Listen to this Post
Introduction:
GraphQL has rapidly become the go‑to query language for modern APIs, but its flexibility often comes at a cost: exposed introspection queries that leak the entire backend schema to anyone who asks. Security researchers and penetration testers now leverage tools like InQL – a Burp Suite extension and standalone CLI from Doyensec – to automatically parse GraphQL introspection data, generate attack queries, and batch‑test for vulnerabilities, turning a complex API into a mapped, exploitable surface in minutes.
Learning Objectives:
- Understand how GraphQL introspection works and why it creates a critical attack vector.
- Install and configure InQL as both a Burp Suite extension and a command‑line tool.
- Perform batch attack testing against GraphQL endpoints and visualize schemas using graphql‑voyager.
You Should Know:
1. Setting Up InQL on Burp Suite (Windows/Linux)
InQL is most powerful when integrated into Burp Suite, the industry standard for web application testing. The extension reads introspection responses from GraphQL endpoints and automatically builds a structured representation of all queries, mutations, and types.
Step‑by‑step guide:
- Download the latest InQL JAR from the official GitHub repository: https://github.com/doyensec/inql/releases.
- Open Burp Suite (Professional or Community). Go to the Extender tab → Extensions → Add.
- Select Extension Type: Java and load the downloaded JAR file.
- Once loaded, a new InQL tab appears in Burp. Target a GraphQL endpoint (e.g., `https://target.com/graphql`).
– Use Burp’s Repeater or Proxy to send a request containing the standard introspection query:query IntrospectionQuery { __schema { types { name kind description fields { name args { name type { name kind } } } } queryType { name } mutationType { name } } }– Right‑click the response in Burp → Extensions → InQL → Parse GraphQL Introspection. InQL will populate the schema tree, showing every available query and mutation – including hidden or deprecated fields.
For Linux users, ensure you have Java 11+ installed (`sudo apt install openjdk-11-jre`). Windows users can download the official JRE from Oracle. No additional dependencies are required for the Burp extension.
- Using InQL CLI for Automated GraphQL Schema Extraction
When you cannot use a GUI or need to automate testing in CI/CD pipelines, the InQL standalone CLI is indispensable. It accepts introspection JSON as input and outputs a comprehensive query list for batch attacks.
Step‑by‑step guide:
- Clone the InQL repository and build the CLI:
`git clone https://github.com/doyensec/inql.git``cd inql
</h2>./gradlew build` (Linux/macOS) or `gradlew.bat build` (Windows)
<h2 style="color: yellow;"> - Obtain the introspection JSON from your target. You can do this using
curl:
curl -X POST https://target.com/graphql \
-H "Content-Type: application/json" \
-d '{"query":"query IntrospectionQuery { __schema { types { name } } }"}' \
-o introspection.json
- Run the InQL CLI to generate attack queries:
java -jar build/libs/inql-cli.jar -f introspection.json -o output_queries.txt
- The output file contains every possible query and mutation in a format ready for Burp Intruder or custom scripts. For Windows PowerShell, use `Invoke-WebRequest` instead of
curl, but the same principle applies.
This CLI approach is ideal for scanning dozens of GraphQL endpoints in an engagement, especially when combined with parallel processing.
- Pairing InQL with graphql‑voyager for Visual Schema Exploration
Raw introspection output is dense and hard to navigate. `graphql‑voyager` turns that JSON into an interactive, graphical representation of your target’s API – showing relationships between types, arguments, and return objects. This visual map often reveals misconfigurations like exposed admin mutations or deep recursive queries that could lead to DoS.
Step‑by‑step guide:
- Install graphql‑voyager globally via npm (Node.js required):
npm install -g graphql-voyager
- Alternatively, use the Docker image:
`docker run -p 3000:80 apollographql/graphql-voyager`
- Run voyager and point it to your introspection JSON file or a live GraphQL endpoint:
graphql-voyager --endpoint https://target.com/graphql
- If the endpoint requires authentication headers, you can save the introspection response as `schema.json` and load it locally:
graphql-voyager --schema ./schema.json
- Open `http://localhost:3000` in your browser. You will see an interactive graph where you can zoom, click on fields, and spot unexpected connections – for example, a `deleteAllUsers` mutation hidden under a seemingly harmless `user` query.
Combining InQL’s structured query generation with voyager’s visual clarity slashes reconnaissance time from hours to minutes.
