skills.rest
sseshachala
sseshachalaCOMMUNITY
Explore all skills by this author →
GitHub

hunt-graphql

Map GraphQL schemas and test authorization boundaries for IDOR and access control vulnerabilities.

Updated Jun 5, 2026
Search Tags:#authorization#security#graphql#pentesting#multitenancy#idor#bug-bounty
One-click install
npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-graphql-sseshachala
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-graphql
Source: https://github.com/sseshachala/Claude-BugHunter-archive/tree/main/skills/hunt-graphql
Command: npx skills add https://github.com/sseshachala/Claude-BugHunter-archive --skill hunt-graphql-sseshachala

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

GraphQL applications often expose complex authorization boundaries and vulnerability surfaces such as broken object-level access, cross-tenant data exposure, and misconfigured introspection. This skill provides a repeatable framework to identify, test, and chain GraphQL-based vulnerabilities across multi-tenant targets, helping researchers reproduce and report issues effectively.

Core Features & Use Cases

  • GraphQL endpoint discovery, introspection-based schema mapping, and authorization testing across REST/GraphQL boundaries.
  • IDOR and cross-tenant access testing in mutations and queries, including mutation-level authorization bypass attempts and field-level checks.
  • DoS/batching abuse and SSRF-esque payload testing via GraphQL arguments, with structured payloads and detection patterns for real-world reports.
  • Use cases include bug-bounty investigations on SaaS platforms, internal pentests, and red-team engagements where GraphQL surfaces sensitive data or privileges.

Quick Start

Begin by locating a GraphQL endpoint (for example, /graphql), run a basic introspection to enumerate types, and then attempt a low-privilege mutation to verify access controls.

Frequently Asked Questions about hunt-graphql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test GraphQL authorization vulnerabilities and IDOR in multi-tenant apps?▼

To test GraphQL authorization vulnerabilities and IDOR, you map schemas via introspection, test access controls on queries and mutations, and verify token-based boundary enforcement across tenants. This skill provides a repeatable workflow with concrete payloads to detect cross-tenant access risks.

What is the best way to find GraphQL IDOR and access control flaws during a pentest?▼

The best way to find GraphQL IDOR and access control flaws is by enumerating types through introspection, attempting low-privilege mutations, and executing field-level checks. This approach identifies broken object-level access and cross-tenant data exposure effectively.

Can I detect SSRF and DoS vulnerabilities through GraphQL batching and arguments?▼

Yes, you can detect SSRF-esque behavior and DoS vulnerabilities by injecting structured payloads into GraphQL arguments and abusing query batching. This skill includes specific detection patterns and payloads to reproduce and report these abuse scenarios.

Does this GraphQL security testing workflow apply to SaaS platforms with REST boundaries?▼

Yes, this testing workflow applies to web apps exposing GraphQL endpoints, including multi-tenant SaaS platforms. It specifically supports authorization testing across REST and GraphQL boundaries to uncover misconfigured introspection and privilege escalation risks.

How do I start a bug bounty investigation on a GraphQL endpoint?▼

To start a bug bounty investigation on a GraphQL endpoint, locate the endpoint path like /graphql, run a basic introspection query to enumerate the schema, and then attempt a low-privilege mutation to verify if access controls are properly enforced.

Related Skills

Explore More Software Engineering Skills→
cameronapakcameronapak
1

bknd-protect-endpoint

Enforce authentication and authorization checks on BKND API endpoints.

Community
Advanced
0xhaaz0xhaaz

security-arsenal

Provide security payloads, bypass tables, and submission rules for bug bounty hunting.

Community
Advanced
SalesforceCommerceCloudSalesforceCommerceCloud
51

b2c-scapi-shopper

Consume Salesforce B2C Shopper APIs with SLAS authentication for headless storefronts.

Official
Intermediate
zebbernzebbern
4.5k

Windows Privilege Escalation

Enumerate Windows privileges and misconfigurations to identify privilege escalation vectors.

Community
Advanced