domains / families / security / performing-graphql-introspection-attack

performing-graphql-introspection-attack

separate

'Performs GraphQL introspection attacks that extract the full API schema

When to use

• Testing GraphQL endpoints for exposed introspection that reveals the complete API schema
• Mapping the attack surface of a GraphQL API to identify sensitive queries, mutations, and types
• Testing for GraphQL-specific vulnerabilities including query depth abuse, batching attacks, and field-level authorization
• Assessing GraphQL implementations where introspection is disabled but schema can be reconstructed through error messages
• Evaluating defenses against resource exhaustion through deeply nested or complex GraphQL queries

When not to use

• Use without written authorization

Skill page

Source