vapt-graphql

GraphQL Security Testing

When Invoked

The user runs /vapt graphql <url> for deep GraphQL-specific security testing.

This is a specialized extension of vapt-api. While vapt-api covers basic GraphQL checks (introspection, depth, batching), this skill provides comprehensive GraphQL attack surface analysis.

Phase 1: GraphQL Discovery & Fingerprinting

1.1 Endpoint Detection

# Common GraphQL endpoint paths
for path in /graphql /graphiql /v1/graphql /v2/graphql /api/graphql /query /gql /graphql/console /altair /playground; do
    code=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
        -H "Content-Type: application/json" \
        -d '{"query":"{__typename}"}' <url>$path)
    [ "$code" != "404" ] && [ "$code" != "405" ] && echo "GraphQL candidate: $path ($code)"
done

1.2 Engine Fingerprinting

Identify the GraphQL server implementation:

# Apollo Server detection
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{__typename}"}' <url>/graphql | grep -i apollo

# Check for engine-specific headers
curl -sI -X POST -H "Content-Type: application/json" \
    -d '{"query":"{__typename}"}' <url>/graphql

Look for indicators of:

• Apollo Server (Node.js)
• graphql-yoga (Node.js)
• Hasura (auto-generated)
• AWS AppSync
• Graphene (Python)
• graphql-java
• Strawberry (Python)
• Hot Chocolate (.NET)

Engine detection informs which vulnerabilities are most likely.

Phase 2: Schema Reconnaissance

2.1 Full Introspection Query

curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ __schema { queryType { name } mutationType { name } subscriptionType { name } types { name kind description fields(includeDeprecated: true) { name description args { name type { name kind ofType { name kind } } } type { name kind ofType { name kind } } isDeprecated deprecationReason } inputFields { name type { name kind ofType { name kind } } } enumValues { name } possibleTypes { name } } directives { name description locations args { name type { name kind ofType { name kind } } } } } }"}' \
    <url>/graphql