> For the complete documentation index, see [llms.txt](https://ttp.parzival.sh/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ttp.parzival.sh/pentesting/web-applications/graphql.md).

# GraphQL

### Enumerating GraphQL

When performing reconaissance, ensure the following paths are in your wordlist:

```bash
/v1/explorer
/v1/graphiql
/graph
/graphql
/graphql/console/
/graphql.php
/graphiql
/graphiql.php
```

After identifying a GraphQL endpointl, the next step is to submit an introspection query to discover what queries it supports:

```graphql
{__schema{queryType{name}mutationType{name}subscriptionType{name}types{...FullType}directives{name description locations args{...InputValue}}}}fragment FullType on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValue}type{...TypeRef}isDeprecated deprecationReason}inputFields{...InputValue}interfaces{...TypeRef}enumValues(includeDeprecated:true){name description isDeprecated deprecationReason}possibleTypes{...TypeRef}}fragment InputValue on __InputValue{name description type{...TypeRef}defaultValue}fragment TypeRef on __Type{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name ofType{kind name}}}}}}}}
```

This query can be submitted in a `POST` request using Burp Suite, the following screenshot demonstrates:

<figure><img src="/files/fd3WiGwPyNXduufDpeOX" alt=""><figcaption><p><a href="https://blog.yeswehack.com/yeswerhackers/how-exploit-graphql-endpoint-bug-bounty/">https://blog.yeswehack.com/yeswerhackers/how-exploit-graphql-endpoint-bug-bounty/</a></p></figcaption></figure>

If Introspection is disabled, then you will need to manually test for valid querie. The following tools can be leveraged as well as Burp Suite's Intruder:

{% embed url="<https://github.com/nikitastupin/clairvoyance>" %}

{% embed url="<https://github.com/swisskyrepo/GraphQLmap>" %}

### Resources

{% embed url="<https://blog.yeswehack.com/yeswerhackers/how-exploit-graphql-endpoint-bug-bounty/>" %}

{% embed url="<https://infosecwriteups.com/hacking-graphql-for-fun-and-profit-part-1-understanding-graphql-basics-72bb3dd22efa>" %}

### Practice

{% embed url="<https://github.com/righettod/poc-graphql>" %}

{% embed url="<https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application>" %}