W-GRAPHQL-INTRODiscovery

GraphQL Introspection

__schema query reveals every type, field, mutation — even in production where it should be disabled.

§ Where this technique fits

W-GRAPHQL-INTRO is catalogued under the Discovery tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 2 on average.

§ Dossiers chaining this technique

GraphQL introspection → BOLA → mass enum
GraphQL endpoint exposes its full schema. Discover an unauth'd or under-authorized resolver, enumerate every user's data by iterating IDs.
step 2 / 6

§ What commonly comes next

01
GraphQL Field-Level AuthZ Gaps
W-GRAPHQL-AUTHZ · Discovery
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

GraphQL introspection → BOLA → mass enum

§ What commonly comes next