Working with GraphQL in Burp Suite - Port Swigger
Summary: PortSwigger describes how Burp Suite detects GraphQL requests and adds a GraphQL tab to the message editor, separating the query from the rest of the request and displaying the query and its variables in separate panels. Burp can generate introspection queries to return a GraphQL API's schema, and discovered queries can be saved to the site map and sent to Intruder or Repeater for testing.
Why it matters: GraphQL services are commonly used for authentication and data retrieval, so an attacker who can send malicious requests may reach vulnerable information or higher-severity exploits such as cross-site request forgery. If introspection is enabled, the server returns the full schema, handing an attacker the map of every query and mutation the API supports.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026