graphql api vulns

API identify

To identify if there is hidden GraphQL API endpoint send an invalid GET request endpoint and observe message Not Found, but when sending /api the response is Query not present.

Enumeration of the GraphQL API endpoint require testing with a universal query. Modify GET request with query as a URL parameter /api?query=query{__typename}.

The below response validate the identity of GraphQL endpoint:

{
  "data": {
	"__typename": "query"
  }
}

Send a new request with a URL-encoded introspection query as a query parameter.

To do this, right-click the request and select GraphQL > Set introspection query:

This introspection query works with most GraphQL servers. However, if you are working with an older GraphQL server, it may fail. If that happens, right-click anywhere within the Request panel of the message editor, then select GraphQL > Set legacy introspection query and try again.

 query IntrospectionQuery {
    __schema {
      queryType { name }
      mutationType { name }
      subscriptionType { name }
      types {
        ...FullType
      }
      directives {
        name
        description
        args {
          ...InputValue
        }
        onOperation
        onFragment
        onField
      }
    }
  }

Right-click anywhere within the Response panel of the message editor, then select GraphQL > Save GraphQL queries to site map.

Brute force login

put thos mutations inside post request inside mutations{}

CSRF for change mail grapql

change content type and convert json body to

PreviousOS Cmd InjectionNextno sql

Last updated