Skip to content
BackEsc
Sign in

GraphQL Injection · passage 2 of 19

Common GraphQL Endpoints

1 code block · GraphQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

GraphQL endpoints are often exposed at predictable paths, most commonly: - `/graphql` - `/graphiql` (interactive IDE) You should always probe for both API and developer/debug interfaces.

/v1/explorer
/v1/graphiql
/graph
/graphql
/graphql/console/
/graphql.php
/graphiql
/graphiql.php

For an extended wordlist, see [danielmiessler/SecLists/graphql.txt](https://github.com/danielmiessler/SecLists/blob/fe2aa9e7b04b98d94432320d09b5987f39a17de8/Discovery/Web-Content/graphql.txt).

Source: GraphQL Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 19 is a mark on the map. Named now: 1 to 19, reading order first.

  1. GraphQL Injection§ 1text · README.md
  2. Common GraphQL Endpoints§ 21 code block · README.md
  3. Identify An Injection Point§ 31 code block · README.md
  4. Enumerate Database Schema via Introspection§ 45 code blocks · README.md
  5. Enumerate Database Schema via Suggestions§ 51 code block · README.md
  6. Enumerate Types Definition§ 61 code block · README.md
  7. Enumerating Paths to a Target Type§ 71 code block · README.md
  8. Methodology§ 8text · README.md
  9. Queries§ 9text · README.md
  10. Basic Query§ 102 code blocks · README.md
  11. Query with Arguments§ 111 code block · README.md
  12. Nested Queries§ 121 code block · README.md
  13. Mutations§ 131 code block · README.md
  14. GraphQL Batching Attacks§ 14text · README.md
  15. JSON List Based Batching§ 151 code block · README.md
  16. Query Name Based Batching§ 162 code blocks · README.md
  17. Injections§ 17text · README.md
  18. NOSQL Injection§ 181 code block · README.md
  19. SQL Injection§ 192 code blocks · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in