skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

graphql-and-hidden-parameters

Identify GraphQL API vulnerabilities including hidden parameters and authorization gaps.

96|1|Updated Jun 4, 2026
Search Tags:#security testing#graphql#api security#vulnerability scanning#authorization bypass#injection testing#hidden parameters
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill graphql-and-hidden-parameters-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: graphql-and-hidden-parameters
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/graphql-and-hidden-parameters
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill graphql-and-hidden-parameters-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the gap in standard GraphQL security testing that only covers basic introspection, enabling security testers to discover high-severity, often overlooked vulnerabilities including hidden parameters, authorization gaps, batching abuse, and resolver injection flaws that can lead to data breaches and system compromise.

Core Features & Use Cases

  • Comprehensive attack surface coverage: Tests introspection, batching and alias abuse for rate limit bypass, hidden/undocumented field discovery, IDOR and field-level access control bypasses, mutation and subscription abuse, and injection via GraphQL resolvers.
  • Works with restricted GraphQL implementations: Includes techniques to discover schema and fields even when introspection is disabled, via field suggestions, frontend code mining, and known type probes.
  • Use case: For security teams testing web and mobile application GraphQL APIs, this Skill provides a structured playbook to systematically identify and validate exploitable flaws during authorized penetration tests.

Quick Start

Use the graphql-and-hidden-parameters skill to test a target GraphQL endpoint for authorization gaps, hidden fields, and injection vulnerabilities by running the provided probe queries and following the included decision tree to prioritize testing steps.

Frequently Asked Questions about graphql-and-hidden-parameters

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hidden parameters in a GraphQL API?▼

Hidden parameters in a GraphQL API can be discovered by leveraging field suggestions, frontend code mining, and known type probes to enumerate undocumented fields when introspection is disabled.

Can I test for authorization gaps and IDOR in GraphQL endpoints?▼

Testing for authorization gaps and IDOR in GraphQL endpoints involves applying structured probe queries to identify field-level access control bypasses and validate their exploitability during authorized security tests.

How does GraphQL batching abuse bypass rate limits?▼

GraphQL batching abuse bypasses rate limits by packaging multiple queries or aliases into a single HTTP request, overwhelming resolvers to extract data without triggering standard request volume thresholds.

What is the best way to test GraphQL APIs when introspection is disabled?▼

Testing GraphQL APIs with disabled introspection requires mining frontend code for queries, analyzing field suggestion errors, and probing known types to reconstruct the schema and discover hidden fields.

Can I test for resolver injection vulnerabilities in GraphQL?▼

Testing for resolver injection vulnerabilities in GraphQL requires executing structured probe queries designed to identify injection flaws within resolvers that could lead to data breaches or system compromise.

Does this GraphQL security testing approach work for mobile applications?▼

This GraphQL security testing approach works for mobile applications by systematically enumerating attack surfaces and validating exploitable flaws in authorized web and mobile GraphQL endpoints.

Related Skills

Explore More Software Engineering Skills→
AcczdyAcczdy
2

performing-graphql-introspection-attack

Extract GraphQL schemas and test for introspection and batching vulnerabilities.

Community
Intermediate
uphiagouphiago
1.1k

hunt-fastapi

Detect FastAPI-specific vulnerabilities including OpenAPI schema exposure and DI authorization gaps.

Community
Intermediate
giosuetedeschi-specgiosuetedeschi-spec

Burp Suite Web Application Testing

Intercept and modify HTTP traffic to test web application security.

Community
Advanced
sayseven7sayseven7
11

graphql-and-hidden-parameters

Probe GraphQL schemas and enumerate hidden request parameters for security assessments.

Community
Intermediate