Skip to content
BackEsc
Sign in

GraphQL Injection · passage 17 of 19

Injections

Text · GraphQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

> SQL and NoSQL Injections are still possible since GraphQL is just a layer between the client and the database.

Source: GraphQL Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 19 is a mark on the map. Named now: 1 to 19, reading order first.

  1. GraphQL Injection§ 1text · README.md
  2. Common GraphQL Endpoints§ 21 code block · README.md
  3. Identify An Injection Point§ 31 code block · README.md
  4. Enumerate Database Schema via Introspection§ 45 code blocks · README.md
  5. Enumerate Database Schema via Suggestions§ 51 code block · README.md
  6. Enumerate Types Definition§ 61 code block · README.md
  7. Enumerating Paths to a Target Type§ 71 code block · README.md
  8. Methodology§ 8text · README.md
  9. Queries§ 9text · README.md
  10. Basic Query§ 102 code blocks · README.md
  11. Query with Arguments§ 111 code block · README.md
  12. Nested Queries§ 121 code block · README.md
  13. Mutations§ 131 code block · README.md
  14. GraphQL Batching Attacks§ 14text · README.md
  15. JSON List Based Batching§ 151 code block · README.md
  16. Query Name Based Batching§ 162 code blocks · README.md
  17. Injections§ 17text · README.md
  18. NOSQL Injection§ 181 code block · README.md
  19. SQL Injection§ 192 code blocks · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in