// Comparison

Black Hat GraphQL vs The Web Application Hacker's Handbook: Which Should You Read?

Two cybersecurity books on Web Security, compared honestly: who each is for, what each does best, and which to read first.

Intermediate

4/52023

Black Hat GraphQL

Attacking Next Generation APIs

Nick Aleks, Dolev Farhi

Aleks and Farhi on attacking GraphQL specifically: introspection abuse, batching, depth and complexity attacks, auth flaws, and the differences from REST that make GraphQL pentests their own discipline.

Intermediate

4/52011

The Web Application Hacker's Handbook

Finding and Exploiting Security Flaws

Dafydd Stuttard, Marcus Pinto

The exhaustive reference for web app pentesting, comprehensive but increasingly a historical document.

Read this if

Anyone whose bug bounty or pentest scope includes GraphQL — and who keeps finding nothing because they're using web-app methodology. Aleks and Farhi cover introspection abuse, batching attacks, depth/complexity DoS, auth flaws, and the way GraphQL flattens the typical web threat model.

Anyone moving from CTF web challenges into real engagements who needs a systematic mental model of attack surface.

Skip this if

Readers without GraphQL exposure in their work; the book is a specialization, not a general intro.

Frontend-heavy apps in 2024. SPA-specific bugs, JWT pitfalls, GraphQL, and modern CSP are barely covered or absent entirely.

Key takeaways

Disabled introspection is not a security control; the book explains how to enumerate schemas without it and why that matters.
Batching and aliasing attacks let one HTTP request do many things; classic rate-limit defenses fail unless GraphQL-aware.
Depth and complexity attacks are the GraphQL equivalent of regex DoS, usually possible, often forgotten, sometimes catastrophic.

Authentication, session management, and access control are still where most real bugs live.
Methodology beats tooling, the structure of how you map an app matters more than which scanner you run.
Use it as a reference for the classes of bug, then cross-check with PortSwigger Academy for the modern exploitation details.

How they compare

Black Hat GraphQL and The Web Application Hacker's Handbook are both rated 4/5 in our catalog. Pick by topic preference and reading style rather than by rating.

Both books target intermediate-level readers, so the choice is about topic, not difficulty.

Black Hat GraphQL and The Web Application Hacker's Handbook both cover Web Security, AppSec, Offensive, so reading them in sequence reinforces the same material from different angles.

Keep reading