[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71H0ZCS488J1FJSY2AV7E3P":3,"skill-same:01M71H0ZCS488J1FJSY2AV7E3P":67},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":35,"linkOnly":36,"markdownContent":37,"markdownBody":38,"frontMatter":39,"refName":40,"commitSha":41,"skillDirectory":42,"forksCount":14,"repositoryHtmlUrl":43,"repositoryHomepageUrl":6,"ownerHtmlUrl":44,"ownerBlogUrl":6,"ownerDescription":45,"updatedAt":46,"install":47,"resources":60},"01M71H0ZCS488J1FJSY2AV7E3P","webapp-api-graphql-introspection",null,"Webapp Api Graphql Introspection.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-api-graphql-introspection\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[29,30,31,32,33,34],"webapp","GraphQL","introspection","webapp api graphql introspection","api","cybersecurity","2026-11-10 10:12:30",false,"---\nname: webapp-api-graphql-introspection\ndescription: \"Webapp Api Graphql Introspection.\"\ndomain: cybersecurity\n---\n\n|\n| **GraphQL Introspection** | Built-in capability to query the schema definition, exposing all types, fields, queries, mutations, and subscriptions available in the API |\n| **Query Depth Attack** | Sending deeply nested queries that cause exponential resolver execution, consuming server resources and potentially causing DoS |\n| **Alias-Based Batching** | Using GraphQL aliases to execute multiple operations in a single request, bypassing per-request rate limiting |\n| **Schema Reconstruction** | Reconstructing the GraphQL schema when introspection is disabled by analyzing error messages and field suggestions |\n| **Field-Level Authorization** | Controlling access to individual fields within a GraphQL type based on the authenticated user's role or permissions |\n| **Query Complexity Analysis** | Calculating the computational cost of a GraphQL query before execution to enforce resource limits |\n\n## Tools & Systems\n\n- **InQL (Burp Suite Extension)**: Automated GraphQL introspection, schema analysis, and attack generation with support for schema brute-forcing\n- **Clairvoyance**: Schema reconstruction tool that works even when introspection is disabled, using error-based field discovery\n- **GraphQL Voyager**: Visual schema explorer that generates interactive diagrams from introspection results\n- **Altair GraphQL Client**: Feature-rich GraphQL IDE for crafting and testing queries with authentication support\n- **graphql-cop**: GraphQL security auditor that tests for common misconfigurations including introspection, field suggestions, and query limits\n\n## Common Scenarios\n\n### Scenario: E-Commerce GraphQL API Security Assessment\n\n**Context**: An e-commerce platform migrated from REST to GraphQL. The GraphQL endpoint serves the web and mobile frontends. Introspection was left enabled during development and was not disabled for production.\n\n**Approach**:\n1. Run full introspection query against `\u002Fgraphql` endpoint - complete schema extracted with 45 types, 120 queries, and 38 mutations\n2. Identify sensitive types: `AdminUser`, `PaymentInfo`, `InternalConfig`, `AuditLog`\n3. Discover that `User` type exposes `passwordHash`, `mfaSecret`, and `lastLoginIp` fields\n4. Find admin mutations accessible to regular users: `deleteUser`, `updateRole`, `exportAllOrders`\n5. Test query depth: no limit enforced, nested query 50 levels deep executes successfully and takes 45 seconds\n6. Test alias batching: 1000 login attempts in a single request bypass rate limiting\n7. Test batch queries: array of 500 queries accepted without limit\n8. Schema reveals internal `InternalConfig` type with `databaseConnectionString` and `stripeSecretKey` fields\n\n**Pitfalls**:\n- Assuming introspection is the only way to discover the schema (error messages and field suggestions reveal information even when introspection is disabled)\n- Not testing mutations which often have weaker authorization than queries\n- Missing subscription endpoints that may expose real-time data streams without authentication\n- Not testing query complexity limits with realistic payloads that trigger expensive database operations\n- Ignoring that GraphQL over WebSocket (subscriptions) may have different authentication requirements\n\n## Output Format\n\n```\n## Finding: GraphQL Introspection Enabled with Sensitive Schema Exposure\n\n**ID**: API-GQL-001\n**Severity**: High (CVSS 7.5)\n**Affected Endpoint**: POST \u002Fgraphql\n**Tools Used**: InQL, Clairvoyance, custom Python scripts\n\n**Description**:\nThe GraphQL endpoint has introspection enabled in production, exposing\nthe complete API schema including 45 types, 120 queries, and 38 mutations.