4. Advanced Batch Attack Testing Against GraphQL Endpoints
Once you have a list of generated queries from InQL, the next step is batch testing for common GraphQL vulnerabilities: broken authorization, excessive recursion (DoS), and field injection. InQL can also export to Burp Intruder payload positions.
Step‑by‑step guide:
- From the InQL Burp tab, click Generate Queries → select all discovered fields. InQL produces a list of complete GraphQL queries.
- Send one of them to Intruder (right‑click → Send to Intruder).
- In the Positions tab, clear default payload markers and add markers around the query body or argument values.
- Load the full list of generated queries as payloads (Paste from the InQL output window).
- Set attack type to Sniper and start the attack. Monitor response lengths, status codes, and error messages – a 200 OK for a query that should require admin privileges indicates an IDOR or broken access control.
For Linux command‑line batch testing without Burp, use `ffuf` with a custom GraphQL request template:
ffuf -u https://target.com/graphql \
-X POST \
-H "Content-Type: application/json" \
-d '{"query": "FUZZ"}' \
-w queries.txt \
-fc 400,404
This will iterate through every query from InQL and flag any unexpected successes. Windows users can achieve similar results with `Invoke-WebRequest` inside a `foreach` loop in PowerShell.
5. Mitigating GraphQL Misconfigurations (For Defenders)
Understanding how attackers use InQL is the first step to locking down your own GraphQL APIs. Defenders should assume that any public or semi‑public GraphQL endpoint will be scanned by tools like InQL within hours of deployment.
Step‑by‑step hardening guide:
- Disable introspection in production unless absolutely necessary. Most GraphQL servers allow this via configuration:
- Apollo Server: `introspection: false`
– Express‑GraphQL: `graphqlHTTP({ schema, graphiql: false, introspection: false })`
– Hasura: `HASURA_GRAPHQL_ENABLE_INTROSPECTION=false`
– Implement query depth and complexity limits. Attackers use InQL to find nested queries that cause resource exhaustion. Example using `graphql‑depth‑limit` in Node.js:
const depthLimit = require('graphql-depth-limit');
app.use('/graphql', graphqlHTTP({
schema,
validationRules: [depthLimit(5)]
}));
- Authenticate introspection requests if you must keep it enabled. Require a special header or API key to return the introspection schema; unauthenticated requests should return a generic error.
- Use a GraphQL firewall or WAF rule that detects batch introspection attempts (multiple `__schema` queries in a short time). For example, a ModSecurity rule:
SecRule ARGS|ARGS_NAMES|REQUEST_BODY "__schema" "id:1001,phase:2,deny,status:403,msg:'GraphQL Introspection Probe'"
- Regularly test your own API using the same InQL + voyager workflow. If you can map the entire attack surface in five minutes, so can an attacker.
What Undercode Say:
- Key Takeaway 1: GraphQL introspection is not a vulnerability by itself – but leaving it enabled on production endpoints turns your API schema into a free map for attackers, and InQL automates the entire reconnaissance phase.
- Key Takeaway 2: Combining automated query generation (InQL) with visual schema explorers (graphql‑voyager) dramatically lowers the skill floor for API hacking, meaning developers must adopt defense‑in‑depth strategies like depth limiting and authentication for introspection.
Analysis: The tools described here are not theoretical – they are used daily by ethical hackers and malicious actors alike. InQL’s ability to generate batch attack payloads directly from introspection responses means that even a junior tester can find high‑impact misconfigurations (e.g., exposing `__internal` mutations) that would otherwise require hours of manual probing. Defenders often underestimate how quickly an entire GraphQL attack surface can be mapped; this article shows that with two open‑source tools and a few commands, the process takes under two minutes. The real solution is not to hide your schema (security through obscurity fails) but to enforce strict authorization on every field, mutation, and subscription – because InQL will find every one of them.
Prediction:
As GraphQL adoption continues to outpace REST in modern applications, we will see a surge of automated attack tools specifically targeting introspection and batching. Within 12–18 months, every major vulnerability scanner (Nessus, Qualys, OpenVAS) will include native GraphQL introspection parsing, and bug bounty programs will treat exposed production introspection as a high‑severity finding. Simultaneously, new GraphQL security middleware will emerge – some using AI to detect anomalous query patterns – and framework defaults will shift to disabling introspection by default. Organizations that fail to adapt will face data breaches originating from a single `curl` command and a free GitHub repository.
▶️ Related Video (70% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: 0xacb Github – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
