web-vuln-graphql

What problem does it solve?

Tests GraphQL APIs for security misconfigurations and improper access control, enabling faster discovery of exposure risks.

Core Features & Use Cases

• Introspection exposure checks and field-level authorization assessment
• Node() interface IDOR testing and schema mapping when allowed
• Query batching, alias-based rate-limit bypass, mutation authorization checks, and nested query DoS testing
• Directive overloading validations and practical bug-bounty oriented scenarios

Quick Start

Provide a sample GraphQL endpoint URL and token, then run the tests as described to map the schema and test for misconfigurations.