# API GRAPHQL

> Attack GraphQL APIs. Load on /graphql, /graphiql, /v1/graphql, a POST with {"query":"..."}, Apollo/Hasura/graphene stacks, or "query/mutation" language. Signals: introspection enabled, batched queries, deeply nested fields, __schema, aliases.

- Skill: `noorqureshi/api-graphql` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/api-graphql`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/api-graphql/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Integrations & APIs
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/api-graphql

---


# GraphQL abuse

## When it applies
The target exposes a GraphQL endpoint. GraphQL collapses many objects behind one URL, so
authorization gaps and info leaks are common and easy to miss with URL-based testing.

## Why it works
One endpoint, a self-describing schema, and per-field resolvers mean access control must be
enforced at every field/resolver — it frequently isn't. Introspection hands you the entire
attack surface; batching/aliases turn one request into thousands.

## Method
1. **Fingerprint & map**: `graphw00f` for the engine; if introspection is on, dump the schema
   (`{__schema{types{name fields{name}}}}`) with `inql`/`clairvoyance`. If off, brute field
   names with `clairvoyance` (error messages leak valid fields).
2. **AuthZ testing (BOLA/BFLA)**: call queries/mutations for objects and admin operations you
   shouldn't reach; swap ids in arguments (same as IDOR) — resolvers often skip owner checks.
3. **Info disclosure**: reach sensitive fields/types (users, tokens, internal flags) via
   nested relations even when the "front door" query hides them.
4. **DoS / cost**: deeply nested recursive queries and aliased batching (`a:login b:login ...`)
   to bypass rate limits or brute-force — respect program rules on this.
5. **Injection**: arguments feed backends — test SQLi/NoSQLi in GraphQL variable values.

## Gotchas
- Introspection off ≠ safe — field brute-forcing and suggestion errors still map the schema.
- Rate-limit bypass via batching/aliases is a real, reportable finding on many programs.
- Mutations are where impact lives; don't stop at read queries.

## Verify success
Retrieve/modify data through a query or mutation your role shouldn't allow, or dump a schema
that reveals hidden admin operations.

## References
PortSwigger GraphQL labs; OWASP API Security Top 10 (2023); graphw00f/inql docs.