GraphQL endpoint security testing

Question

I am working with a team who is developing a mobile app for which they are using GraphQL.

So as part of performing security testing it, they only shared the graphql endpoint and nothing else.

Not even the app UI nor any credentials.

Based on my basic understanding of GraphQL I was able to get the schema and see some of the queries and their responses.

But I am unable to understand what kind of security checks can be performed on the graphql endpoint without any other details apart from the endpoint URL itself.

Just wanted to know is there something that I am missing here and is it safe to say that security testing cannot be performed without looking at the App UI and having a basic credentials.

Please help.

Thank you.

Answer 1

The fact that you can run a schema query is a first red flag, especially if this is a production environment endpoint.

Being able to run schema queries gives an attacker everything they need to explore the API, and if there are any API methods/queries/mutations that can be misused then the schema query will make it easier for them to find any potential weaknesses.

Once you can run a graphql schema query, the next step is to look for queries/methods that can be misused by an attacker, and then go from there.