graphql-audit

# GRAPHQL SECURITY AUDIT > GraphQL flips the threat model — clients drive queries. One endpoint, infinite attack surface. Introspection hands you the schema; even without it, field suggestions give you 80% back. --- ## 0. QUICK KILL CHECKLIST ``` [ ] Run graphql_audit.sh <endpoint> — full automated sweep [ ] Check if introspection is enabled (__schema query) [ ] If introspection off — run clairvoyance for field discovery [ ] Fingerprint engine (graphw00f) — different engines, different CVEs [ ] Test query batching — send 100 identical queries in one POST [ ] Test alias bombing — 1000 aliases in one query [ ] Check field suggestions on typos — leaks schema even when introspection off [ ] Try IDOR: query another user's object by ID, no auth check [ ] Test field-level auth: query privileged fields (admin, role, internalNote) [ ] Inject SQLi/NoSQLi via string arguments — id, filter, search args [ ] Check subscriptions: can you subscribe to other users' events? [ ] Try introspection bypass: __schema\nquery, query batching, fragment tricks [ ] Look for mutation rate limiting — account takeover / self-XSS via mutations ``` --- ## 1. TOOL — graphql_audit.sh ```bash # Basic audit bash tools/graphql_audit.sh https://target.com/graphql # With auth cookie bash tools/graphql_audit.sh https://target.com/api/graphql --cookie "session=abc123" # With Authorization header bash tools/graphql_audit.sh https://target.com/graphql --header "Authorization: Bearer TOKEN" # Through Burp prox...