Lab: Finding a hidden GraphQL endpoint
Summary: A PortSwigger lab exercise shows how to find a hidden GraphQL endpoint by sending requests to common suffixes, where a GET to /api returned a "Query not present" error and a universal query confirmed the endpoint. The lab then bypasses introspection defenses by inserting a newline after __schema so the query no longer matches the server's "__schema{" regex, and uses the exposed schema to run a deleteOrganizationUser mutation with user ID 3 to delete carlos.
What you should know: The introspection block here was a single regex, and one newline defeated it - exposing the full schema and a mutation that deletes a user by ID.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026