Security Testing for GraphQL Backed Applications

Rate this content
Bookmark

FAQ

Yes, StackHawk can scan a variety of application types including server side HTML, single page applications, REST APIs, and GraphQL interfaces.

StackHawk is a tool designed for developers to easily find, triage, and fix application security vulnerabilities. It specializes in application and API security testing, and is built for integration with CI/CD workflows.

StackHawk runs automated scans on applications and APIs, identifying vulnerabilities such as SQL injection or data exposure. These scans can be triggered during the development processes like opening a pull request or on a commit, depending on the CI/CD configuration.

StackHawk is built on top of the open-source scanner ZAP (Zed Attack Proxy), which is an industry-standard dynamic application security testing tool.

When StackHawk identifies a vulnerability, it notifies the development team and provides detailed information including the request sent and the response received. This allows developers to validate the issue, debug the code, and quickly implement a fix.

StackHawk offers triage options such as marking vulnerabilities as 'risk accepted' or adding them to a JIRA backlog. The scanner respects these settings in subsequent runs, focusing only on newly introduced vulnerabilities.

StackHawk integrates seamlessly with modern engineering stacks and workflows, enhancing the approachability of security tasks for engineering teams.

To start using StackHawk, you can visit their website and sign up for a free account. There is also a promotional giveaway for Node Congress attendees, including a t-shirt and a chance to win a Nintendo Switch.

Ryan Severns
Ryan Severns
5 min
24 Jun, 2021

Comments

Sign in or register to post your comment.
Video Summary and Transcription
StackHawk is an automated application and API security testing tool that integrates with CI/CD. It uses the ZAP scanner and supports various types of applications and APIs. StackHawk provides detailed vulnerability information and triage features to manage low-risk issues. The tool aims to seamlessly integrate into engineering workflows and make security accessible for teams.

1. Overview of StackHawk

Short description:

StackHawk provides automated application and API security testing, making it easy to find and fix vulnerabilities. It integrates with CI/CD, running scans on pull requests or commits. The tool uses the ZAP scanner and supports various types of applications and APIs. When a vulnerability is found, StackHawk provides detailed information and allows for easy debugging and fixing. It also offers triage features to manage low-risk issues. StackHawk aims to integrate seamlessly into engineering workflows and make security approachable for teams.

Hey there, Node Congress. I'm Ryan Severance, one of the founders of StackHawk. At StackHawk, it's simple for developers to find and triage and fix application security bugs. I'm going to tell you a little bit more about what we do today.

So StackHawk in a nutshell, we do application and API security testing. We're built for automation in CI, CD. Ultimately, we make it really easy to find and fix any application security vulnerabilities. So let's say you're building a new feature and your team's working on it. And somebody introduces a new endpoint that perhaps has a SQL injection vulnerability, exposes sensitive data from the backend that a malicious attacker could access. What would happen traditionally, traditional approaches that might not be discovered until weeks, months later, and maybe a pen test or a security team review.

With StackHawk, when you open the pull request or even on the commit, depending on how you have it configured in CICD, a scan will run. It's a test against the application and it looks for any of these sort of vulnerabilities. It would notify you that a SQL injection vulnerability has been found. And then it tees the team up with all of the information to hop in there and fix it. So you find any bugs early, and it makes it really simple to fix them. Let me tell you a little bit about how it works behind the scenes. So we're built on top of an open source scanner. It's called ZAP, Z-A proxy.org. So it's an industry standard in terms of one of the best dynamic application security testing tools out there. We make it really easy to configure and to run anywhere, make it simple to automate. With StackHawk, you can scan modern applications, server side HTML, single page applications, rest APIs, GraphQL, and ultimately it's just really fast automated application security testing.

So let's say test runs, maybe you get notified from a broken build that there is a new vulnerability that's been introduced. Can hop into the StackHawk web app, and you have the request that was sent to the application, the response that was returned with a highlighting of the evidence that shows that it's a vulnerability. There's a validate button that you can click on, to go recreate that same request, and step through the code in debug mode, figure out where you're mishandling information, and ultimately get to a fix really quickly. We also have overviews of what the bug is, documentation on how to fix it. There's also triage features. So let's say you get notified about something, but it's low risk, it shouldn't block the push to production. You can mark it as either risk accepted, or maybe you put it in your JIRA backlog, and the scanner respects that. So the next time it runs, it's only looking for newly introduced vulnerabilities. Stackhawk integrates really easily with the rest of your engineering stack. We're big believers in tying into the modern developer workflows and making security easy to approach for engineering teams.

