Offensive Graphql
Offensive methodology for attacking GraphQL APIs during penetration tests and bug...
Install
npx skills add SnailSploit/Claude-Red --skill offensive-graphql -g -a claude-code -y- Repository
- SnailSploit/Claude-Red10.2k
- Category
- Testing
- Updated
- 23d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Offensive methodology for attacking GraphQL APIs during penetration tests and bug bounty engagements. Covers the full attack lifecycle: endpoint discovery, introspection abuse and blind schema reconstruction when introspection is disabled, authentication and authorization bypass through Relay node IDs and nested object traversal, injection via variables and directives, query batching for brute force and OTP bypass, denial of service through depth bombs and alias amplification, WebSocket subscription hijacking, information disclosure through verbose errors and field suggestion oracles, and file upload abuse via the multipart GraphQL specification. Includes tool-specific guidance for InQL, graphql-cop, CrackQL, BatchQL, Altair, GraphQL Voyager, and clairvoyance. Trigger on: GraphQL, graphql, introspection query, batching attack, query depth, GraphQL injection, GraphQL IDOR, field suggestion, GraphQL auth bypass, GraphQL DoS, GraphQL security, graphql-cop, InQL, CrackQL, BatchQL, Relay node, alias amplification, subscription abuse, multipart upload GraphQL, schema enumeration, __schema, __type.
Offensive GraphQL
GraphQL consolidates an entire API surface behind a single endpoint, making it a high-value target during web application assessments. Unlike REST, where each route maps to a discrete resource, a GraphQL schema exposes every type, field, mutation, and subscription in one queryable structure. Attackers who obtain or reconstruct that schema gain a complete map of the application's data model before writing a single exploit. This skill walks you through each phase of a GraphQL engagement with concrete queries, tool invocations, and chaining patterns.
Quick Workflow
- Discover the endpoint -- probe common paths, inspect client-side JS bundles, check WebSocket upgrade headers.
- Fingerprint the implementation -- use graphw00f to identify the engine and tailor payloads.
- Dump or reconstruct the schema -- full introspection query; if blocked, field suggestion probing or clairvoyance.
- Map the attack surface -- feed the schema into GraphQL Voyager or InQL.
- Test authentication and authorization -- every query and mutation with no token, low-privilege, and cross-user tokens.
- Inject through resolvers -- SQL, NoSQL, and OS command payloads through arguments and variables.
- Abuse batching -- arrayed operations for brute force, OTP bypass, and rate limit evasion.
- Stress depth and complexity -- nested queries, alias fans, and circular fragments.
- Probe subscriptions -- WebSocket with expired or missing tokens, subscribe to sensitive streams.
- Exfiltrate via errors -- verbose stack traces, type mismatches, field suggestions.
- Test file upload -- multipart GraphQL specification for oversized or malicious files.
- Chain and escalate -- combine findings into multi-step attack paths with proof-of-concept queries.
1 -- Endpoint Discovery and Fingerprinting
Probe common paths with a minimal query body. A __typename response confirms a live GraphQL endpoint.
