// Comparison

Black Hat GraphQL vs Hacking APIs: Which Should You Read?

Two cybersecurity books on Web Security, compared honestly: who each is for, what each does best, and which to read first.

Intermediate

4/52023

Black Hat GraphQL

Attacking Next Generation APIs

Nick Aleks, Dolev Farhi

Aleks and Farhi on attacking GraphQL specifically: introspection abuse, batching, depth and complexity attacks, auth flaws, and the differences from REST that make GraphQL pentests their own discipline.

Intermediate

4/52022

Hacking APIs

Breaking Web Application Programming Interfaces

Corey J. Ball

Corey Ball's structured approach to attacking REST and GraphQL APIs: enumeration, auth flaws, business logic, mass assignment, and the testing harness around them.

Read this if

Anyone whose bug bounty or pentest scope includes GraphQL — and who keeps finding nothing because they're using web-app methodology. Aleks and Farhi cover introspection abuse, batching attacks, depth/complexity DoS, auth flaws, and the way GraphQL flattens the typical web threat model.

Pentesters and bug bounty hunters who realized that most production attack surface is now API, not HTML. Ball's structured approach covers REST, GraphQL discovery, BOLA, mass assignment, JWT abuses, and the operational tooling around them.

Skip this if

Readers without GraphQL exposure in their work; the book is a specialization, not a general intro.

Readers who want generalist web security; the book is API-focused and assumes you already understand OWASP-class web bugs.

Key takeaways

Disabled introspection is not a security control; the book explains how to enumerate schemas without it and why that matters.
Batching and aliasing attacks let one HTTP request do many things; classic rate-limit defenses fail unless GraphQL-aware.
Depth and complexity attacks are the GraphQL equivalent of regex DoS, usually possible, often forgotten, sometimes catastrophic.

API attack surface is dramatically underexploited compared to HTML attack surface; for most public bug bounty programs, the API is where the bounties hide.
BOLA (broken object-level authorization) is the dominant API bug class and the one that pays best; Ball's framing is the cleanest in print.
Burp Suite Professional + Postman + a custom recon pipeline is the practical toolset; the book justifies the choice and shows you how to use them together.

How they compare

Black Hat GraphQL and Hacking APIs are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Both books target intermediate-level readers, so the choice is about topic, not difficulty.

Black Hat GraphQL and Hacking APIs both cover Web Security, AppSec, Offensive, so reading them in sequence reinforces the same material from different angles.

Keep reading