GraphQL Injection · passage 5 of 19

Enumerate Database Schema via Suggestions

1 code block · GraphQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

When you use an unknown keyword, the GraphQL backend will respond with a suggestion related to its schema.

{
  "message": "Cannot query field \"one\" on type \"Query\". Did you mean \"node\"?",
}

You can also try to bruteforce known keywords, field and type names using wordlists such as [Escape-Technologies/graphql-wordlist](https://github.com/Escape-Technologies/graphql-wordlist) when the schema of a GraphQL API is not accessible.

Every one of the 19 is a mark on the map. Named now: 1 to 19, reading order first.

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.