Lab: Bypassing GraphQL brute force protections
Summary: PortSwigger's lab demonstrates that a GraphQL login API with a rate limiter returning errors for too many requests from one origin can still be brute-forced by sending multiple login mutations as aliases in a single request. The lab's goal is to sign in as carlos using the authentication lab password list, with a JavaScript example provided to build the alias list and copy the request to the clipboard.
What's compelling: A rate limiter that counts requests rather than login attempts leaves the door open: one aliased GraphQL message can carry many password guesses at once, and the response marks each attempt's success with a true or false.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026