graphql-idor-via-introspection-leak

What problem does it solve?

This Skill helps identify and exploit object-level authorization bypass vulnerabilities in GraphQL APIs, where introspection can reveal hidden fields or mutations that allow unauthorized access to or modification of data using arbitrary IDs.

Core Features & Use Cases

• GraphQL Schema Discovery: Leverages introspection to map out available queries and mutations.
• IDOR Identification: Systematically probes resolvers for missing ownership checks on ID parameters.
• Exploitation: Demonstrates how to read or modify data across different user accounts via vulnerable resolvers.
• Use Case: An attacker can use this skill to discover and exploit a vulnerability where they can view another user's private messages by simply changing the messageId in a GraphQL query.

Quick Start

Use the graphql-idor-via-introspection-leak skill to find object-level authorization bypasses in the GraphQL API endpoint.