Question

During a web application assessment, you discover a GraphQL API endpoint at /graphql. The application does not appear to expose its schema in any documentation. You want to map every available query, mutation, and type before attempting authorization bypass testing. Which technique should you use first to enumerate the full API structure?

Accepted Answer

Send an introspection query (e.g., the __schema and __type meta-fields) to the endpoint to retrieve the complete type system

Answer

Fuzz the endpoint with a wordlist of common REST paths such as /api/v1/users to discover hidden resources

Answer

Submit a batched array of aliased queries to trigger a denial-of-service and reveal error stack traces

Answer

Perform a SQL injection test against the id parameter to enumerate backend database tables