hunt-graphql

What problem does it solve?

This Skill helps you discover and systematically validate GraphQL security weaknesses—especially authorization persistence, schema/IDOR issues, and REST/GraphQL state desynchronization—so you can move from endpoint recon to a credible impact proof.

Core Features & Use Cases

• GraphQL discovery & confirmation: Identify likely GraphQL endpoints, confirm behavior via introspection probes, and detect schema presence using response patterns and JavaScript bundle clues.
• Schema and surface mapping: Enumerate types/fields, spotlight mutations that affect permissions or ownership, and map relationships to understand where access control can break.
• Authorization & state desync testing: Compare authorization behavior between GraphQL and equivalent REST actions, test persistence after revocation, and validate cross-tenant or cross-context IDOR risks.
• Practical validation workflow: Produce reproducible exploitation chains by replaying mutations as different privilege tiers, documenting ordering effects, and checking batch/alias amplification behavior.

Quick Start

Use the hunt-graphql skill to enumerate a target’s GraphQL endpoints, map permission-related mutations, and build a reproducible proof of authorization persistence or REST/GraphQL state desync.