What problem does it solve? When a CTF challenge or authorized target exposes a GraphQL endpoint, testers often lack a structured workflow to enumerate the schema, bypass disabled introspection, and exploit injection or authorization flaws. ## Core Features & Use Cases - Endpoint Discovery & Introspection: Confirms /graphql endpoints with a __typename probe and extracts the full schema via introspection queries. - Introspection Bypass Techniques: Covers field suggestion enumeration, GET request WAF bypass, alias/fragment obfuscation, and case/whitespace mutations when introspection is disabled. - Exploitation Patterns: Provides alias-based batch ID enumeration, SQL injection through GraphQL arguments, mutation-based privilege escalation, and rate-limit bypass via batched aliases. - Use Case: During an authorized CTF web challenge, you find /graphql returning data/errors JSON. Follow the phases to dump the schema, enumerate hidden flag fields, and extract the flag via aliased batch queries. ## Quick Start Ask the agent to load the graphql-methodology skill and test the target's /graphql endpoint starting with an introspection query.
