GraphQL hunting

Playbooks

• API Hunting Methodology - Discover, understand, and abuse API surface - usually where the real vulns hide.
• GraphQL Abuse - Enumerate and attack GraphQL: schema recovery, authorization gaps, and resource abuse.

Gadgets

• Debug / actuator / env endpoint - Information leak alone is P4. Env with cloud keys, heap dumps, or gateway routes is a foothold.
• IDOR parameter - The param is inventory until you prove a second user can read or write the object.
• WebSocket IDOR / missing auth - Subscribe to another user's channel, replay a privileged event, or skip the HTTP auth that the REST API has.
• Mass assignment / extra JSON field - role, isAdmin, verified, balance, price, tenantId, twoFactorEnabled in a request the client never sends.
• GraphQL node(id) / alias batch - Relay-style node(id) and aliased batch queries skip the UI's object graph. Same as IDOR, with a nicer query language.

Payloads

• GraphQL - Start with introspection to dump the schema; if it's off, use field-suggestion errors (clairvoyance) to rebuild it. Then hunt BOLA/BFLA on objects and mutations.
• Mass assignment - Extra keys on register / PATCH / GraphQL update. Prove the new field changes authz, not just the JSON echo.
• IDOR / object-ID canaries - Two-account object identifiers and verb swaps. Use records you created. The payload is the ID, not a dump.

Bypasses

• GraphQL authorization and batching - UI hide is not schema hide. Aliases, batch, and node(id) skip the screen the designer drew.

Checklists

• API / GraphQL - The UI is a subset of the schema. Hunt the schema.
• GraphQL - The schema is the app. Introspection off just means you reconstruct it.

Tools

• graphql-cop - Fast security auditor for GraphQL: checks introspection, batching, field suggestions, CSRF, and DoS-prone features in one pass.
• clairvoyance - Recovers a GraphQL schema even when introspection is disabled, by abusing field-suggestion error messages. Rebuilds the attack surface others can't see.
• jq - JSON processor. Every API hunt ends in jq. Filter httpx/nuclei JSONL, reshape GraphQL, extract token fields.

Workflows

• Find GraphQL → introspect → Cop - Locate the endpoint, dump the schema if allowed, then run the cheap automated checks.
• GraphQL operation boundaries - Map which queries and mutations each test role may execute, including object-level authorization and persisted-operation handling. Keep introspection and volume within the program's rules.
• Two-account object replay - Capture object IDs as A, replay as B across GET/PUT/DELETE, batch, and GraphQL node(id). The pipeline is a notebook, not a scanner.

Questions

Introspection is disabled. Now what?

Field suggestions, clairvoyance, persisted-query hashes, mobile APKs, and JS operation names rebuild the schema.

Is batching a finding?

Batching or aliases that skip rate limits or authorization are. A working introspection on a public playground is usually P4/P5.

This page is the public form of hunt_brief("graphql") on the MCP connector. Authorized testing only.