API Security

Spot GraphQL Introspection Leaks and Query-Abuse Patterns

GraphQL flattens the API surface into one endpoint, which means one mistake exposes the whole schema. The scanner probes introspection, query depth and complexity limits, field-level authorization, and aliasing / batching abuse.

Try GraphQL Scanner

How It Works

From target input to actionable findings in three straightforward steps.

01

Point at the Endpoint

Usually /graphql or /api/graphql. The scanner handles both GET and POST.

02

Introspect the Schema

Dumps every type, field, and directive the server will admit — and fails the check if introspection is open.

03

Abuse Patterns

Runs deep-nested queries, aliased batches, and field-level authorization probes to spot missing limits.

Key Capabilities

Purpose-built scanning backed by real penetration testing expertise.

Introspection Detection

Flags open introspection in production environments — the #1 GraphQL disclosure risk.

Query Depth Testing

Sends increasingly deep queries to find the depth at which the server stops responding or times out.

Alias / Batch Abuse

Tests whether aliased fields and query batching bypass rate limits or authorization.

Field-Level Auth

Attempts to access admin-only fields as an anonymous user to catch missing field guards.

Error-Message Disclosure

Inspects error responses for stack traces, internal hostnames, and schema hints.

No-Auth & Auth Modes

Works with open endpoints or authenticated targets when you paste a bearer token.

Common Use Cases

Audit a GraphQL API before production rollout
Verify introspection is disabled in prod
Catch missing query-depth limits that enable DoS
Confirm that field-level authorization is enforced
Pre-engagement recon on authorized GraphQL targets
Sanity-check a schema change did not re-open fields

Why Use Pentestas

Security tools built by penetration testers, not just developers.

Enterprise-Grade Accuracy

Our scanning engine is built on the same methodologies our penetration testers use in manual engagements, tuned to minimize false positives and surface genuine risk.

Fast, Actionable Results

Get findings in minutes rather than days. Every result includes severity ratings, technical evidence, and clear remediation steps your team can act on immediately.

Continuous Monitoring

Schedule recurring scans from the Pentestas platform to catch regressions before they reach production. Stay ahead of new CVEs and configuration drift.

Privacy First

Your scan data is encrypted at rest and in transit. You own your data, with full control over retention and export.

Detailed Reporting

Export findings as PDF, CSV, or JSON. Feed results directly into your SIEM, ticketing system, or CI/CD pipeline through our REST API.

Instant Setup

Run scans directly from your browser. Enter a target, click scan, and receive results. Ready in under a minute.

Start scanning with GraphQL Scanner today

Create a free account and run your first scan in under a minute. Full platform access during your 14-day trial.

Frequently Asked Questions

Will this crash my GraphQL server?
The scanner uses conservative query depth and batch sizes. Use the slower setting on production endpoints.
Does it cover subscriptions?
The free tool focuses on queries + mutations. Subscription-protocol testing is available in paid scans.
What about GraphQL over HTTP/2 or WebSocket?
Standard HTTP/1.1 and HTTP/2 POST are supported out of the box. WebSocket transports are part of the paid engine.