> For the complete documentation index, see [llms.txt](https://appsecurity.gitbook.io/offensive/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://appsecurity.gitbook.io/offensive/appsec/technologies/web/graphql.md).

# GraphQL

<https://github.com/sorokinpf/graphql_sample_sender>

inql - python script and burp extension for scan qraphql: <https://blog.doyensec.com/2020/03/26/graphql-scanner.html>

GraphQL визуализация <https://apis.guru/graphql-voyager/>

GraphQL IDE: \
<https://github.com/prisma-labs/graphql-playground>\
<https://app.graphqleditor.com/>

GraphQL коннектится к MongoDB, или вроде же к любой базе?

Есть разные библиотеки для работы с GraphQL API: AWS AppSync, Apollo, ...

Для вот этих двух интроспекция работает. Достаточно сделать запрос: `{<запрос на интроспекцию из PayloadAllTheThings>}`

## BatchQL

Link: <https://github.com/assetnote/batchql>

a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements.

This tool is capable of detecting the following:

* Introspection query support
* Schema suggestions detection
* Potential CSRF detection
* Query name based batching
* Query JSON list based batching