\nThe schema reveals sensitive internal types (AdminUser, PaymentInfo,\nInternalConfig) and exposes fields containing password hashes, MFA secrets,\nand database connection strings. No query depth or complexity limits are\nenforced, enabling denial-of-service through nested queries.\n\n**Schema Highlights**:\n- User.passwordHash: bcrypt hash exposed\n- User.mfaSecret: TOTP secret exposed (allows MFA bypass)\n- InternalConfig.databaseConnectionString: Production DB credentials\n- InternalConfig.stripeSecretKey: Payment processing API key\n- 12 admin mutations accessible to regular users\n\n**Impact**:\nAn attacker can extract the complete API schema, identify sensitive\nfields, access password hashes and MFA secrets for any user, retrieve\nproduction database credentials, and execute admin-only mutations.\n\n**Remediation**:\n1. Disable introspection in production: set introspection to false in the GraphQL server config\n2. Implement field-level authorization using GraphQL directives (@auth, @hasRole)\n3. Remove sensitive fields from the schema or restrict them with authorization middleware\n4. Implement query depth limiting (max 10 levels) and complexity scoring\n5. Disable field suggestions in error messages to prevent schema reconstruction\n6. Rate limit GraphQL requests per query, not just per HTTP request\n```\n","|\n| **GraphQL Introspection** | Built-in capability to query the schema definition, exposing all types, fields, queries, mutations, and subscriptions available in the API |\n| **Query Depth Attack** | Sending deeply nested queries that cause exponential resolver execution, consuming server resources and potentially causing DoS |\n| **Alias-Based Batching** | Using GraphQL aliases to execute multiple operations in a single request, bypassing per-request rate limiting |\n| **Schema Reconstruction** | Reconstructing the GraphQL schema when introspection is disabled by analyzing error messages and field suggestions |\n| **Field-Level Authorization** | Controlling access to individual fields within a GraphQL type based on the authenticated user's role or permissions |\n| **Query Complexity Analysis** | Calculating the computational cost of a GraphQL query before execution to enforce resource limits |\n\n## Tools & Systems\n\n- **InQL (Burp Suite Extension)**: Automated GraphQL introspection, schema analysis, and attack generation with support for schema brute-forcing\n- **Clairvoyance**: Schema reconstruction tool that works even when introspection is disabled, using error-based field discovery\n- **GraphQL Voyager**: Visual schema explorer that generates interactive diagrams from introspection results\n- **Altair GraphQL Client**: Feature-rich GraphQL IDE for crafting and testing queries with authentication support\n- **graphql-cop**: GraphQL security auditor that tests for common misconfigurations including introspection, field suggestions, and query limits\n\n## Common Scenarios\n\n### Scenario: E-Commerce GraphQL API Security Assessment\n\n**Context**: An e-commerce platform migrated from REST to GraphQL. The GraphQL endpoint serves the web and mobile frontends. Introspection was left enabled during development and was not disabled for production.\n\n**Approach**:\n1. Run full introspection query against `\u002Fgraphql` endpoint - complete schema extracted with 45 types, 120 queries, and 38 mutations\n2. Identify sensitive types: `AdminUser`, `PaymentInfo`, `InternalConfig`, `AuditLog`\n3. Discover that `User` type exposes `passwordHash`, `mfaSecret`, and `lastLoginIp` fields\n4. Find admin mutations accessible to regular users: `deleteUser`, `updateRole`, `exportAllOrders`\n5. Test query depth: no limit enforced, nested query 50 levels deep executes successfully and takes 45 seconds\n6. Test alias batching: 1000 login attempts in a single request bypass rate limiting\n7. Test batch queries: array of 500 queries accepted without limit\n8. Schema reveals internal `InternalConfig` type with `databaseConnectionString` and `stripeSecretKey` fields\n\n**Pitfalls**:\n- Assuming introspection is the only way to discover the schema (error messages and field suggestions reveal information even when introspection is disabled)\n- Not testing mutations which often have weaker authorization than queries\n- Missing subscription endpoints that may expose real-time data streams without authentication\n- Not testing query complexity limits with realistic payloads that trigger expensive database operations\n- Ignoring that GraphQL over WebSocket (subscriptions) may have different authentication requirements\n\n## Output Format\n\n```\n## Finding: GraphQL Introspection Enabled with Sensitive Schema Exposure\n\n**ID**: API-GQL-001\n**Severity**: High (CVSS 7.5)\n**Affected Endpoint**: POST \u002Fgraphql\n**Tools Used**: InQL, Clairvoyance, custom Python scripts\n\n**Description**:\nThe GraphQL endpoint has introspection enabled in production, exposing\nthe complete API schema including 45 types, 120 queries, and 38 mutations.