graphql-and-hidden-parameters
yaklang/hack-skills
Discover hidden GraphQL fields, introspection gaps, and batching vulnerabilities to expose authorization flaws.
What is graphql-and-hidden-parameters?
This skill guides testing of GraphQL APIs for schema introspection, undocumented fields, batching abuse, and authorization gaps. Use it when exploring GraphQL endpoints or when REST documentation hints at optional or hidden parameters that may bypass security controls.
- Perform GraphQL introspection queries to enumerate schema types and fields
- Discover hidden or admin-only fields exposed in type definitions
- Test batching operations to bypass rate limits or authentication checks
- Identify undocumented parameters in frontend bundles and mobile endpoints
- Probe for IDOR vulnerabilities through object field access
- Detect authorization gaps in nested object relationships
How to install graphql-and-hidden-parameters
npx skills add https://github.com/yaklang/hack-skills --skill graphql-and-hidden-parametersHow to use graphql-and-hidden-parameters
- 1.Start with basic introspection queries (__typename and __schema) to test if schema is exposed
- 2.If introspection is blocked, use error-based discovery and field suggestions to probe for types
- 3.Extract JavaScript and mobile bundles to find references to undocumented fields and parameters
- 4.Test batching by submitting arrays of operations or multiple objects in a single request
- 5.Check for IDOR by attempting to access other users' data via id parameters
- 6.Examine nested object fields for authorization gaps weaker than parent-level checks
- 7.Document any hidden fields, parameters, or batching behaviors that affect authentication or authorization
Use cases
- Enumerate a GraphQL schema when introspection is enabled to find hidden admin fields
- Test batching multiple login or fetch operations in a single request to bypass rate limiting
- Extract route and field information from JavaScript bundles when introspection is disabled
- Discover role, org, or feature-flag parameters in mobile API requests not exposed in UI
- Probe nested object fields for weaker authorization checks than parent objects
- API security testers
- Penetration testers targeting GraphQL endpoints
- Security researchers auditing authorization controls
- Bug bounty hunters exploring undocumented API features
graphql-and-hidden-parameters FAQ
Use field suggestions and error-based discovery by probing known type names. Extract JavaScript and mobile bundles to find field references. Try known type probes like __type(name: "User").
Batching allows submitting multiple operations in one request, which can bypass per-request rate limits or authentication checks. Test whether auth is re-validated per operation or only once per batch.
Hidden parameters are fields present in admin docs or frontend code but not exposed in the public UI. Check mobile endpoints, admin documentation, and frontend source code for role, org, feature-flag, or internal filter fields.
Follow up with the api-authorization-and-bola skill to test whether those fields can be exploited for privilege escalation or unauthorized access.
Use tools like grep, strings, or dedicated bundle analyzers to search for GraphQL query patterns and field names in minified frontend code.
Full instructions (SKILL.md)
Source of truth, from yaklang/hack-skills.
name: graphql-and-hidden-parameters description: >- GraphQL and hidden parameter testing playbook. Use when exploring introspection, batching, undocumented fields, hidden parameters, schema abuse, and GraphQL authorization gaps.
SKILL: GraphQL and Hidden Parameters — Introspection, Batching, and Undocumented Fields
AI LOAD INSTRUCTION: Use this skill when GraphQL exists or when REST documentation suggests optional, deprecated, or undocumented fields. Focus on schema discovery, hidden parameter abuse, and batching as a force multiplier.
1. GRAPHQL FIRST PASS
query { __typename }
query {
__schema {
types { name }
}
}
If introspection is restricted, continue with:
- field suggestions and error-based discovery
- known type probes like
__type(name: "User") - JS and mobile bundle route extraction
2. HIGH-VALUE GRAPHQL TESTS
| Theme | Example |
|---|---|
| IDOR | user(id: "victim") |
| batching | array of login or object fetch operations |
| hidden fields | admin-only fields exposed in type definitions |
| nested authz gaps | related object fields with weaker checks |
3. HIDDEN PARAMETER DISCOVERY
Look for:
- fields present in admin docs but not public docs
additionalPropertiesor permissive schemas- frontend code using richer request bodies than visible UI controls
- mobile endpoints carrying role, org, feature-flag, or internal filter fields
4. NEXT ROUTING
- If hidden fields affect privilege: api authorization and bola
- If GraphQL batching changes auth or rate behavior: api auth and jwt abuse
- If endpoint discovery is incomplete: api recon and docs
Related skills
More from yaklang/hack-skills and the wider catalog.
hack
Entry-point router for web security testing, API security, and bug bounty work.
hash-attack-techniques
Expert hash attack techniques for length extension, MD5/SHA1 collisions, HMAC timing leaks, and birthday attacks.
heap-exploitation
Expert glibc heap exploitation: ptmalloc2 internals, tcache/fastbin attacks, and version-specific techniques.
http-host-header-attacks
Exploit HTTP Host header injection for password reset poisoning, cache poisoning, SSRF routing, and virtual host bypass.
http-parameter-pollution
Exploit HTTP Parameter Pollution to bypass WAFs, SSRF checks, and business logic by leveraging parser disagreements across request hops.
http2-specific-attacks
Exploit HTTP/2 protocol-specific vulnerabilities: h2c smuggling, pseudo-header injection, HPACK attacks, and multiplexing abuse.