GraphQL Injection · passage 3 of 19

Identify An Injection Point

1 code block · GraphQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

> A server MUST accept POST requests, and MAY accept other HTTP methods, such as GET. - [GraphQL Over HTTP](https://graphql.github.io/graphql-over-http/draft/#sec-Request) - GET endpoint ```js GET /graphql?query={yourQueryHere} GET /graphql?query={__schema{types{name}}} GET /graphiql?query={__schema{types{name}}} GET /graphql?query=query%20%7B%20user(id:%221%22)%20%7B%20id%20name%20%7D%20%7D ``` - POST endpoint ```js POST /graphql/v1 HTTP/1.1 Host: example.com Content-Type: application/json { "query": "query { user { id name } }" } ``` Check if errors are visible.

?query={__schema}
?query={}
?query={thisdefinitelydoesnotexist}

Every one of the 19 is a mark on the map. Named now: 1 to 19, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.