hunt-graphql

To test GraphQL authorization boundaries, you probe resolvers to verify if they enforce the same access controls as equivalent REST actions, specifically targeting IDOR-prone global IDs and validating mutation-focused authorization checks across different privilege tiers.

GraphQL state desync occurs when GraphQL resolvers and overlapping REST APIs enforce inconsistent access controls. You hunt for it by testing for persistent privilege retention after revocation and validating cross-API authorization desynchronization during bug bounty recon.

You discover GraphQL endpoints by probing URL patterns, JSON POST behavior, and frontend JS bundle signals like Apollo or Relay usage. Schema mapping involves performing introspection attempts, minimal probes, and schema enumeration tactics to map type relationships.

Yes, this approach applies to bug-bounty style recon and validation workflows targeting GraphQL on any platform. It is specifically designed for environments suspecting dual-write surfaces, IDOR-prone global IDs, or persistent privilege retention after revocation.

You generate reproduction-ready PoCs by sequencing deterministic verification steps that test authorization boundaries across mutations and related REST overlaps, ensuring the exploit is consistently reproducible across privilege tiers.

When introspection is disabled, you can find high-impact mutations by using schema-suggestion techniques and minimal probes to enumerate the schema, mapping type relationships to identify mutations that alter state or escalate privileges.