hodan.ai

GraphQL Security Pentesting

Automated offensive security for teams that deploy every day. Tests that understand GraphQL schemas, probe business logic, and provide developer-friendly remediation — entirely on your own infrastructure.

GraphQL Endpoint

Bearer Token(optional)

Disabled on this deployment — no run can happen here, so there is no reason to hand over a token.

Custom Headers

Introspection Disclosure

Check if schema introspection is enabled

Field Suggestion Leak

Test if typo suggestions expose schema info

Injection (SQL, NoSQL, XSS)

Test for SQL, NoSQL injection and XSS via arguments

Server-Side Request Forgery

Test URL arguments for SSRF vulnerabilities

Authentication Bypass

Test sensitive queries/mutations without auth

IDOR (Object Access)

Test for insecure direct object references

DoS Protection

Test depth limits, alias overloading, cost analysis

Query Batching Abuse

Test if unbounded query batching is allowed

Demo. This page shows the tool's interface and how it scores what it finds. Live analysis is not running for you yet.

This tool sends attack-shaped traffic at whatever target it is given, so it stays demo-only on the public site. Ask about running it on your own infrastructure.

A run sends automated attack payloads to the endpoint you name. Nothing on this deployment can start one — no request is issued from this page.

Privacy: All analysis runs locally on this server. Your endpoint URL, schema, findings, and tokens are never sent to OpenAI or any third-party service.

Schema Discovery

Introspects your GraphQL schema to map queries, mutations, types, and arguments -- building a complete attack surface model.

16+ Attack Tests

SQL/NoSQL injection, XSS, SSRF, auth bypass, IDOR, depth bombing, alias overloading, batching abuse, CORS, rate limiting, and more.

Developer Remediation

Every finding includes CWE/OWASP mapping, request/response evidence, confidence scores, and framework-specific fix guidance — no AI required.

Reconnaisance & Schema Discovery

No data leaves — all requests go only to your target endpoint

Sends a GraphQL introspection query to map all types, queries, and mutations
Fingerprints the server framework (Apollo, Hasura, graphql-yoga) from headers and error shapes
If introspection is disabled, uses field suggestion probing and behavioral inference
Introspection-enabled endpoints are flagged as GQL-INTROSPECT-001 (info disclosure)

Injection Testing (SQL, NoSQL, XSS)

Payloads go only to your target — nothing logged or stored

SQL injection — UNION SELECT, boolean blind, time-based payloads through every string argument
NoSQL injection — $gt, $ne, $regex MongoDB operators in JSON arguments
XSS reflection — script tags, event handlers, and encoded payloads; checks if reflected in response
Confidence scored by inspecting response for error signatures, data leaks, or behavior changes

Authentication & Authorization

Your token is never logged — only used as a header in test requests

Replays queries without your auth token to detect unprotected resolvers
Flags sensitive queries (user, admin, delete, payment) accessible without authentication
IDOR testing — enumerates sequential IDs (1, 2, 3…) on user-scoped queries
SSRF — injects internal IPs (169.254.169.254, 127.0.0.1) into URL-type arguments

DoS & Resource Abuse

Parallel burst requests only — no sustained attack, safe for staging environments

Depth attack — sends nested queries 10+ levels deep to test depth limiting
Alias overloading — duplicates the same expensive field with 50+ aliases in one query
Batch attack — sends 100+ queries in a single array to test batching limits
Rate limiting — 20 parallel requests burst to detect missing throttling

Report & Remediation (100% Local)

Zero AI calls — all analysis is deterministic rule-based logic on this server

Every finding assigned CWE ID, OWASP category, severity, and confidence score
Full request and response evidence attached to each finding
Framework-specific remediation (Apollo, graphql-yoga, Hasura) — no generic advice
Security grade (A–F) from weighted scoring across all test results

Attack Coverage

SQL Injection

CWE-89

NoSQL Injection

CWE-943

XSS Reflection

CWE-79

SSRF

CWE-918

Auth Bypass

CWE-306

IDOR

CWE-639

Depth DoS

CWE-400

Alias Overload

CWE-400

Batching Abuse

CWE-770

CORS Misconfig

CWE-942

Rate Limiting

CWE-770

Verbose Errors

CWE-209

Schema Leak

CWE-200

Field Suggestion

CWE-200

Sensitive Fields

CWE-200

Cost Analysis

CWE-400