GraphQL
Introspection Query
query
| |
inline
{__schema{queryType{name}mutationType{name}subscriptionType{name}types{...FullType}directives{name description locations args{...InputValue}}}}fragment FullType on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValue}type{...TypeRef}isDeprecated deprecationReason}inputFields{...InputValue}interfaces{...TypeRef}enumValues(includeDeprecated:true){name description isDeprecated deprecationReason}possibleTypes{...TypeRef}}fragment InputValue on __InputValue{name description type{...TypeRef}defaultValue}fragment TypeRef on __Type{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name}}}}}}}}Tools
Challenges
Root-Me
Portswigger
- Performing CSRF exploits over GraphQL | Web Security Academy
- Bypassing GraphQL brute force protections | Web Security Academy
- Finding a hidden GraphQL endpoint | Web Security Academy
- Accidental exposure of private GraphQL fields | Web Security Academy
- Accessing private GraphQL posts | Web Security Academy
Resources
Last updated on