GraphQL abuse

When it applies

The target exposes a GraphQL endpoint. GraphQL collapses many objects behind one URL, so authorization gaps and info leaks are common and easy to miss with URL-based testing.

Why it works

One endpoint, a self-describing schema, and per-field resolvers mean access control must be enforced at every field/resolver — it frequently isn't. Introspection hands you the entire attack surface; batching/aliases turn one request into thousands.