Skip to content
BackEsc
Sign in

GraphQL Injection · passage 9 of 19

Queries

Text · GraphQL Injection/README.md

For testing systems you own or are authorised to test, and for defending them. Nothing here is run by this page.

Open this passage on GitHub

GraphQL queries are used to request specific fields from a schema, and the structure of your query directly mirrors the JSON response you will receive. At its simplest, querying data means selecting a root field (like `user`, `posts`, or `teams`) and then specifying which subfields you want returned. Unlike REST, you never get extra data, everything must be explicitly requested.

Source: GraphQL Injection/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.

Every one of the 19 is a mark on the map. Named now: 1 to 19, reading order first.

  1. GraphQL Injection§ 1text · README.md
  2. Common GraphQL Endpoints§ 21 code block · README.md
  3. Identify An Injection Point§ 31 code block · README.md
  4. Enumerate Database Schema via Introspection§ 45 code blocks · README.md
  5. Enumerate Database Schema via Suggestions§ 51 code block · README.md
  6. Enumerate Types Definition§ 61 code block · README.md
  7. Enumerating Paths to a Target Type§ 71 code block · README.md
  8. Methodology§ 8text · README.md
  9. Queries§ 9text · README.md
  10. Basic Query§ 102 code blocks · README.md
  11. Query with Arguments§ 111 code block · README.md
  12. Nested Queries§ 121 code block · README.md
  13. Mutations§ 131 code block · README.md
  14. GraphQL Batching Attacks§ 14text · README.md
  15. JSON List Based Batching§ 151 code block · README.md
  16. Query Name Based Batching§ 162 code blocks · README.md
  17. Injections§ 17text · README.md
  18. NOSQL Injection§ 181 code block · README.md
  19. SQL Injection§ 192 code blocks · README.md

Zoom in on the map and the dots under the middle of it are named where they are.

Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Source: PayloadsAllTheThings by Swissky and contributors, MIT License. For authorised testing only.

CyberSIXTSignal over noise
Updated AboutDevelopersSign in