// -

Intro It is officially Burp Extensibility Month. Burp Suite is the most used security tool, when it comes to web application security. It already has many built-in features. However, Burp Extensions allow you to level up your existing testing processes, and workflow. There are a lot of them with most of them being available for Burp Suite Community Edition users. In this blog post I would like to talk about some of them that I use quite often when I am testing for Bug Bounty Programs or when I am doing CTFs.

Recently I got interested in API hacking, seeing during my tests more and more companies transforming their architectures from monolithic design to microservices. In this first part of my GraphQL hacking series you will get an introduction on what GraphQL is, and at the end I will show a critical finding I found regarding the GraphQL API of Belgian train company NMBS/SNCB. What Are APIs Being in this field it’s impossible to not be aware of APIs unless one lives under a rock.