Overview

This project involved performing a structured security assessment against the Damn Vulnerable GraphQL Application, an intentionally insecure environment designed to expose common GraphQL misconfigurations and backend vulnerabilities. The objective was to identify, exploit, and analyze weaknesses specific to GraphQL implementations, ranging from schema exposure and authorization failures to injection and denial-of-service conditions.

GraphQL introduces a unique attack surface compared to traditional REST APIs. Instead of multiple endpoints, applications often expose a single /graphql endpoint capable of resolving complex nested queries. When improperly configured, this model can expose sensitive schema data, allow unbounded query execution, or provide attackers with a powerful interface to backend logic.

Tools Used

• Damn Vulnerable Graphql Application, for information on how to install the application check https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application
• Burp Suite was used for intercepting and manipulating GraphQL queries and HTTP requests.
• GraphQL Voyager was used for visualizing the schema structure once introspection was obtained.
• gql-finder, a custom-built open-source tool, was used for endpoint discovery and initial GraphQL surface mapping. https://github.com/kizerh/gql-finder
• graphwOOf was used to fingerprint the GraphQL engine and extract implementation details. https://github.com/dolevf/graphw00f
• sqlmap was used where backend injection opportunities were suspected.

Execution

Section 1: Reconnaissance

The first phase of the assessment focused on identifying exposed GraphQL endpoints and fingerprinting the underlying implementation. Because GraphQL applications typically expose a limited number of endpoints, accurate discovery at this stage is critical. A single overlooked endpoint can provide full schema visibility and direct access to backend logic.

1.1 Endpoint Discovery Using gql-finder

To identify potential GraphQL endpoints, I used my custom-built open-source tool, gql-finder. The tool is designed to enumerate common GraphQL paths and detect GraphQL behavior through response analysis.

The scan revealed two accessible endpoints: