3.14 GraphQL

• 攻击Graph https://xzfile.aliyuncs.com/upload/zcon/2018/7_攻击GraphQL_phithon.pdf

• GraphQL abuse: Bypass account level permissions through parameter smuggling https://labs.detectify.com/2018/03/14/graphql-abuse/