Usually in these when I write about some library or app I try to highlight its strengths. Well this time I’m going to do the complete opposite and talk about weaknesses. Rest assured it won't be some scorching review, because we’re looking at Damn Vulnerable GraphQL Application where weaknesses are completely intentional and exploiting them is the whole point.

The Why and the How

As for why it's fairly obvious, as GraphQL continues to grow and become more popular so too do the concerns about its vulnerabilities. After all, if you want to use it for your app you probably want it to be secure. So yes Damn Vulnerable GraphQL Application is full of weaknesses by design, it's meant to test GraphQL’s safety against various attacks. Let’s look at these types of attacks (or scenarios) you can try out:

Denial of Service

• Batch Query Attack
• Deep Recursion Query Attack
• Resource Intensive Query Attack
• Field Duplication Attack
• Aliases based Attack

Information Disclosure

• GraphQL Field Suggestions
• GraphQL Introspection
• GraphiQL Interface
• GraphQL Field Suggestions
• Server Side Request Forgery

Code Execution

• OS Command Injection #1
• OS Command Injection #2

Injection

• Stored Cross-Site Scripting
• Log spoofing / Log injection
• HTML Injection

Authorization Bypass

• GraphQL Interface Protection Bypass
• GraphQL Query Deny List Bypass

Other

• GraphQL Query Weak Password Protection
• Arbitrary File Write / Path Traversal

Source: github.com/dolevf/Damn-Vulnerable-GraphQL-Application

Safe and sound

So as you can see it provides you with a bunch of attacks you can try out against GraphQL using some pretty well known methods from DoS to directory traversal attack. It's safe because by default the application is listening on 127.0.0.1 (ie. localhost) so you don't have to be afraid someone can actually attack your app. You can change that, but because of its vulnerabilities opening it up to the internet is not advisable. On the technical side DVGA also has two operation modes, Beginner and Expert, which change the exploitation difficulty. As far as requirements go you will need some Python3 libraries for it to actually work:

• Python3,
• Flask,
• Flask-SQLAlchemy,
• Graphene and Graphene-SQLAlchemy.

...and also fun!

At first glance it might look like something for security experts, but it's actually pretty fun to just try and poke around looking for holes. There’s no risk involved so you can actually just have some fun while learning a thing or two about the various types of vulnerabilities and attacks. So if you’re interested in app security in general or just always wanted to play hacker for a bit definitely give DVGA a spin.

A guest blog post for GraphQL Editor blog by Michał Tyszkiewicz

Speed up your GraphQL API development

GraphQL Editor is a supportive tool for both advanced GraphQL users as well as those taking their first steps with GraphQL APIs. Our all-in-one development environment for GraphQL will help you build, manage & deploy your GraphQL API much faster. Try GraphQL Editor for free!