performing-graphql-security-assessment

# Performing GraphQL Security Assessment ## When to Use - During authorized penetration tests when the target application uses a GraphQL API - When assessing single-page applications (React, Vue, Angular) that communicate via GraphQL - For evaluating mobile app backends that expose GraphQL endpoints - When testing microservice architectures with a GraphQL gateway or federation - During bug bounty programs targeting GraphQL-based APIs ## Prerequisites - **Authorization**: Written penetration testing agreement for the target - **Burp Suite Professional**: With InQL extension for GraphQL scanning - **GraphQL Voyager**: Schema visualization tool - **InQL Scanner**: Burp extension for GraphQL introspection and query generation - **Altair GraphQL Client**: Desktop GraphQL client for interactive testing - **clairvoyance**: GraphQL schema enumeration when introspection is disabled - **curl**: For manual GraphQL query submission ## Workflow ### Step 1: Discover and Fingerprint GraphQL Endpoints Locate GraphQL endpoints and confirm GraphQL is running. ```bash # Common GraphQL endpoint paths for path in graphql graphiql playground query gql api/graphql \ v1/graphql v2/graphql graphql/console; do status=$(curl -s -o /dev/null -w "%{http_code}" \ -X POST -H "Content-Type: application/json" \ -d '{"query":"{__typename}"}' \ "https://target.example.com/$path") echo "$path: $status" done # Check for GraphQL IDEs (GraphiQL, Playground) curl -s "https://target.exampl...