Aleksa Zatezalo
Aleksa is a passionate security engineer, software developer, and aspiring open sorcerer. He enjoys writing and publishing software that provides elegant solutions to offensive security problems. He has contributed to multiple projects, including Metasploit. In April of 2022, Aleksa graduated from the University of Toronto with a bachelor’s degree in computer science and a Certificate of Ethical Hacking (CEHv10). He began working as a Cloud Security consultant and hacker. He also began attending Defcon as an attendee and a volunteer for the Blue Team Village (BTV). One of Aleksa’s fondest cybersecurity memories is playing the Pros Versus Joes CTF during BSides Las Vegas. By April 2024, Aleksa had obtained his OSCP and begun working as a security engineer at Praetorian. He is currently pursuing his OSCE3. He enjoys Brazilian Jiu-Jitsu, running long distances, and reading in his free time. He currently holds a blue belt in Brazilian Jiu-Jitsu. The book Mastery by Robert Greene is a big inspiration for Aleksa.
Session
GraphQL's flexibility creates an attack surface traditional scanners weren't built for. GrapeQL is a modular GraphQL security platform that covers the full kill chain: fingerprinting the engine, probing for injection, auth bypass, IDOR, and DoS, then handing confirmed findings to an AI agent that produces a vulnerability report along with working exploit scripta.
The platform ships as a browser-based tool. Upload or edit YAML test cases directly in the UI, point it at an endpoint, and let it run. When a finding lands, click Exploit — the agent probes the vulnerable query or mutation with tailored payloads and emits a self-contained Python script you can download and run. It will be demo this live against a deliberately vulnerable GraphQL API, covering SQLi, command injection, and DOS attacks.
The talk is honest about where agentic generation earns its keep (injection chains, auth bypass) and where it doesn't (blind OOB, complex fragment bombs). If you're securing GraphQL APIs — or building tools for people who do — this is the architecture walkthrough you want.