web-vuln-graphql

What this skill does

Tests GraphQL APIs for security misconfigurations including introspection exposure, field-level authorization bypass, node() interface IDOR, query batching and alias-based rate limit bypass, mutation authorization gaps, nested query DoS, and directive overloading. Maps the full schema when introspection is enabled and systematically tests each finding for exploitable impact.

When to use

• When the target application exposes a /graphql or /api/graphql endpoint
• When auditing APIs for authorization bypasses (IDOR via GraphQL node IDs)
• When testing rate limit enforcement on sensitive operations (login, OTP, password reset)
• During bug bounty or penetration testing of modern web applications

Prerequisites

• curl installed
• GraphQL endpoint URL and a valid authentication token (user-level; admin token for comparison if available)

Inputs