~/
josangeorge
█
Cheatsheet
Attacking GraphQL
Josan
Sep 21, 2025
#
Blog
#
cheatsheet
#
GraphQL
← Back
↑ Top
>
on this page
Information Disclosure:
Identifying GraphQL Engine:
Introspection:
Obtain GraphQL Types:
Obtain Type Fields:
Obtain All Queries:
General Introspection Query:
Introspection Disabled:
Fuzzing GraphQL Types:
Fuzzing Query name:
Fuzzing Field Names:
Fuzzing Variable Names:
Automated Fuzzing Tool (clairvoyance):
DOS:
Batch Query Attack:
Deep Recursion Query Attack:
Resource Intensive Query Attack:
Field Duplication Attack:
Aliases based Attack:
GraphQL Cop:
Mutations:
What are mutations?
Batching Attacks:
Other Attacks:
CSRF:
Attack Pathway / Checklist:
Tools & Resources: