skills.rest
uphiago
uphiagoCOMMUNITY
Explore all skills by this author →
Website𝕏@uphiagoGitHub

hunt-graphql

Identify and validate high-severity GraphQL vulnerabilities including IDOR, SSRF, and auth bypass.

1.1k|191|Updated Jun 24, 2026
Search Tags:#penetration testing#graphql#ssrf#bug bounty#idor#vulnerability hunting#auth bypass
One-click install
npx skills add https://github.com/uphiago/recon-skills --skill hunt-graphql-uphiago
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-graphql
Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-graphql
Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-graphql-uphiago

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill fills the gap left by standard web application scanners, which often miss high-value GraphQL-specific vulnerabilities including IDOR, SSRF, race conditions, and authorization bypasses that can lead to critical data breaches or top-tier bug bounty payouts.

Core Features & Use Cases

  • Comprehensive Vulnerability Coverage: Hunts 12+ distinct GraphQL flaw classes including IDOR via global node IDs, mutation auth bypasses, SSRF via query arguments, batch DoS, query cost bypass, PII exposure from missing field-level authz, and cross-tenant data access flaws.
  • Proven Step-by-Step Methodology: Provides a full hunting workflow from endpoint discovery and schema mapping to REST/GraphQL overlap analysis and cross-API state desync testing, with clear validation gates to ensure findings are reportable and reproducible.
  • Verified Real-World Examples: Includes 12 public bug bounty reports with payouts up to $20,000 from platforms including GitHub, Shopify, Stripe, and GitLab, each with working proof-of-concept details and root cause analysis.
  • Defense Bypass Techniques: Includes proven workarounds for common security controls including disabled introspection, depth limiting, rate limiting, WAF blocks, and persisted query whitelisting.

Quick Start

Use the hunt-graphql skill to test a target's GraphQL endpoint for IDOR, auth bypass, and SSRF vulnerabilities, and develop a valid proof-of-concept for any high-severity findings you identify.

Frequently Asked Questions about hunt-graphql

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find IDOR and auth bypass vulnerabilities in GraphQL APIs?▼

To find IDOR and auth bypass vulnerabilities in GraphQL APIs, you can use a hunting workflow that performs endpoint discovery, schema enumeration, and authorization boundary testing to validate high-severity flaws like global node ID manipulation and mutation auth bypasses.

What is the best way to test for SSRF vulnerabilities in GraphQL mutations?▼

The best way to test for SSRF vulnerabilities in GraphQL mutations is to analyze query arguments for internal network interaction potential, validating proof-of-concept payloads against the target endpoint to confirm server-side request forgery execution.

How do I enumerate a GraphQL schema when introspection is disabled?▼

You can enumerate a GraphQL schema when introspection is disabled by applying defense bypass techniques that infer query structures through error-based probing, field suggestion analysis, and REST/GraphQL overlap mapping.

Does standard web application scanner testing work for finding GraphQL race conditions?▼

Standard web application scanner testing often misses GraphQL race conditions and cross-API state desync flaws, requiring dedicated cross-tenant data access analysis and state desync testing to identify these high-severity vulnerabilities.

Can I bypass query depth limiting and rate limiting in GraphQL for bug bounty hunting?▼

You can bypass query depth limiting and rate limiting in GraphQL by utilizing batch DoS techniques, query cost bypass methods, and persisted query whitelisting workarounds to test the target's security controls effectively.

How do I develop a proof-of-concept for PII exposure from missing field-level authorization in GraphQL?▼

To develop a proof-of-concept for PII exposure from missing field-level authorization in GraphQL, map the schema to identify unprotected sensitive fields, query them directly, and document the resulting unauthorized data access.

Related Skills

Explore More Software Engineering Skills→
ricardoo022ricardoo022

scan-fase-1

Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.

Community
Advanced
jinyimeng01jinyimeng01
54

report-agent

Generate HackerOne-format vulnerability reports from validated security findings.

Community
Advanced
Prohao42Prohao42
120

request-smuggling

Detect CL.TE, TE.CL, and HTTP/2 downgrade desynchronization between proxies and origins.

Community
Advanced
EntroVyxEntroVyx
3

bb-local-toolkit

Coordinate reconnaissance, vulnerability research, and exploit chaining for bug bounty hunting.

Community
Advanced