Methodology
Mohamed El-Fiky {Ghaziroot}
25 Aug 2026
the-bilal-rizwan.medium.com
Sign in to open
GraphQL — Common Vulnerabilities & How to Exploit Them
المصدر: Bilal Rizwan - Medium Tags: #graphql #api-security #bug-bounty #recon
ما هو GraphQL؟
- بديل لـ REST وSOAP — لغة استعلام للـ APIs
- يعمل على endpoint واحد فقط بدلاً من عدة endpoints
-
/graphql
/graphiql/graphql.php/graphql/console/api/api/graphql/graphql/api/graphql/graphql- To check if a URL is a GraphQL service, a universal query,
query{__typename}, can be sent. If the response includes{"data": {"__typename": "Query"}}, it confirms the URL hosts a GraphQL endpoint. This method relies on GraphQL’s__typenamefield, which reveals the type of the queried object.
-