dolevf/Damn-Vulnerable-GraphQL-Application

Health v2 · maintenance only

Adoption not part of the score

1705 stars · 375 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

Damn Vulnerable GraphQL Application (DVGA) is an intentionally insecure GraphQL service built for learning and practicing GraphQL security attacks. It ships with beginner and expert modes covering reconnaissance, denial of service, injection, code execution, and authorization bypass scenarios.

Use cases

• practice exploiting graphql vulnerabilities
• learn graphql security concepts
• train a security team on graphql attacks
• test graphql pentesting tools against a safe target
• set up a deliberately vulnerable graphql lab
• learn graphql introspection and dos attacks

When to choose

• you want a safe, self-hosted target to practice graphql exploitation
• you are teaching or learning graphql security hands-on
• you need a benchmark app to validate graphql security scanners

When to avoid

• you need a production graphql server or framework
• you want a secure reference implementation to copy
• you are not interested in security training

Facets

application · maturity active

security penetration-testing graphql web-framework security penetration-testing web-development education apis python self-hosted cross-platform graphql-security vulnerable-app security-training ctf exploitation learning-by-doing docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="dolevf/Damn-Vulnerable-GraphQL-Application")