Hacking GraphQL using Burp Suite

GraphQL is a very commonly used API query language. The main difference between using REST APIs and GraphQL is the structure of the call. REST API calls require multiple calls to accomplish a task, whereas GraphQL makes a single call containing the entire schema structure. The GraphQL parser determines which components of the schema require lookups or changes. In this recipe, we will learn how to leverage a Burp Suite extension called GraphQL Raider to read, mutate, and attack GraphQL schemas.

Getting ready

The GraphQL Raider extension can be found in BApp Store. We will download and install the extension within our Burp Suite instance. Then, we’ll see how to use the extension against GraphQL endpoints.

How to do it...

1. Inside Burp Suite Extensions | BApp Store, select GraphQL Raider and click the Install button.

Figure 11.62 – The GraphQL Raider extension

2. We will use the free GraphQL...