\nThe schema reveals sensitive internal types (AdminUser, PaymentInfo,\nInternalConfig) and exposes fields containing password hashes, MFA secrets,\nand database connection strings. No query depth or complexity limits are\nenforced, enabling denial-of-service through nested queries.\n\n**Schema Highlights**:\n- User.passwordHash: bcrypt hash exposed\n- User.mfaSecret: TOTP secret exposed (allows MFA bypass)\n- InternalConfig.databaseConnectionString: Production DB credentials\n- InternalConfig.stripeSecretKey: Payment processing API key\n- 12 admin mutations accessible to regular users\n\n**Impact**:\nAn attacker can extract the complete API schema, identify sensitive\nfields, access password hashes and MFA secrets for any user, retrieve\nproduction database credentials, and execute admin-only mutations.\n\n**Remediation**:\n1. Disable introspection in production: set introspection to false in the GraphQL server config\n2. Implement field-level authorization using GraphQL directives (@auth, @hasRole)\n3. Remove sensitive fields from the schema or restrict them with authorization middleware\n4. Implement query depth limiting (max 10 levels) and complexity scoring\n5. Disable field suggestions in error messages to prevent schema reconstruction\n6. Rate limit GraphQL requests per query, not just per HTTP request\n```\n",{"name":5,"domain":34,"description":7},"main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Fwebapp-api-graphql-introspection","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":48,"prompt":58,"zipAvailable":59},[49,52,55],{"tool":50,"command":51},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill webapp-api-graphql-introspection",{"tool":53,"command":54},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill webapp-api-graphql-introspection",{"tool":56,"command":57},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill webapp-api-graphql-introspection","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-api-graphql-introspection\u002FSKILL.md",true,[61],{"path":62,"resourceType":63,"resourceTypeDesc":64,"sizeBytes":65,"sourceHtmlUrl":66},"index.json","REFERENCE","参考文档",528,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwebapp-api-graphql-introspection\u002Findex.json",[68,93,116,138,160,175],{"skillNo":69,"name":70,"nameZh":6,"description":71,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":35},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,34,92],"services","detect","services wmi persistence detect","wmi","persistence","de","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":35},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[100,75,101,78,102,103,104,34,105,106,107,108,109,110,80,111,112,113,114,115],"exploit","services wmi exec exploit","exec","remote","traffic","Bash","analysis","team","across","crackmapexec","native","command","lateral movement","read","lateral-movement","Impacket",{"skillNo":117,"name":118,"nameZh":6,"description":119,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":120,"categories":121,"keywords":122,"publishedAt":35},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[123,124,125,126,127,128,34,105,129,106,130,131,80,113,132,133,134,135,136,137],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper","sonnet",{"skillNo":139,"name":140,"nameZh":6,"description":141,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":142,"categories":143,"keywords":144,"publishedAt":35},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[76,145,146,147,148,149,150,81,151,34,92,152,153,154,155,156,157,158,159,80],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","privilege-escalation","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":161,"name":162,"nameZh":6,"description":163,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":164,"categories":165,"keywords":166,"publishedAt":35},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[167,168,76,169,147,149,170,81,171,151,34,92,106,33,172,173,174,159,80,82],"thread","processes thread injection detect","injection","memory","process-injection","apc-injection","thread-injection","nt-api",{"skillNo":176,"name":177,"nameZh":6,"description":178,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":179,"categories":180,"keywords":181,"publishedAt":35},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[182,76,147,183,170,81,184,185,34,92,186,187,188,189,190,191,80,82,192,193],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]