Graphql Audit
GraphQL security hunting, introspection abuse, field suggestion enumeration...
Install
npx skills add awarexone/Agentic-Bug-Hunter --skill graphql-audit -g -a claude-code -y- Repository
- awarexone/Agentic-Bug-Hunter5.5k
- Category
- Security
- Updated
- 7d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
GraphQL security hunting, introspection abuse, field suggestion enumeration (clairvoyance), batching DoS, IDOR via aliasing, auth bypass, injection via arguments, subscription abuse, depth/complexity bombs, and WAF bypass. Covers graphw00f fingerprinting, GraphQLmap, graphql-cop, and inql. Use when a target exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.
GRAPHQL SECURITY AUDIT
GraphQL flips the threat model, clients drive queries. One endpoint, infinite attack surface. Introspection hands you the schema; even without it, field suggestions give you 80% back.
0. QUICK KILL CHECKLIST
[ ] Run graphql_audit.sh <endpoint>, full automated sweep
[ ] Check if introspection is enabled (__schema query)
[ ] If introspection off, run clairvoyance for field discovery
[ ] Fingerprint engine (graphw00f), different engines, different CVEs
[ ] Test query batching, send 100 identical queries in one POST
[ ] Test alias bombing, 1000 aliases in one query
[ ] Check field suggestions on typos, leaks schema even when introspection off
[ ] Try IDOR: query another user's object by ID, no auth check
[ ] Test field-level auth: query privileged fields (admin, role, internalNote)
[ ] Inject SQLi/NoSQLi via string arguments, id, filter, search args
[ ] Check subscriptions: can you subscribe to other users' events?
[ ] Try introspection bypass: __schema\nquery, query batching, fragment tricks
[ ] Look for mutation rate limiting, account takeover / self-XSS via mutations
1. TOOL, graphql_audit.sh
# Basic audit
bash bughunter/tools/graphql_audit.sh https://target.com/graphql
# With auth cookie
bash bughunter/tools/graphql_audit.sh https://target.com/api/graphql --cookie "session=abc123"
# With Authorization header
bash bughunter/tools/graphql_audit.sh https://target.com/graphql --header "Authorization: Bearer TOKEN"
# Through Burp proxy
bash bughunter/tools/graphql_audit.sh https://target.com/graphql --proxy http://127.0.0.1:8080
# Custom output directory
bash bughunter/tools/graphql_audit.sh https://target.com/graphql --output-dir ./findings/target/graphql
