web-vuln-graphql

What this skill does

Tests GraphQL APIs for security misconfigurations including introspection exposure, field-level authorization bypass, node() interface IDOR, query batching and alias-based rate limit bypass, mutation authorization gaps, nested query DoS, and directive overloading. Maps the full schema when introspection is enabled and systematically tests each finding for exploitable impact.

When to use

• When the target application exposes a /graphql or /api/graphql endpoint
• When auditing APIs for authorization bypasses (IDOR via GraphQL node IDs)
• When testing rate limit enforcement on sensitive operations (login, OTP, password reset)
• During bug bounty or penetration testing of modern web applications

Prerequisites

• curl installed
• GraphQL endpoint URL and a valid authentication token (user-level; admin token for comparison if available)

Inputs

Variable	Description	Example
GQL_URL	GraphQL endpoint URL	https://api.example.com/graphql
AUTH_TOKEN	Bearer token for authenticated requests	eyJhbGci...
VICTIM_USER_ID	A second user's base64 node ID for IDOR testing	dXNlcjoy

Workflow

Step 1: Test introspection enabled

GQL_URL="https://api.example.com/graphql"
AUTH_TOKEN="YOUR_BEARER_TOKEN"

echo "=== Step 1: Introspection test ==="

# Unauthenticated introspection
curl -s -X POST "$GQL_URL" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __schema { queryType { name } } }"}' | python3 -m json.tool

echo ""

# Authenticated introspection
curl -s -X POST "$GQL_URL" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $AUTH_TOKEN" \
  -d '{"query":"{ __schema { queryType { name } } }"}' | python3 -m json.tool

Step 2: Extract full schema via introspection

echo ""
echo "=== Step 2: Full schema extraction ==="

curl -s -X POST "$GQL_URL" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $AUTH_TOKEN" \
  -d '{
    "query": "{ __schema { types { name kind fields { name type { name kind ofType { name kind } } args { name type { name kind } } } } } }"
  }' > /tmp/gql_schema.json

python3 -m json.tool /tmp/gql_schema.json > /tmp/gql_schema_pretty.json

echo "Schema saved to /tmp/gql_schema_pretty.json"
echo ""
echo "=== Types found ==="
python3 -c "
import json
with open('/tmp/gql_schema.json') as f:
    data = json.load(f)
types = data.get('data', {}).get('__schema', {}).get('types', [])
for t in types:
    if not t['name'].startswith('__'):
        print(f\"  {t['kind']:12} {t['name']}\")
" 2>/dev/null

echo ""
echo "=== Potentially sensitive fields (look for: ssn, dob, password, token, secret, admin, role) ==="
python3 -c "
import json
with open('/tmp/gql_schema.json') as f:
    data = json.load(f)
types = data.get('data', {}).get('__schema', {}).get('types', [])
sensitive = ['ssn','dob','password','token','secret','admin','role','credit','salary','phone','address']
for t in types:
    for field in (t.get('fields') or []):
        name_lower = field['name'].lower()
        if any(s in name_lower for s in sensitive):
            print(f\"  {t['name']}.{field['name']}\")
" 2>/dev/null