API › Module 8 › Lesson 2
Introspection Risks
Introspection maps the schema — disable or restrict in production.
Visual · api_introspection
Introspection is powerful documentation — and a map for attackers. Original Cyberlium.
Opening
If anyone can ask __schema, they can inventory your graph.
Introspection helps developers. In production, restrict it. On YOUR lab, run an introspection query to see why defenders care — then write the disable/restrict policy.
1. What introspection returns
Types, fields, arguments — a blueprint.
Useful in staging with auth; dangerous wide open in prod.
Command guide
Try these commands — What introspection returns
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
GraphQL introspection — https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html gitleaks — https://github.com/gitleaks/gitleaks (scan YOUR demo repo only)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl brew install gitleaks # or go install
macOS:
Command — copy this
brew install gitleaks
Windows: Built-in (PowerShell: Invoke-WebRequest)
Command — copy this
choco install gitleaks
═══ LINUX / macOS ═══
Command — copy this
mkdir -p "$HOME/cyberlium-lab/t13-api/demo-repo"
curl -sS -X POST http://127.0.0.1:8817/graphql -H "Content-Type: application/json" -d '{"query":"query IntrospectionQuery { __schema { queryType { name } } }"}' | jq '.data.__schema.queryType // .errors'
gitleaks detect --source "$HOME/cyberlium-lab/t13-api/demo-repo" --no-git 2>/dev/null || grep -rEn 'AKIA[0-9A-Z]{16}|api[_-]?key\s*=' "$HOME/cyberlium-lab/t13-api" 2>/dev/null || echo 'No secrets in YOUR demo folder yet — good'Primary tools to practice this lesson: curl, grep, gitleaks. Reference sites: GraphQL introspection (https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html); gitleaks (https://github.com/gitleaks/gitleaks). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Defender controls
Disable in production, or allow only authenticated admins.
Prefer checked-in schema docs for partners.
3. Lab only
Introspect YOUR :8817. Do not treat public graphs as free CTFs.
Record policy sentence.
4. What you ship: introspection policy
Lab introspection + prod disable/restrict sentence.
5. What you record before the next lesson
Query used + policy.
6. Wrong vs right: stranger APIs vs literacy on systems you own
Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.
Wrong
Mass-introspect third-party graphs for a portfolio.
Right
Lab + policy. Next: batching/authz.
Mission: introspect lab + policy
1) Run __schema query on lab. 2) Write prod policy. 3) Confirm no stranger targets.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Should prod allow anonymous introspection?”
Knowledge Check
APPLY: Production introspection should be:
Multiple choice
Knowledge Check
APPLY: True or False: Introspection is only a client UI concern.
True or False
Knowledge Check
APPLY: __schema reveals:
Multiple choice