~/
josangeorge
█
Cheatsheet
Attacking GraphQL
Sep 21, 2025
#
Blog
#
cheatsheet
#
GraphQL
← Back
↑ Top
>
on this page
Information Disclosure:
Identifying GraphQL Engine:
Introspection:
Obtain GraphQL Types:
Obtain Type Fields:
Obtain All Queries:
General Introspection Query:
Introspection Disabled:
Fuzzing GraphQL Types:
Fuzzing Query name:
Fuzzing Field Names:
Fuzzing Variable Names:
Automated Fuzzing Tool (clairvoyance):
DOS:
Batch Query Attack:
Deep Recursion Query Attack:
Resource Intensive Query Attack: