graphql-and-hidden-parameters

Start with introspection queries like __schema and __typename to map types, then test IDOR via object IDs, batching for rate-limit bypass, and hidden admin fields in type definitions. If introspection is disabled, use field suggestions and error-based discovery.

Compare admin documentation against public docs, inspect frontend JavaScript and mobile bundles for richer request bodies, and look for permissive schemas with additionalProperties. Role, org, and feature-flag fields often appear only in internal clients.

GraphQL batching sends arrays of operations in one request, which can bypass rate limits on login attempts or multiply object fetch operations. Test whether the server enforces per-operation limits or only per-request limits.

Yes. Use field suggestion errors, known type probes like __type(name: "User"), and route extraction from JS or mobile bundles to reconstruct the schema without full introspection access.

Route to authorization and BOLA testing when hidden fields affect privilege levels, and to JWT abuse testing when batching changes authentication or rate-limiting behavior. Incomplete endpoint discovery should route back to API recon.