> For the complete documentation index, see [llms.txt](https://kathan19.gitbook.io/howtohunt/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kathan19.gitbook.io/howtohunt/graphql/graphql.md).

# GraphQL

### Videos

* GraphQL Video - [InsiderPhd](https://www.youtube.com/watch?v=GlvNwhq-uBg)
* [REST in Peace: Abusing GraphQL to Attack Underlying Infrastructure - LevelUp 0x05](https://www.youtube.com/watch?v=NPDp7GHmMa0)

### Blogs

* Exploit GraphQL - [Yeswehack Blog](https://blog.yeswehack.com/yeswerhackers/how-exploit-graphql-endpoint-bug-bounty/)
* Hacking GraphQL - [Part 1](https://infosecwriteups.com/hacking-graphql-for-fun-and-profit-part-1-understanding-graphql-basics-72bb3dd22efa) [Part 2](https://infosecwriteups.com/hacking-graphql-for-fun-and-profit-part-2-methodology-and-examples-5992093bcc24)
* [That single GraphQL issue that you keep missing](https://blog.doyensec.com/2021/05/20/graphql-csrf.html) by [Doyensec](https://www.doyensec.com/)
* [Reverse engineer a GraphQL API](https://swizec.com/blog/reverse-engineer-a-graphql-api-to-automate-love-notes-codewithswiz-24)
* [Exploiting GraphQL](https://blog.assetnote.io/2021/08/29/exploiting-graphql/) by [Assetnote](https://assetnote.io/)
* [GraphQL Resources Thread](https://twitter.com/holybugx/status/1441460070387261440?s=21) by [HolyBugx](https://twitter.com/HolyBugx)
* [GraphQL Test Cases](https://anmolksachan.github.io/graphql/)

## Tools

* [GraphQL Voyager](https://apis.guru/graphql-voyager/)
* [GraphQL Cheatsheet](https://devhints.io/graphql)
* [AutoGraphQL](https://graphql-dashboard.herokuapp.com/) - Demo [Video](https://www.youtube.com/watch?v=JJmufWfVvyU)
* [graphw00f](https://github.com/dolevf/graphw00f) - GraphQL Server Engine Fingerprinting utility to learn more about what technology is behind a given GraphQL endpoint
* [InQL - Introspection GraphQL Scanner](https://portswigger.net/bappstore/296e9a0730384be4b2fffef7b4e19b1f) - A security testing tool to facilitate GraphQL technology security auditing efforts
* [Graphicator is a GraphQL "scraper" / extractor](https://github.com/cybervelia/graphicator)

## Labs

* Damn-Vulnerable-GraphQL-Application - [Github](https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application)