GraphQL labs
GraphQL API Attacks
What is GraphQL?
GraphQL attacks exploit the query language's own features: introspection that exposes the whole schema, alias batching for brute force, nested queries that cause DoS, and missing per-field authorization that leads to IDOR/BOLA.
Why practice GraphQL?
GraphQL keeps growing in startups and modern APIs, but its flexible model introduces flaws REST devs don't expect. Open introspection reveals hidden sensitive mutations, and batching lets you skip entire rate limits. Typical bounties: $1,000-$15,000 for an exposed admin mutation.
What will you learn with the GraphQL labs?
You'll learn to dump the full schema with an introspection query, discover hidden mutations, brute force credentials/OTP with alias batching in a single request, cause DoS with deep nesting, and find BOLA by reaching nodes by id without authorization checks.
Types of GraphQL we cover
- Introspection abuse
If __schema is on in prod, you dump every type, query and mutation — including the hidden, undocumented surface.
- Alias batching
You repeat the same operation with multiple aliases in one query (login1, login2...) to brute force while skipping the rate limit.
- Deeply nested query (DoS)
Circular nested relations (posts→author→posts→...) that blow up the resolution cost and take down the service.
- Per-field BOLA
node(id:...) or queries that take an id without verifying ownership: you reach other users' objects just like an IDOR.
How do you find and exploit GraphQL?
A practical playbook — from recon to proof of concept.
- 1
Locate the endpoint and try introspection
The endpoint is usually /graphql or /api/graphql. Fire the introspection query to dump the full types, queries and mutations.
POST /graphql {"query":"{__schema{types{name fields{name}}}}"} - 2
Map sensitive mutations
From the schema, look for state-changing mutations: updateUser, deleteAccount, createInvite, setRole. There are often admin functions not exposed in the UI.
mutation{updateUser(id:2,role:"admin"){id role}} - 3
Brute force with alias batching
Pack dozens of login/OTP attempts into a single request using aliases; per-request rate limiting doesn't stop you.
{a:login(u:"x",p:"1111"){t} b:login(u:"x",p:"1112"){t} c:login(...)...} - 4
Look for BOLA by id
Pass other people's ids to queries that take a node/object. Without per-field authorization, you read other users' data.
{user(id:1002){email phone address}} - 5
Cause DoS via nesting
If there's no depth/cost limit, chain circular relations to exhaust the server's resources.
{posts{author{posts{author{posts{title}}}}}}
Learn the theory
Academy: GraphQL APIs
Loading labs...
View in full catalog →Frequently asked questions
What is a GraphQL attack?
It's the exploitation of GraphQL's own features: introspection that exposes the whole schema, alias batching for brute force, deep nesting that causes DoS, and missing per-field authorization that leads to access to other people's data (BOLA).
How is a GraphQL API exploited?
You dump the schema with the introspection query to discover sensitive mutations, brute force by packing many attempts with aliases into one request, reach other people's objects by passing their id, and take down the service with deep circular queries.
How do you find GraphQL flaws in bug bounty?
Detect the endpoint (/graphql), fire introspection and, if it responds, map the whole surface. Then test administrative mutations with normal accounts, BOLA by id, and alias batching to skip the login or OTP rate limit.
How do you prevent GraphQL attacks?
Disable introspection in production, apply field-level and object-level authorization, limit query depth and cost, restrict the number of aliases/operations per request, and apply rate limiting that counts operations, not just requests.
Difference between attacking GraphQL and a REST API?
In REST each endpoint is a fixed URL; in GraphQL there's a single endpoint and the client composes the query, which widens the surface: introspection, batching and nesting are vectors that don't exist in REST. Even so, they share classes like BOLA/IDOR and mass assignment.
Other related categories
- hunters training
- 650
- labs from real reports
- 50
- completions
- 380
- in bounties practiced
- $200,000
hunters training
labs from real reports
completions
in bounties practiced
Practice GraphQL in real labs
Every GraphQL lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.
No card · free Academy · cancel anytime