cop

Utility to run common security tests against GraphQL APIs that can be run inside CI/CD

GraphQL Armor

Highly customizable security middleware for Apollo GraphQL and Envelop servers

Web Application Firewall for GraphQL APIs

Postman is an API platform for developers to design, build, test and iterate their APIs

Design and test GraphQL APIs with ease

GraphQL Client helps you debug GraphQL queries and implementations. Also distributed as a Browser Extension

Hoppscotch

Online REST and GraphQL client

GraphMan

Generate a complete Postman collection from a GraphQL endpoint. Allows instant and easy discovery and exploration of the API

Visualize GraphQL schema

Voyager

Represent any GraphQL API as an interactive graph

GraphQL Inspector

– Validate schema, get schema change notifications, validate operations, find breaking changes, look for similar types, schema coverage

GraphQL Rover

GraphQL schema viewer for endpoints with introspection

CraftQL

CLI GraphQL schema viewer, view schema diagram on the terminal or generate graphviz .dot format file

Graphinder

Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce

Graphw00f

GraphQL Server Engine Fingerprinting utility

Clairvoyance

Patrial introspection fetcher when introspection is disabled

– Tool that lists the different ways of reaching a given type in a GraphQL schema

ShapeShifter

Schema extraction to JSON file with introspection

Goctopus

a GraphQL endpoint discovery and fingerprinting tool

GraphCrawler

A GraphQL automated security toolkit. Grab introspection, search for sensitive queries, and then test authorization

CrackQL

GraphQL password brute-force and fuzzing utility

GraphQLMap

A scripting engine to interact with a GraphQL endpoint for pentesting purposes

One-click quick security scan of your GraphQL endpoints. Free, no login required

GraphQL Threat Matrix

GraphQL threat framework to research security gaps in GraphQL implementations

InQL

A Burp Extension for GraphQL Security Testing

BatchQL

GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations

GraphQL wordlist

the only GraphQL wordlist for pentesting you'll ever need. Operations, field names, type names. It was collected on more than 60k distinct GraphQL schemas

Damn Vulnerable GraphQL Application

Damn Vulnerable GraphQL Application is an intentionally vulnerable implementation of Facebook's GraphQL technology, to learn and practice GraphQL Security

Hands-on learning about GraphQL. Each lesson is built around a WebContainer containing a live GraphQL application, so you'll not only understand why a vulnerability is risky, but also how to exploit it and, most importantly, how to fix it

Confusion between authentication and authorization causes data leaks. Learn the difference and how to implement the right access control pattern in your GraphQL API

Take your GraphQL skills to the next level with our free interactive GraphQL tutorials, videos, quizzes and code challenges

Learn about GraphQL security, performance, testing and building production-ready APIs with the latest tools and best practices of the GraphQL ecosystem

Introduction to Basic Concepts, Security Considerations & Reconnaissance, Vulnerabilities and Attacks, Offensive Tools

Learn about GraphQL security, performance, testing and building production-ready APIs with the latest tools and best practices of the GraphQL ecosystem

Addressing the Security concerns of GraphQL Aliases

File Inclusion and Directory Traversal in GraphQL

Understanding and Dealing with Cross-Site Request Forgery Attacks (CSRF) in GraphQL

The relational aspect of GraphQL can be a vulnerability exploited by running deep and cyclic queries causing your API to crawl under the load and crash

How HTTPS can prevent Data Leaks

SQL Injections in GraphQL

When GraphQL Error Messages become a Security Issue

When GraphQL Error Messages become a Security Issue