skills.rest
baiqigo
baiqigoCOMMUNITY
Explore all skills by this author →
GitHub

hunt-graphql

Tests GraphQL endpoints for IDOR, authorization bypass, SSRF, and cross-API state desynchronization vulnerabilities.

10|3|Updated Aug 10, 2026
Search Tags:#graphql#introspection#api security#bug bounty#idor#vulnerability hunting#authorization testing
One-click install
npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-graphql-baiqigo
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-graphql
Source: https://github.com/baiqigo/baiqi-redteam-lab/tree/main/.agents/skills/hunt-graphql
Command: npx skills add https://github.com/baiqigo/baiqi-redteam-lab --skill hunt-graphql-baiqigo

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? GraphQL endpoints expose broad attack surfaces that are easy to miss during manual testing, including broken object-level authorization, cross-tenant IDOR via global IDs, and state desynchronization between REST and GraphQL APIs. This Skill provides a structured, evidence-gated hunting methodology built from 12 real disclosed bug bounty reports. ## Core Features & Use Cases - Endpoint Discovery & Schema Mapping: Detect GraphQL endpoints via URL patterns, JS bundle analysis, and response signals, then enumerate schemas using introspection, field-suggestion probing, and clairvoyance when introspection is blocked. - Authorization & IDOR Testing: Systematically replay mutations across privilege tiers, swap relay global IDs across tenants, and test node() resolvers for broken object-level authorization. - Cross-API Desync & Race Testing: Identify REST/GraphQL dual-write surfaces where privilege revocation fails to propagate, and evaluate alias batching versus parallel HTTP for race-condition exploitation. - Use Case: While testing a B2B SaaS platform, you discover a /graphql endpoint, map its schema, find a mutation that mirrors a REST permission change, and demonstrate that a removed team member retains admin access via the GraphQL mutation — a critical cross-API authorization bug. ## Quick Start Use the hunt-graphql skill to plan an evidence-gated, authorized validation of the GraphQL endpoint on my in-scope bug bounty target.

Frequently Asked Questions about hunt-graphql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test a GraphQL API for IDOR vulnerabilities?▼

GraphQL IDOR testing focuses on node() resolvers and relay global IDs, which often encode object type and ID as base64. Decode the ID, swap it with another tenant's object ID, and replay the query or mutation with your own token to check for missing object-level authorization.

How to enumerate a GraphQL schema when introspection is disabled?▼

Schema enumeration without introspection uses field-suggestion errors, where invalid field names trigger 'did you mean' responses revealing real fields. Tools like clairvoyance brute-force field names against wordlists, and JS bundles often contain hardcoded query strings exposing the schema.

Does alias batching bypass GraphQL rate limits and race protections?▼

Alias batching only wins races against multi-threaded or DataLoader-batched resolvers that execute aliases concurrently. Single-threaded resolvers run aliases serially, so the first mutation closes the door; combine batching with parallel HTTP requests for reliable race exploitation.

What is REST and GraphQL state desynchronization?▼

State desynchronization occurs when the same resource is modifiable via both REST and GraphQL with inconsistent authorization or cascading effects. A privilege revoked through the REST API may persist or be re-granted through the equivalent GraphQL mutation, leaving covert access.

When is GraphQL introspection alone reportable as a vulnerability?▼

Introspection alone is informational and not reportable under the Body-Diff Rule. It becomes valuable as reconnaissance that unlocks a concrete cross-tenant read or impactful mutation, which is the actual reportable finding requiring a working proof of concept.

Related Skills

Explore More Software Engineering Skills→
salmanabdurrahmansalmanabdurrahman

recon-js-analysis

Extract API endpoints, routing tables, and environment configurations from client-side JavaScript bundles.

Community
Advanced
hhjkjkjkhhjkjkjk

report-writing

Generates platform-specific bug bounty report templates with CVSS scoring and severity guidance.

Community
Intermediate
ricardoo022ricardoo022

scan-fase-9

Identify and exploit GraphQL, mass assignment, IDOR, and race condition vulnerabilities.

Community
Advanced
uphiagouphiago
1.1k

hunt-fastapi

Detect FastAPI-specific vulnerabilities including OpenAPI schema exposure and DI authorization gaps.

Community
Intermediate