Hunting for bugs in GraphQL APIs (Demo)

[@albonycal]

*Hacker Voice* I'm in

[@InsiderPhD]

me_irl

[@JL-ud6xx]

Thank you katie for your wonderful structure lesson to strengthen my foundation firmly from theory to demo. It's so precious. Continue making good videos :)

[@allan_bomb]

Thank you! You're explanations were exceptional. Keep up the good work. I'm looking forward for more of your videos.

[@bigbooduh]

Hackverter burp ext makes encoding a breeze i highly recommended it you can find it in bapp store, thanks for the great content. This helped me a lot

[@bejanknaveen2274]

thank you lots , teaching us thank you thank you

[@real_alkebulan]

Thank you for making this video 👸

[@karthikmp5590]

Hey I keep watching your videos... Just love them 🤩 they are so informative... I just have a suggestion if you don't mind.... Try to upload videos with 1080p coz sometimes it's hard to look up on those small letters and which buttons you press and the code too ... Thank you❤️

[@rajatdutta8365]

really informative. Thanks

[@andreslauga]

Niiice!! Great video! Thanks 😃

[@kerbalette156]

Just epic thx

[@8ara7a68]

That was nice!
Thanks

[@rzizah]

"Ctrl + u" does url encoding and its a lot faster

[@FarhanAli-xb9nx]

Thanks for such effort

[@InsiderPhD]

It's my pleasure! As long as folks keep watching I'll keep making them!

[@abhii5521]

Katie, I have small question. How can we further exploit vulnerability when the introspection is disabled.

[@geniusesml3700]

hello any informations u get ?

[@brs2379]

Hey Katie, I'm hunting on a live target, and whenever I run a query on the users object, I only ever got my own data returned. I'm assuming this is because there is some validation on my cookies, and I can't just send a query to the user's object to get all users data without permissions to do that?

[@InsiderPhD]

It’s going to be dependent on how the application is made, is there a way to see another’s users profile in the UI?

[@brs2379]

@InsiderPhD No, there isn't. It's a shopping cart application, so you can only see your own cart, orders, address, etc

[@itsm3dud39]

what if introspection is disabled??

[@eXfilPr4tik]

Thanks for the effort and information!

[@oneplanet2198]

Thank you for all you do .
God bless you

[@bag8208]

Тhank you mam, it was very nice, and sorry my bad english :)

[@krishanuchhabra]

❤️❤️❤️

[@fulliculli]

Kudos, great content. +1 subscriber.