// Comparison

Black Hat GraphQL vs The Tangled Web: Which Should You Read?

Two cybersecurity books on Web Security, compared honestly: who each is for, what each does best, and which to read first.

Intermediate

4/52023

Black Hat GraphQL

Attacking Next Generation APIs

Nick Aleks, Dolev Farhi

Aleks and Farhi on attacking GraphQL specifically: introspection abuse, batching, depth and complexity attacks, auth flaws, and the differences from REST that make GraphQL pentests their own discipline.

Advanced

5/52011

The Tangled Web

A Guide to Securing Modern Web Applications

Michal Zalewski

The deepest book ever written on the strange, accreted security model of the web browser.

Read this if

Anyone whose bug bounty or pentest scope includes GraphQL — and who keeps finding nothing because they're using web-app methodology. Aleks and Farhi cover introspection abuse, batching attacks, depth/complexity DoS, auth flaws, and the way GraphQL flattens the typical web threat model.

Anyone who builds, attacks, or audits browser-based systems and wants to know why the rules are the way they are.

Skip this if

Readers without GraphQL exposure in their work; the book is a specialization, not a general intro.

Beginners, Zalewski assumes you've already touched the surface and want the substrate. Start with PortSwigger Academy first.

Key takeaways

Disabled introspection is not a security control; the book explains how to enumerate schemas without it and why that matters.
Batching and aliasing attacks let one HTTP request do many things; classic rate-limit defenses fail unless GraphQL-aware.
Depth and complexity attacks are the GraphQL equivalent of regex DoS, usually possible, often forgotten, sometimes catastrophic.

The web's security model is not designed; it is excavated.
Origins, schemes, and trust boundaries are the only real abstractions; everything else is a leaky negotiation.
Specifications and reality diverge constantly, and the divergence is where bugs live.

How they compare

We rate The Tangled Web higher (5/5 against 4/5 for Black Hat GraphQL). For most readers, that means The Tangled Web is the primary pick and Black Hat GraphQL is a useful follow-up.

Black Hat GraphQL is pitched at intermediate level. The Tangled Web is pitched at advanced level. Read the easier one first if you're not yet comfortable with the topic.

Black Hat GraphQL and The Tangled Web both cover Web Security, AppSec, so reading them in sequence reinforces the same material from different angles.

Keep reading