Identify and exploit GraphQL API vulnerabilities including IDOR and broken authorization.
npx skills add https://github.com/pdparchitect/rook --skill hunt-graphql-pdparchitect
Please help me install this Agent Skill. Skill: hunt-graphql Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-graphql Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-graphql-pdparchitect
This skill addresses the complex security challenges of GraphQL APIs, where traditional REST-based security testing often fails to uncover deep-seated authorization and state-synchronization vulnerabilities.
Use the hunt-graphql skill to audit the target endpoint at https://api.example.com/graphql for authorization bypasses and schema vulnerabilities.
High-intent search queries and answers about installing and using this skill.
Testing GraphQL APIs for IDOR requires mapping query structures and analyzing mutation side effects to verify cross-tenant data isolation. This process targets production endpoints to identify broken object-level authorization and cross-tenant data exposure.
Enumerating a GraphQL schema with disabled introspection involves discovering hidden endpoints and fields through systematic analysis of query structures. This technique uncovers hidden schema elements without relying on standard introspection queries.
Detecting state desynchronization between GraphQL and REST APIs involves analyzing query structures and mutation side effects for race conditions. This approach identifies synchronization flaws by verifying cross-tenant data isolation across overlapping API endpoints.
The best way to test GraphQL mutations for security flaws is to systematically analyze mutation side effects and query structures. This method identifies authorization bypasses and cross-tenant data exposure on production endpoints.
GraphQL batching can cause denial of service vulnerabilities when query structures allow resource exhaustion. Detecting these batching-based DoS flaws requires systematic analysis of mutation security and query structures targeting production endpoints.
AstorYHQuery a GraphQL endpoint to discover its schema and available operations.
EntroVyxIdentify and exploit GraphQL vulnerabilities including IDOR, authorization bypasses, and race conditions.
vinocrzyImplement and verify multi-tenant data isolation across Laravel stores.
YukiIto1999Automate API security assessment across GraphQL, REST, WebSocket, and Web-LLM interfaces.
