Usually in these when I write about some library or app I try to highlight its strengths. Well, this time I’m going to do the complete opposite and talk about weaknesses. Rest assured it won't be some scorching review, because we’re looking at Damn Vulnerable GraphQL Application where weaknesses are completely intentional and exploiting them is the whole point.
As for why it's fairly obvious, as GraphQL continues to grow and become more popular so too do the concerns about its vulnerabilities. After all, if you want to use it for your app you probably want it to be secure. So yes Damn Vulnerable GraphQL Application is full of weaknesses by design, it's meant to test GraphQL’s safety against various attacks. Let’s look at these types of attacks (or scenarios) you can try out:
So as you can see it provides you with a bunch of attacks you can try out against GraphQL using some pretty well known methods from DoS to directory traversal attack. It's safe because by default the application is listening on 127.0.0.1 (ie. localhost) so you don't have to be afraid someone can actually attack your app. You can change that, but because of its vulnerabilities opening it up to the internet is not advisable. On the technical side DVGA also has two operation modes, Beginner and Expert, which change the exploitation difficulty. As far as requirements go you will need some Python3 libraries for it to actually work:
At first glance it might look like something for security experts, but it's actually pretty fun to just try and poke around looking for holes. There’s no risk involved so you can actually just have some fun while learning a thing or two about the various types of vulnerabilities and attacks. So if you’re interested in app security in general or just always wanted to play hacker for a bit definitely give DVGA a spin.