hunt-graphql

1## Crown Jewel Targets
2 
3GraphQL vulnerabilities are high-value because the attack surface is both broad and deep — a single endpoint can expose entire data models, privilege escalation paths, and cross-API state confusion. Highest payouts occur in:
4 
5- **Platform APIs** (GitHub, Shopify, Stripe-tier targets) where GraphQL mutations interact with REST APIs managing the same resources
6- **Race conditions between GraphQL mutations and REST endpoints** where state synchronization is non-atomic — these hit medium-to-high severity reliably
7- **Authorization persistence bugs** where team/org/repo membership state is controlled by one API but readable/writable by another
8- **B2B SaaS platforms** where one tenant affecting another via schema traversal = critical
9- **Internal admin GraphQL endpoints** accidentally exposed to lower-privilege users
10 
11The GitHub reports demonstrate the crown jewel pattern: **privilege that should be revoked persists because two APIs disagree on ground truth**.
12 
13---
14 
15## Attack Surface Signals
16 
17**URL Patterns:**
18```
19/graphql
20/api/graphql
21/v1/graphql
22/query
23/gql
24/graph
25/api/v2/graphql
26/internal/graphql
27```
28 
29**Response Headers:**
30```
31Content-Type: application/json  (with query body)
32X-Request-Id + no REST-style path params = likely GraphQL
33```
34 
35**JavaScript Source Patterns:**
36```js
37// grep for these in JS bundles
38"query {"
39"mutation {"
40"__typename"
41"apollo"
42"ApolloClient"
43"graphql-tag"
44"gql`"
45"operationName"
46"GRAPHQL_URI"
47```
48 
49**Tech Stack Signals:**
50…