Аудит безопасности GraphQL-эндпоинтов

★ 8.1 · general

graphql-audit is a Claude Code skill that performs comprehensive security testing of GraphQL endpoints — covering introspection abuse, field enumeration via clairvoyance (works even when introspection is disabled), batching DoS, alias bombs, IDOR via aliasing, argument injection, subscription abuse, and WAF bypass techniques. The core tool is graphql_audit.sh, which orchestrates graphw00f fingerprinting, gqlmap, graphql-cop, and inql, storing results in timestamped output files including introspection.json, field_suggestions.txt, batching_dos.txt, cop_report.txt, and summary.txt. Designed for penetration testers and bug bounty hunters targeting any service that exposes a /graphql, /api/graphql, or GQL-over-HTTP endpoint.