Testing playbook · intermediate

GraphQL Abuse

Enumerate and attack GraphQL: schema recovery, authorization gaps, and resource abuse.

graphqlintrospectionbolados

Stable IDplaybook:graphql-abuseLast updated2026-08-20Last verifiedLegacy review pendingProvenanceCurated workflow

Detection firstStop as soon as the evidence decisively supports or falsifies the hypothesis.

Every step requires authorization. Review side effects before running commands against a live system.

Recover the schema

Try introspection first; if disabled, brute-force field names via suggestion errors.

clairvoyance https://target.com/graphql -o schema.json -w graphql-words.txt

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Check batching, field suggestions, CSRF (GET/urlencoded), and debug-mode error leakage.

graphql-cop -t https://target.com/graphql

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Query objects by ID across tenants and call privileged mutations as a low-priv user - the top GraphQL vuln.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Test deeply nested queries, aliases, and batching for mass-assignment and resource exhaustion.

Evidence checkpointSave the request or command, raw result, timestamp, target, and a negative control before continuing.

Field notes

Aliases let you brute-force (e.g., login) hundreds of times in one request - great for rate-limit bypass.
Mutations are where authz is most often forgotten.

Related tools

Sources

Version history: normalized permanent page created 2026-08-20.