GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps.
A testing playbook for GraphQL endpoints and hidden parameters, aimed at discovering undocumented fields, schema abuse, batching tricks, and authorization gaps. It applies when a target exposes GraphQL, or when REST documentation hints at optional, deprecated, or undocumented fields that the visible UI does not surface. The emphasis is on schema discovery, hidden parameter abuse, and using batching as a force multiplier.
The first pass runs introspection queries, for example { __typename } and a full __schema types dump, to map the API. When introspection is restricted it falls back to field suggestions and error-based discovery, known type probes such as __type(name: "User"), and extracting routes from JavaScript and mobile bundles. High-value tests are organized by theme: IDOR through direct object access like user(id: "victim"), batching arrays of login or fetch operations, admin-only fields exposed in type definitions, and nested authorization gaps where related object fields carry weaker checks than their parents.
For hidden parameter discovery, the guidance is to look for fields present in admin docs but absent from public docs, permissive schemas using additionalProperties, frontend code that sends richer request bodies than the UI exposes, and mobile endpoints carrying role, org, feature-flag, or internal filter fields. The skill is designed to route onward: if hidden fields affect privilege it points to API authorization and BOLA testing; if batching changes authentication or rate-limiting behavior it points to API auth and JWT abuse; and if endpoint coverage is incomplete it points to API recon and docs. Use it during web and API penetration testing whenever GraphQL is present or when you suspect the documented request surface understates what the backend will actually accept.
Run introspection queries such as { __typename } and a __schema query listing all type names. These map the schema so you can find fields and types to probe further.
Fall back to field suggestions and error-based discovery, probe known types with __type(name: "User"), and extract routes from JavaScript and mobile bundles.
Batching lets you send arrays of operations, such as multiple login or object-fetch operations, in one request. It acts as a force multiplier that can also change authentication or rate-limiting behavior.
Check for fields in admin docs but not public docs, permissive schemas using additionalProperties, frontend code sending richer bodies than the UI shows, and mobile endpoints carrying role, org, feature-flag, or internal filter fields.
If hidden fields affect privilege, it routes to API authorization and BOLA; if batching changes auth or rate behavior, to API auth and JWT abuse; and if endpoint discovery is incomplete, to API recon and docs.
Quick Setup:
.claude/skills/Repository
yaklang/hack-skills