Advanced Offensive Security
GraphQL API Attacks — Concept + Live Lab
Use introspection to map the schema and pull over-exposed fields.
Open the interactive lesson & lab →
GraphQL exposes a single endpoint where clients ask for exactly the fields they want. That flexibility becomes a weakness when introspection is left enabled and field-level authorization is missing.
Attack surface
- Introspection — query __schema to dump the entire API structure, revealing hidden types and fields.
- Over-exposed fields — request sensitive fields (password, tokens) the UI never shows.
- Broken object-level auth (BOLA/IDOR) — query other users' objects by id.
- Batching / aliasing — send many operations in one request to bypass rate limits or brute-force.
- Deeply nested queries — cause denial of service via query complexity.
# Introspection — the map of the whole API
{ __schema { types { name fields } } }
# Then request whatever you discovered
{ users { username password } }