domains / families / security / graphql-and-hidden-parameters

graphql-and-hidden-parameters

separate

GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps.

When to use

• exploring introspection
• batching
• undocumented fields
• hidden parameters
• schema abuse
• GraphQL authorization gaps
• field suggestions and error-based discovery
• known type probes

Skill page

Source