skills.rest
pdparchitect
pdparchitectCOMMUNITY
Explore all skills by this author →
Website𝕏@pdpGitHub

hunt-graphql

Identify and exploit GraphQL API vulnerabilities including IDOR and broken authorization.

13|2|Updated Jun 1, 2026
Search Tags:#security#vulnerability#api#graphql#pentesting#idor
One-click install
npx skills add https://github.com/pdparchitect/rook --skill hunt-graphql-pdparchitect
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-graphql
Source: https://github.com/pdparchitect/rook/tree/main/skills/hunt-graphql
Command: npx skills add https://github.com/pdparchitect/rook --skill hunt-graphql-pdparchitect

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the complex security challenges of GraphQL APIs, where traditional REST-based security testing often fails to uncover deep-seated authorization and state-synchronization vulnerabilities.

Core Features & Use Cases

  • Schema Enumeration: Discover hidden endpoints and fields even when introspection is disabled.
  • Authorization Testing: Identify IDORs, broken object-level authorization, and cross-tenant data exposure.
  • Advanced Exploitation: Detect race conditions, batching-based DoS, and state desynchronization between GraphQL and REST APIs.

Quick Start

Use the hunt-graphql skill to audit the target endpoint at https://api.example.com/graphql for authorization bypasses and schema vulnerabilities.

Frequently Asked Questions about hunt-graphql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test GraphQL APIs for IDOR and broken authorization vulnerabilities?▼

Testing GraphQL APIs for IDOR requires mapping query structures and analyzing mutation side effects to verify cross-tenant data isolation. This process targets production endpoints to identify broken object-level authorization and cross-tenant data exposure.

Can I enumerate a GraphQL schema when introspection is disabled?▼

Enumerating a GraphQL schema with disabled introspection involves discovering hidden endpoints and fields through systematic analysis of query structures. This technique uncovers hidden schema elements without relying on standard introspection queries.

How do I detect state desynchronization between GraphQL and REST APIs?▼

Detecting state desynchronization between GraphQL and REST APIs involves analyzing query structures and mutation side effects for race conditions. This approach identifies synchronization flaws by verifying cross-tenant data isolation across overlapping API endpoints.

What is the best way to test GraphQL mutations for security flaws?▼

The best way to test GraphQL mutations for security flaws is to systematically analyze mutation side effects and query structures. This method identifies authorization bypasses and cross-tenant data exposure on production endpoints.

Does GraphQL batching cause denial of service vulnerabilities?▼

GraphQL batching can cause denial of service vulnerabilities when query structures allow resource exhaustion. Detecting these batching-based DoS flaws requires systematic analysis of mutation security and query structures targeting production endpoints.

Related Skills

Explore More Software Engineering Skills→
AstorYHAstorYH
15

graphql-introspection

Query a GraphQL endpoint to discover its schema and available operations.

Community
Basic
EntroVyxEntroVyx
3

hunt-graphql

Identify and exploit GraphQL vulnerabilities including IDOR, authorization bypasses, and race conditions.

Community
Advanced
vinocrzyvinocrzy

ecommerce-tenancy

Implement and verify multi-tenant data isolation across Laravel stores.

Community
Advanced
YukiIto1999YukiIto1999

api-security

Automate API security assessment across GraphQL, REST, WebSocket, and Web-LLM interfaces.

Community
Intermediate