# GraphQL Security Testing

> Discover GraphQL-specific vulnerabilities including introspection abuse, query depth attacks, batching exploits, and injection flaws in HTTP-based API endpoints.

- **URL:** https://hackindex.io/services/web/vulnerability-discovery/graphql-testing
- **Path:** HTTP/HTTPS > Vulnerability Discovery
- **Up:** [Vulnerability Discovery](https://hackindex.io/services/web/vulnerability-discovery.md)
- **Published:** 2026-09-14
- **Updated:** 2026-09-14

GraphQL APIs require specific testing approaches because they expose a single endpoint with a flexible query language. Standard web scanners miss most GraphQL vulnerabilities. Testing focuses on introspection availability, authorization gaps between queries and mutations, and input validation on nested queries.

## Introspection Check

Test whether the schema is exposed via introspection (most impactful finding for further testing).

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{__schema{queryType{name}}}"}'
# {"data":{"__schema":{"queryType":{"name":"Query"}}}}
```

## Authorization Testing

GraphQL often lacks field-level authorization. Test whether authenticated queries return data they should not, and whether mutations are accessible across roles.

**Test query without authentication**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{users{id,username,email,role}}"}' | python3 -m json.tool
```

**Test admin mutation with regular user token**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -H 'Authorization: Bearer <USER_TOKEN>' \
  -d '{"query": "mutation{deleteUser(id: 1){success}}"}'
```

## Depth and Complexity Limits

Test for missing query depth limits that enable denial of service through deeply nested queries.

**Nested query DoS test**

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query": "{users{posts{comments{author{posts{comments{author{username}}}}}}}}"}'
```

## Batch Query Rate Limit Bypass

Test whether the API rate-limits individual operations within a batched request.

```bash
curl -s -X POST http://$TARGET_IP:$PORT/graphql \
  -H 'Content-Type: application/json' \
  -d '[{"query":"{user(id:1){username}}"},{"query":"{user(id:2){username}}"},{"query":"{user(id:3){username}}"}]'
```

If any of these checks reveal issues, proceed to [GraphQL exploitation](https://hackindex.io/services/web/exploitation/graphql-exploitation) for detailed attack techniques.

## References

- [OWASP: GraphQL Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html) - Security testing checklist for GraphQL APIs.
- [PortSwigger: GraphQL API Vulnerabilities](https://portswigger.net/web-security/graphql) - GraphQL security testing methodology.