GraphQL Introspection & Batching

Finding schemas with introspection, probes, and aliases

15 min+57 XP1 quiz

Module progress3 of 6

Opening

Ask the API to describe itself

Introspection lets clients query __schema and __type. Great for tooling—risky if left open in production because it maps every query, mutation, and sensitive field name.

1. Finding GraphQL endpoints

Common paths
/graphql, /api/graphql, /v1/graphql, /graphiql
Methods
POST JSON is typical; some stacks allow GET with query=…
Universal query probe
{__typename} often reveals a live GraphQL server even when docs are hidden.

2. Introspection query (lab)

Minimal introspectionquery { __schema { queryType { name } mutationType { name } types { name kind } } }

query {
  __schema {
    queryType { name }
    mutationType { name }
    types { name kind }
  }
}

3. Bypassing weak defenses

Some apps block the word __schema but still leak suggestions in error messages, allow GET introspection, or accept batched aliases that multiply guesses for password reset codes while staying under “one request” rate limits.

Knowledge Check

Open introspection in production mainly helps attackers:

Multiple choice

← Previous

Answer all 1 knowledge check to continue. (0/1 answered)

Guest mode — log in to track XP