graphql-pentest

What problem does it solve?

Penetration testers and security teams often miss critical GraphQL API vulnerabilities due to ad-hoc testing approaches that fail to cover the full attack surface, including resource abuse, auth flaws, and information disclosure. This Skill eliminates that gap with a structured, repeatable testing workflow.

Core Features & Use Cases

• Complete Attack Surface Coverage: Tests all common GraphQL vulnerability classes including batching DoS, alias amplification, circular fragment crashes (CWE-674), deep nesting, introspection exploitation, and content-type CSRF.
• Backend-Aware Testing: Includes fingerprinting for Apollo Server, graphql-java, Hasura, and Yoga to avoid wasting time on inapplicable attack vectors.
• Use Case: A red team assessing a customer-facing application with a GraphQL API can use this Skill to systematically identify all exploitable flaws, measure DoS impact with timing evidence, and produce validated proof for remediation.

Quick Start

Use the graphql-pentest skill to run a full security assessment of all GraphQL endpoints on your target application, including resource abuse, auth bypass, and information disclosure testing.