GraphQL Vulnerabilities

Cross-platform resources for GraphQL Vulnerabilities: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

GraphQL Vulnerabilities

This page aggregates cross-platform resources to practice GraphQL Vulnerabilities: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/graphql

HTB machines practicing GraphQL Vulnerabilities (1)

Machine	OS	Difficulty
OverGraph	Linux	HARD

PortSwigger labs practicing GraphQL Vulnerabilities (5)

Lab	Difficulty	Topic	Official
Accessing private GraphQL posts	APPRENTICE	GraphQL	Open
Accidental exposure of private GraphQL fields	PRACTITIONER	GraphQL	Open
Bypassing GraphQL brute force protections	PRACTITIONER	GraphQL	Open
Finding a hidden GraphQL endpoint	PRACTITIONER	GraphQL	Open
Performing CSRF exploits over GraphQL	PRACTITIONER	GraphQL	Open

TryHackMe rooms practicing GraphQL Vulnerabilities (1)

Room	Difficulty	Type	Access	Official
Intro to GraphQL Hacking	EASY	Walkthrough	🔵 VIP	Open

---

← Back to the full glossary

Last updated: 2026-06-07