Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
GraphQL
GraphQL APIs expose their entire schema to introspection — misconfigured instances leak every field, and the flexible query shape enables IDOR, over-fetching of sensitive fields, and batching abuse in ways REST never allows.
Severity guide
High when introspection leaks sensitive types or IDOR is proven; medium for endpoint exposure alone; batching/DoS angles score per program policy.
Where to look
entry points to test first01
Standard endpoint paths
/graphql, /graphiql, /graph, /v1/explorer, /graphql/console/, /graphql.php — probe them all, GET and POST.
02
Mobile app traffic
Proxy the mobile app — GraphQL endpoints and full queries appear in the traffic even when hidden from the website.
03
JS bundles
Frontend code ships full query strings — search for 'query {' or graphql keywords in the JS.
04
Alternate methods
GET with ?query=, multipart, WebSocket subscriptions — servers often expose more than one transport.
05
Staging/internal hosts
Dev instances run with introspection and graphiql playgrounds open.
How to hunt it
in order, start to finishFind the endpoint
Try /graphql, /graphiql, /graph, /v1/explorer, /graphql.php — and check GET ?query= form. GraphQL often lives at non-obvious paths.
Run introspection
GET /graphql?query={__schema{types{name}}} — if it lists types, dump the full schema and read it like documentation.
If introspection is blocked
Use field-suggestion errors (typo a field, some servers suggest the real one), or probe with {__typename} which is always allowed.
Hunt the real bugs
IDOR via object IDs, authorization missing on nested fields, and query batching for brute force — the schema tells you where to look.
Map the schema, then hunt it
Dump with InQL/Voyager and read it like documentation: every query/mutation is an endpoint, every type a data model. Look for admin/user context fields, file uploads, and auth mutations.
Test IDOR and over-fetching
IDs in queries → swap with another user's. Nested fields → request objects your role shouldn't see (user.password, invoice.paymentMethod). Field-level auth is where GraphQL fails.
Abuse batching where allowed
Array-of-queries JSON ([{query:...},{query:...}]) multiplies rate-limit evasion and brute-force speed — 100 login attempts in one request.
Filter & validation bypasses
when your first tries get blocked- 01Introspection blocked? Field suggestions leak names — typo 'usernme' and read the 'did you mean' response.
- 02__schema blocked? {__typename} always works; probe type-by-type with manual queries.
- 03Depth limits? Query with fragments/aliases to pack more fields per request within the limit.
- 04GET blocked? Try POST with content-type overrides (application/graphql, multipart) — transports vary.
Impact ladder
what makes it payable- 01Schema disclosure — the full API map for free.
- 02IDOR at field level — read other users' objects through normal queries.
- 03Batch brute force — thousands of credential guesses per request.
- 04Auth bypass on mutations — admin operations reachable without the role.
Payloads
6 · from PayloadsAllTheThings/graphqlThe canonical endpoint path — try it first.
/graphiqlThe interactive IDE path — exposed = full schema browsing.
/graphql/console/Alternate console path on some frameworks.
GET /graphql?query={__schema{types{name}}}Minimal introspection — lists every type in the schema.
GET /graphql?query=query%20%7B%20user(id:%221%22)%20%7B%20id%20name%20%7D%20%7DGET-based query — some servers accept queries in the URL.
[{"query":"{user(id:1){name}}"},{"query":"{user(id:2){name}}"}]JSON-array batching — N queries per request where batching is enabled.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.