offensive-graphql

Start by discovering the endpoint with a {__typename} query, fingerprint it with graphw00f, then dump the schema via introspection. Follow with authorization testing on every query and mutation, injection through variables, batching abuse, and depth-based denial of service checks.

Use the field suggestion oracle by querying invalid field names and harvesting 'Did you mean' responses. Automate this with clairvoyance, which iterates a wordlist and assembles a reconstructed schema, or extract query strings from client-side JavaScript bundles.

Common tools include InQL for Burp Suite schema parsing, graphql-cop for configuration audits, CrackQL and BatchQL for batching attacks, clairvoyance for schema reconstruction, graphw00f for fingerprinting, and GraphQL Voyager for visualization.

Yes. GraphQL servers often accept arrays of operations in one HTTP request, while rate limiters count requests rather than operations. Batching hundreds of login or OTP verification mutations in a single request enables brute force and 2FA bypass.

Relay node IDs are base64-encoded values like 'User:123'. Decode them, increment the numeric portion, re-encode, and query through the node interface with another user's ID. Missing ownership checks in resolvers expose the data.

Depth bombs fail when servers enforce query depth limits (typically 7-10 levels) or use cost analysis tools like GraphQL Armor. Circular fragment attacks also fail on modern implementations that detect fragment cycles during validation.