Pentestas / help

GraphQL Scanner

GraphQL Scanner — Test GraphQL endpoints for introspection, injection, and misconfiguration.
GraphQL Scanner in the Pentestas Security tools UI.

Category: API / auth

Probes a GraphQL URL for introspection exposure, batching/alias abuse signals, and common injection/misconfig patterns.

Inputs

GraphQL HTTP endpoint URL (optionally with auth header if the UI provides it).

How to run it

  1. Open Security tools → GraphQL Scanner.
  2. Enter endpoint → run.
  3. Disable introspection in production if exposed; tighten complexity limits.

Output

Findings list with evidence snippets.

Notes

  • For full API program coverage, run an API scan with schema upload.
  • /scans/api-scan/
  • /tools/jwt-analyzer/

← Back to Security tools overview