️ 𝗪𝗛𝗔𝗧’𝗦 𝗢𝗟𝗗 𝗜𝗦 𝗡𝗘𝗪: 𝗘𝗫𝗣𝗟𝗢𝗜𝗧𝗜𝗡𝗚 𝗖𝗟𝗔𝗦𝗦𝗜𝗖 𝗩𝗨𝗟𝗡𝗘𝗥𝗔𝗕𝗜𝗟𝗜𝗘𝗦 𝗜𝗡 𝗚𝗥𝗔𝗣𝗛𝗤𝗟 𝗔𝗣𝗜𝗦 – Aleksa Zatezalo

Modern tech doesn’t mean modern security. This session walks through a real-world penetration test where a production GraphQL API backed by PostgreSQL was compromised using classic attack techniques—from schema enumeration to identifying vulnerable resolvers and injection points.

Follow the full exploitation chain from blind SQL injection to database superuser access, and uncover how broken authentication logic in GraphQL can expose sensitive data. With a live demo of GrapeQL, attendees will gain practical testing workflows and defensive strategies to properly secure GraphQL APIs.

Aleksa Zatezalo is a security engineer and offensive security researcher with experience in cloud security, penetration testing, and exploit development. A contributor to projects like Metasploit and an active member of the security community, he focuses on building practical tools and techniques to uncover and fix real-world vulnerabilities.

Conference Dates: 6–8 May 2026 | 09:00–18:00
14, Porte de France, Esch-sur-Alzette, Luxembourg
️ Tickets: [https://2026.bsides.lu/tickets/](https://2026.bsides.lu/tickets/)
Schedule Link: [https://pretalx.com/bsidesluxembourg-2026/schedule/](https://pretalx.com/bsidesluxembourg-2026/schedule/)

View full schedule & build your agenda: [https://hackertracker.app/schedule?conf=BSIDESLUX2026](https://hackertracker.app/schedule?conf=BSIDESLUX2026)

#BSidesLuxembourg2026 #GraphQL #AppSec #WebSecurity #SQLInjection #CyberSecurity