Uploaded November 2025 | Updated September 2026, 6 hours ago
In this episode, we’re breaking down GraphQL from the ground up - what it is, how it works, and why it differs from REST. We dive deep into its powerful yet complex structure - schemas, queries, mutations, variables, and fragments - and expose the critical security implications you need to know. From recon techniques and schema discovery to attack vectors like denial of service, rate limiting bypass, authentication flaws, and CSRF, this video gives you the mindset and tools to find vulnerabilities scanners will miss.
🎯 Get My Full Caido For Hackers Course: hhub.io/AMRCAIDO
💡 Support AmrSec on Patreon:
patreon.com/AmrSec
🔥 Join Our Community:
Discord: discord.gg/nxHKyJTy3h
📑 Resources
Video Article: amrelsagaei.com/graphql-for-bug-bounty-hunters
Alex Research: yeswehack.com/learn-bug-bounty/syntax-confusion-ambiguous-parsing-exploits
YWH: yeswehack.com
⭐ Become a Channel Member:
youtube.com/@AmrSecOfficial/join
🟠 Get 20% off Caido Premium with code "AMRSEC20" (yearly plan only)
⚠️ Disclaimer
This channel is for educational purposes only. The goal is to teach cybersecurity, ethical hacking, and red team/blue team skills through real tools, techniques, and experience. Always hack ethically. 🔐
⏱️ Timestamps
00:00 — Introduction
00:00 Introduction
01:28 Quick Note Before we dive in
02:02 What is GraphQL?
03:41 GraphQL vs REST
07:24 Understanding Graphql Structure
07:42 └───Schema Basics
08:42 └───Queries
10:05 └───Variables
13:23 └───Fragments
14:32 Graphql Security Fundamentals
15:43 └───Recon - Common GraphQL Paths
17:34 └───Recon - Fingerprinting the Engine
20:04 └───Schema Discovery - Introspection Enabled
21:18 └───Schema Discovery - Introspection Disabled
23:20 Graphql Attacks
23:30 └───Denial of Service
27:35 └───Rate Limiting Bypass
28:48 └───Authentication & Authorization Issues
31:04 └───Information Disclosure
32:36 └───CSRF in GraphQL
35:42 GraphQL hacking in Caido
40:58 Tools Don't Find Bugs
42:50 Closing
Follow AmrSec
LinkedIn: linkedin.com/in/amrelsagaei
Twitter/X: twitter.com/amrelsagaei
Instagram: instagram.com/amrelsagaei
#AmrSec #GraphQL #GraphQLSecurity #BugBounty #CyberSecurity #APIHacking #EthicalHacking #SecurityTesting
In this episode, we’re breaking down GraphQL from the ground up - what it is, how it works, and why it differs from REST. We dive deep into its powerful yet complex structure - schemas, queries, mutations, variables, and fragments - and expose the critical security implications you need to know. From recon techniques and schema discovery to attack vectors like denial of service, rate limiting bypass, authentication flaws, and CSRF, this video gives you the mindset and tools to find vulnerabilities scanners will miss.
🎯 Get My Full Caido For Hackers Course: hhub.io/AMRCAIDO
💡 Support AmrSec on Patreon:
patreon.com/AmrSec
🔥 Join Our Community:
Discord: discord.gg/nxHKyJTy3h
📑 Resources
Video Article: amrelsagaei.com/graphql-for-bug-bounty-hunters
Alex Research: yeswehack.com/learn-bug-bounty/syntax-confusion-ambiguous-parsing-exploits
YWH: yeswehack.com
⭐ Become a Channel Member:
youtube.com/@AmrSecOfficial/join
🟠 Get 20% off Caido Premium with code "AMRSEC20" (yearly plan only)
⚠️ Disclaimer
This channel is for educational purposes only. The goal is to teach cybersecurity, ethical hacking, and red team/blue team skills through real tools, techniques, and experience. Always hack ethically. 🔐
⏱️ Timestamps
00:00 — Introduction
00:00 Introduction
01:28 Quick Note Before we dive in
02:02 What is GraphQL?
03:41 GraphQL vs REST
07:24 Understanding Graphql Structure
07:42 └───Schema Basics
08:42 └───Queries
10:05 └───Variables
13:23 └───Fragments
14:32 Graphql Security Fundamentals
15:43 └───Recon - Common GraphQL Paths
17:34 └───Recon - Fingerprinting the Engine
20:04 └───Schema Discovery - Introspection Enabled
21:18 └───Schema Discovery - Introspection Disabled
23:20 Graphql Attacks
23:30 └───Denial of Service
27:35 └───Rate Limiting Bypass
28:48 └───Authentication & Authorization Issues
31:04 └───Information Disclosure
32:36 └───CSRF in GraphQL
35:42 GraphQL hacking in Caido
40:58 Tools Don't Find Bugs
42:50 Closing
Follow AmrSec
LinkedIn: linkedin.com/in/amrelsagaei
Twitter/X: twitter.com/amrelsagaei
Instagram: instagram.com/amrelsagaei
#AmrSec #GraphQL #GraphQLSecurity #BugBounty #CyberSecurity #APIHacking #EthicalHacking #SecurityTesting
