Nick Aleks, Dolev Farhi

Broschiertes Buch

Black Hat GraphQL

Attacking Next Generation APIs

Mitarbeit: Chan, Opheliar

Beschreibung

Written by hackers for hackers, this hands-on book teaches penetration testers how to identify vulnerabilities in apps that use GraphQL, a data query and manipulation language for APIs adopted by major companies like Facebook and GitHub.

Black Hat GraphQL is for anyone interested in learning how to break and protect GraphQL APIs with the aid of offensive security testing. Whether you re a penetration tester, security analyst, or software engineer, you ll learn how to attack GraphQL APIs, develop hardening procedures, build automated security testing into your development pipeline, and validate controls, all with no prior exposure to GraphQL required.

Following an introduction to core concepts, you ll build your lab, explore the difference between GraphQL and REST APIs, run your first query, and learn how to create custom queries.

You ll also learn how to:

• Use data collection and target mapping to learn about targets
• Defend APIs against denial-of-service attacks and exploit insecure configurations in GraphQL servers to gather information on hardened targets
• Impersonate users and take admin-level actions on a remote server
• Uncover injection-based vulnerabilities in servers, databases, and client browsers
• Exploit cross-site and server-side request forgery vulnerabilities, as well as cross-site WebSocket hijacking, to force a server to request sensitive information on your behalf
• Dissect vulnerability disclosure reports and review exploit code to reveal how vulnerabilities have impacted large companies

This comprehensive resource provides everything you need to defend GraphQL APIs and build secure applications. Think of it as your umbrella in a lightning storm.

Autor

Nick Aleks and Dolev Farhi

Produktdetails

• Verlag: No Starch Press
• Seitenzahl: 320
• Erscheinungstermin: 23. Mai 2023
• Englisch
• Abmessung: 232mm x 180mm x 20mm
• Gewicht: 590g
• ISBN-13: 9781718502840
• ISBN-10: 1718502842
• Artikelnr.: 65340442

Rezensionen

"Black Hat GraphQL is the best resource for anyone looking to test GraphQL for vulnerabilities. Not only did Aleks and Farhi write the book, but they also created the vulnerable application used in the books labs and created a suite of tools specially designed for analyzing weaknesses within GraphQL APIs. This is a must-read book for those in API security."
Corey Ball, author of Hacking APIs

"This book brought me from zero to incredibly dangerous in ten chapters. The authors break down complex topics, making them easy to understand, as well as outlining pros and cons of each feature, tool, and tactic. The book also has quite a bit of foreshadowing, mentioning how certain parts of GraphQL work, and how they

will be exploited later. The authors share not only several hands-on labs, but several tools they created themselves and open-sourced for all to use. If you are going to be PenTesting GraphQL systems, or are charged with protecting such a system, this book is a must-have."
Tanya Janca, founder of We Hack Purple

With the increasing number of web platforms built on top of GraphQL, this book is an essential resource for all security practitioners. By covering both the basics and advanced topics, Nick and Dolev have created the ultimate guide to hacking GraphQL.
Luca Carettoni, Doyensec

"Knowing how to secure GraphQL is often the first question most users have after they have that "ah ha!" moment about how cool it is. While Apollo and others have written a lot of great documentation on best security practices, Black Hat GraphQL is the most comprehensive look from the other side. This is not just a book for red teamers or penetration testers. Any GraphQL developer will learn a lot here."
Tad Whitaker, Apollo GraphQL

"I study my way up in cybersecurity, in part, through books. While many of the books I use don't actually bring something new to the table, Black Hat GraphQL is definitely an exception. My copy, believe it or not, is oversaturated with highlights. And that probably says it all."
Cristi Vlad, @CristiVlad25, cybersecurity researcher