enumeration

Paso 2 · Run GraphQL Introspection to Map the Schema

Objetivo: Send a GraphQL introspection query to enumerate all available types, fields, and their arguments — especially looking for any hidden or undocumented fields.

Contexto: You have confirmed the GraphQL endpoint at `/graphql`. GraphQL APIs often expose their full schema through introspection. This is a key recon step to discover all available types, queries, fields, and their arguments.

Pistas progresivas

Revela solo las que necesites. Claude lleva la cuenta de cuántas usaste para calibrar la retroalimentación.

Pista 1 — empujón direccional

GraphQL has a built-in mechanism to query its own schema. Try sending a special meta-query to the endpoint to discover all available types and fields.

Pista 2 — técnica / clase de vuln

Use a GraphQL introspection query targeting `__schema`. Focus on discovering type names, their fields, and the arguments those fields accept.

Pista 3 — casi la solución

Send this introspection query via POST to `/graphql`:
```json
{"query": "{ __schema { types { name fields { name args { name } } } } }"}
```
Look through the response for any type or field you haven't seen in the UI yet.

Tu intento

Enviar intento Revelar solución