So that's a quick overview of Stackhawk. We'd love for you to come check us out. Come by the website, sign up for a free account, and make sure to check out the giveaway that we have going on for Node Congress. Everybody gets a t-shirt and you're also entered to win a Nintendo Switch. That's all. Thanks so much. Bye.

Check out more articles and videos

We constantly think of articles and videos that might spark Git people interest / skill us up or help building a stellar career

It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder
Node Congress 2022Node Congress 2022
26 min
It's a Jungle Out There: What's Really Going on Inside Your Node_Modules Folder
Top Content
The talk discusses the importance of supply chain security in the open source ecosystem, highlighting the risks of relying on open source code without proper code review. It explores the trend of supply chain attacks and the need for a new approach to detect and block malicious dependencies. The talk also introduces Socket, a tool that assesses the security of packages and provides automation and analysis to protect against malware and supply chain attacks. It emphasizes the need to prioritize security in software development and offers insights into potential solutions such as realms and Deno's command line flags.
Towards a Standard Library for JavaScript Runtimes
Node Congress 2022Node Congress 2022
34 min
Towards a Standard Library for JavaScript Runtimes
Top Content
There is a need for a standard library of APIs for JavaScript runtimes, as there are currently multiple ways to perform fundamental tasks like base64 encoding. JavaScript runtimes have historically lacked a standard library, causing friction and difficulty for developers. The idea of a small core has both benefits and drawbacks, with some runtimes abusing it to limit innovation. There is a misalignment between Node and web browsers in terms of functionality and API standards. The proposal is to involve browser developers in conversations about API standardization and to create a common standard library for JavaScript runtimes.
ESM Loaders: Enhancing Module Loading in Node.js
JSNation 2023JSNation 2023
22 min
ESM Loaders: Enhancing Module Loading in Node.js
ESM Loaders enhance module loading in Node.js by resolving URLs and reading files from the disk. Module loaders can override modules and change how they are found. Enhancing the loading phase involves loading directly from HTTP and loading TypeScript code without building it. The loader in the module URL handles URL resolution and uses fetch to fetch the source code. Loaders can be chained together to load from different sources, transform source code, and resolve URLs differently. The future of module loading enhancements is promising and simple to use.
Out of the Box Node.js Diagnostics
Node Congress 2022Node Congress 2022
34 min
Out of the Box Node.js Diagnostics
This talk covers various techniques for getting diagnostics information out of Node.js, including debugging with environment variables, handling warnings and deprecations, tracing uncaught exceptions and process exit, using the v8 inspector and dev tools, and generating diagnostic reports. The speaker also mentions areas for improvement in Node.js diagnostics and provides resources for learning and contributing. Additionally, the responsibilities of the Technical Steering Committee in the TS community are discussed.
Node.js Compatibility in Deno
Node Congress 2022Node Congress 2022
34 min
Node.js Compatibility in Deno
Deno aims to provide Node.js compatibility to make migration smoother and easier. While Deno can run apps and libraries offered for Node.js, not all are supported yet. There are trade-offs to consider, such as incompatible APIs and a less ideal developer experience. Deno is working on improving compatibility and the transition process. Efforts include porting Node.js modules, exploring a superset approach, and transparent package installation from npm.
Multithreaded Logging with Pino
JSNation Live 2021JSNation Live 2021
19 min
Multithreaded Logging with Pino
Top Content
Today's Talk is about logging with Pino, one of the fastest loggers for Node.js. Pino's speed and performance are achieved by avoiding expensive logging and optimizing event loop processing. It offers advanced features like async mode and distributed logging. The use of Worker Threads and Threadstream allows for efficient data processing. Pino.Transport enables log processing in a worker thread with various options for log destinations. The Talk concludes with a demonstration of logging output and an invitation to reach out for job opportunities.

