GraphQL API Pentest Checklist

Common paths: /graphql, /api/graphql, /v1/graphql, /graphiql, /playground, /altair. Confirm whether multiple endpoints serve different roles (public vs admin).

A `__schema` probe is the cheapest discovery tool. Note whether introspection is on globally, on for staging only, or off (then plan for graphql-clairvoyance).

GraphQL pentest scope often excludes recursive depth bombs or destructive mutations. Get the exclusion list in writing before fuzzing.

Apollo, graphql-yoga, Hasura, Hot Chocolate, graphene, etc. each have distinct default behaviours and CVEs. graphw00f outputs implementation fingerprints.

Some servers accept the same query unauthenticated and reveal more types when auth is supplied. Test both paths and note the diff.

Field-level authorization can only be tested if you have at least two roles. Request anonymous, normal-user, and privileged-user credentials.

Use Burp Suite with the InQL extension or Caido GraphQL plug-in to render queries human-readably and to send tampered queries quickly.

Capture all GET/POST queries the legit client sends. This is your starting corpus for tampering and the baseline for diffing later.

GraphQL-over-GET enables CSRF and cache-poisoning attack surface. Note whether query, variables, and operationName are accepted via query string.

OWASP maintains a current cheat sheet of GraphQL-specific risks - load it into your notes so nothing standard slips by.

If introspection is enabled, capture the full schema via the canonical introspection query. This is the map for every later test.

clairvoyance reconstructs schemas by fuzzing field names against error messages. Slow but effective on production where introspection is locked.

Internal-only fields often survive into production schemas. Fields named *_internal, debug*, admin* are high-signal.

Most servers (Apollo, graphene) leak field-name suggestions on typos. Drive a wordlist through field-name slots and harvest suggestions.

Mutations are the high-value targets - both for BOLA testing and for destructive bugs. List them, assess privilege required, and note side effects.

Chase user.posts.comments.author.posts... down 6+ levels. Real PII often hides in transitively-loaded edges that the front-end never asks for.

Send a query of progressively deeper recursion (or fragment-cycle) until it errors. The threshold tells you the resource-DoS budget.

Custom scalars are typed `String` server-side. Any URL/JSON-typed scalar is a candidate for SSRF, prototype pollution, or path traversal.

GraphQL hides ORM behaviour. Use error messages, response shape, and sometimes intentional type errors to infer Postgres/Mongo/Elastic backends.

These developer UIs sometimes survive into production with introspection enabled and CSRF-relaxed CORS, expanding attack surface considerably.

OWASP API1. Substitute another tenant`s record IDs into queries. Particularly effective via fragments where the tested field is several levels deep.

Mutations like deletePost(id), updateUser(id, ...), transferFunds(from, to) - confirm authorization is checked on every mutable target ID.

Common bug: object-level auth passes but a sensitive field on the object (`creditCard`, `ssn`, `internalNotes`) is exposed regardless of role.

You may not be authorized to read User(id=42) directly, but Post(id=mine).author may resolve User(42) without re-checking.

Some implementations enforce role checks only in resolvers, not in schema directives. Send the mutation as a basic user and observe.

Anywhere a mutation accepts a URL, probe with internal IPs, cloud metadata endpoints, and DNS-rebinding bait.

Opaque base64 cursors often decode to predictable IDs or "afterId=N". Replay another tenant`s cursor against the query.

GraphQL-over-GET enables classic CSRF. POST + JSON only is generally safe, but CORS misconfig or text/plain content type defeats that.

Persisted queries by hash skip parsing. Confirm the auth check still runs when the query is served from the persisted-query cache.

Crafted @skip/@include conditions can sometimes elide authorization directives, or reorder execution to read protected fields.

Raw-string filters (`where`, `orderBy`, `q`) are the primary SQLi vector. Use sqlmap with the JSON variables and watch boolean / time-based behaviour.

Filters that accept JSON-shaped objects can be bent into $ne, $gt, $regex queries to bypass auth or dump records.

GraphQL aliases let one HTTP request fire 1000 login attempts as alias_1: login(...) ... alias_1000: login(...). Bypasses naive rate limits.

Apollo/Yoga support `[ {query: ...}, {query: ...} ]`. Same effect as aliases for rate-limit bypass and useful when aliases are filtered.

Build a recursive fragment cycle or 1000-edge query and confirm whether the server enforces cost analysis or depth limits.

`{ user { id id id id ... id } }` repeated thousands of times can amplify response size massively without triggering depth checks.

GraphQL servers in Node.js sometimes feed scalar inputs into ejs/handlebars templates. Standard SSTI payloads still apply.

Filename or URL-typed scalars sometimes feed `exec(...)` for thumbnails or file conversion. Probe with backticks, $(id), and ;.

GraphQL multipart spec uploads (Apollo) can carry XML/SVG/PDF that triggers XXE or SSRF on parse. Provide each MIME type and watch back-channels.

Stack traces, ORM query strings, internal hostnames - GraphQL errors are notoriously verbose. Trigger errors in every resolver class and review.

Show what fields, mutations, and types are reachable but undocumented. Often the highest-impact section for stakeholders.

API1/API3/API4 are the workhorses of GraphQL findings. Tag each result so risk-owners can dedupe across REST and GraphQL reports.

Most teams know SQLi but not GraphQL-specific abuse classes. A short taxonomy with examples accelerates remediation.

Generally: introspection off in prod, on in staging behind auth; GraphiQL/Playground off in prod outright.

Reference graphql-cost-analysis, graphql-depth-limit, Apollo`s built-in plugins, and document tuned thresholds based on test data.

Highest-leverage long-term fix. Limits the public API surface to a known set of hashes - kills most introspection-driven attacks.

Specifically callout how counts changed (1 HTTP request -> 1000 logical operations) so the AppSec team can fix at the right layer.

Schema directives are easy to bypass via fragments and persisted queries. Authorization should ultimately live in the resolver layer.

GraphQL findings reproduce poorly without the exact body. Attach the request payload as a curl one-liner and as a gql-cli command.

GraphQL schemas change weekly. A frozen-time pentest decays fast - bake a post-fix re-test (or schema-diff CI gate) into the SoW.