TL;DR

  • Use a simple { __typename } query to detect GraphQL.
  • Use graphw00f to fingerprint implementations.

Quick Detection

curl -X POST http://target/graphql \
  -H 'Content-Type: application/json' \
  -d '{"query":"{ __typename }"}'

Fingerprinting with graphw00f

python3 main.py -d -f -t http://localhost:5013

Example output:

[!] Found GraphQL at http://localhost:5013/graphql
[!] Discovered GraphQL Engine: Graphene

Notes

  • Once identified, switch to the GraphQL checklist for deeper testing.