Workshops on related topic

API Testing with Postman Workshop
TestJS Summit 2023TestJS Summit 2023
48 min
API Testing with Postman Workshop
Top Content
WorkshopFree
Pooja Mistry
Pooja Mistry
In the ever-evolving landscape of software development, ensuring the reliability and functionality of APIs has become paramount. "API Testing with Postman" is a comprehensive workshop designed to equip participants with the knowledge and skills needed to excel in API testing using Postman, a powerful tool widely adopted by professionals in the field. This workshop delves into the fundamentals of API testing, progresses to advanced testing techniques, and explores automation, performance testing, and multi-protocol support, providing attendees with a holistic understanding of API testing with Postman.
1. Welcome to Postman- Explaining the Postman User Interface (UI)2. Workspace and Collections Collaboration- Understanding Workspaces and their role in collaboration- Exploring the concept of Collections for organizing and executing API requests3. Introduction to API Testing- Covering the basics of API testing and its significance4. Variable Management- Managing environment, global, and collection variables- Utilizing scripting snippets for dynamic data5. Building Testing Workflows- Creating effective testing workflows for comprehensive testing- Utilizing the Collection Runner for test execution- Introduction to Postbot for automated testing6. Advanced Testing- Contract Testing for ensuring API contracts- Using Mock Servers for effective testing- Maximizing productivity with Collection/Workspace templates- Integration Testing and Regression Testing strategies7. Automation with Postman- Leveraging the Postman CLI for automation- Scheduled Runs for regular testing- Integrating Postman into CI/CD pipelines8. Performance Testing- Demonstrating performance testing capabilities (showing the desktop client)- Synchronizing tests with VS Code for streamlined development9. Exploring Advanced Features - Working with Multiple Protocols: GraphQL, gRPC, and more
Join us for this workshop to unlock the full potential of Postman for API testing, streamline your testing processes, and enhance the quality and reliability of your software. Whether you're a beginner or an experienced tester, this workshop will equip you with the skills needed to excel in API testing with Postman.
Node.js Masterclass
Node Congress 2023Node Congress 2023
109 min
Node.js Masterclass
Top Content
Workshop
Matteo Collina
Matteo Collina
Have you ever struggled with designing and structuring your Node.js applications? Building applications that are well organised, testable and extendable is not always easy. It can often turn out to be a lot more complicated than you expect it to be. In this live event Matteo will show you how he builds Node.js applications from scratch. You’ll learn how he approaches application design, and the philosophies that he applies to create modular, maintainable and effective applications.

Level: intermediate
Build and Deploy a Backend With Fastify & Platformatic
JSNation 2023JSNation 2023
104 min
Build and Deploy a Backend With Fastify & Platformatic
WorkshopFree
Matteo Collina
Matteo Collina
Platformatic allows you to rapidly develop GraphQL and REST APIs with minimal effort. The best part is that it also allows you to unleash the full potential of Node.js and Fastify whenever you need to. You can fully customise a Platformatic application by writing your own additional features and plugins. In the workshop, we’ll cover both our Open Source modules and our Cloud offering:- Platformatic OSS (open-source software) — Tools and libraries for rapidly building robust applications with Node.js (https://oss.platformatic.dev/).- Platformatic Cloud (currently in beta) — Our hosting platform that includes features such as preview apps, built-in metrics and integration with your Git flow (https://platformatic.dev/). 
In this workshop you'll learn how to develop APIs with Fastify and deploy them to the Platformatic Cloud.
Building a Hyper Fast Web Server with Deno
JSNation Live 2021JSNation Live 2021
156 min
Building a Hyper Fast Web Server with Deno
WorkshopFree
Matt Landers
Will Johnston
2 authors
Deno 1.9 introduced a new web server API that takes advantage of Hyper, a fast and correct HTTP implementation for Rust. Using this API instead of the std/http implementation increases performance and provides support for HTTP2. In this workshop, learn how to create a web server utilizing Hyper under the hood and boost the performance for your web apps.
0 to Auth in an Hour Using NodeJS SDK
Node Congress 2023Node Congress 2023
63 min
0 to Auth in an Hour Using NodeJS SDK
WorkshopFree
Asaf Shen
Asaf Shen
Passwordless authentication may seem complex, but it is simple to add it to any app using the right tool.
We will enhance a full-stack JS application (Node.JS backend + React frontend) to authenticate users with OAuth (social login) and One Time Passwords (email), including:- User authentication - Managing user interactions, returning session / refresh JWTs- Session management and validation - Storing the session for subsequent client requests, validating / refreshing sessions
At the end of the workshop, we will also touch on another approach to code authentication using frontend Descope Flows (drag-and-drop workflows), while keeping only session validation in the backend. With this, we will also show how easy it is to enable biometrics and other passwordless authentication methods.
Table of contents- A quick intro to core authentication concepts- Coding- Why passwordless matters
Prerequisites- IDE for your choice- Node 18 or higher
Building out a meaningful test suite that's not all E2E
TestJS Summit 2023TestJS Summit 2023
89 min
Building out a meaningful test suite that's not all E2E
Workshop
David Burns
David Burns
We're all taught to follow the Testing Pyramid but the reality is that we build out the Testing Christmas Tree. In this workshop, David will talk you through how to break down projects and put the tests where they need to be. By the end of the workshop you will be able to update your projects so that anyone and everyone can start contributing and truly living up to "Quality is everyone job".
He will walk you through:- Component Testing- API Testing- Visual Regression Testing- A11Y testing
He will also talk you through how to get these all setup in your CI/CD pipeline so that you can get shorter and faster feedback loops.