Hacking GraphQL#

The Core Operations#

GraphQL relies on three primary operation types:

• Queries (The Readers): Equivalent to REST GET requests. Used to fetch data without modifying the server state.

  • Example: Asking for a user’s ID, email, and their last 5 login IPs.

• Mutations (The Writers): Equivalent to REST POST, PUT, or DELETE. Used to create, update, or delete data.

  • Example: Changing a password or creating a new administrative user.

• Subscriptions (The Listeners): Maintains an active connection (usually WebSockets) to push real-time updates from the server to the client.

Structural Components#

• Types: The objects available in the database (e.g., User, Product, Order).

• Resolvers: The backend functions written by developers. When you query a user’s email, the server executes the specific resolver function tied to that email field to fetch the data. This is where authorization bugs live. If the resolver checks if you are logged in, but fails to check who you are, you have an Insecure Direct Object Reference (IDOR).

• Fragments: Reusable units of a query. Attackers often abuse recursive fragments to bypass query depth limits and cause Denial of Service (DoS).

• Variables: Used to pass dynamic arguments into queries securely, preventing injection attacks if implemented correctly.

Endpoint Discovery & Fingerprinting#

GraphQL typically sits at predictable paths. In directory brute-forcing, look for:

• /graphql, /graphiql, /api/graphql, /graphql.php

To confirm the endpoint, send a universal query:

1
query{__typename}

If the server returns {"data": {"__typename": "Query"}}, you have a live target.

Introspection: The Keys to the Castle#

GraphQL has a built-in feature called Introspection. If left enabled, you can ask the API to document itself, returning every type, query, mutation, and argument it supports. The generation of introspection payload can be automated in burpsuite by going to the GraphQL tab in Repeater and then: Right click > Set introspection query.

1
query={__schema{types{name,fields{name,args{name,description,type{name,kind,ofType{name, kind}}}}}}}

Visualizing the Schema with GraphQL Voyager:

Reading massive JSON introspection responses is a waste of time. Copy the introspection output and paste it into GraphQL Voyager. Voyager renders the entire API into an interactive, visual graph. You can physically see the relationships between a User node and a BillingDetails node, instantly highlighting high-value targets.

Bypassing Disabled Introspection#

If developers block the __schema keyword, try to bypass it:

1. Regex Bypasses: Add spaces or newlines: query{__schema \n {queryType{name}}}

2. Error-Based Reconstruction: Modern engines are overly helpful. If you query query { use }, the server replies: Did you mean "user"? Tools like InQL brute-force wordlists to map the schema purely via these error messages.

External CLI Tooling#

• InQL (v6.1+): Automates error-based schema reconstruction and generates syntactically valid attack payloads. Essential for blind targeting.

• graphw00f: Command-line fingerprinting to identify the specific GraphQL engine (e.g., Apollo, Hasura) and map it to known CVEs.

• graphql-cop: Automated scanning script for common misconfigurations like array batching, alias limits, and trace mode leaks.

Maximizing Burp Suite In-Built Features#

• Introspection Query Automation: Burp’s GraphQL parser allows you to set and send introspection queries directly from the Repeater tab. If supported, you pull the schema instantly.

• Site Map Integration: Traditional web crawlers fail at GraphQL because every request hits a single /graphql URL. Burp circumvents this by parsing operation names and saving each unique query as a distinct node in the Target Site Map. This allows you to track tested queries and run active scans on specific mutations.

• CSRF PoC Generator: If you find a state-changing mutation, right-click the request in Burp and select Engagement Tools -> Generate CSRF PoC. Burp builds an HTML page that automatically submits the mutation. Open this in an authenticated browser to prove the vulnerability.