GraphQL Vulnerabilities

Cross-platform resources for GraphQL Vulnerabilities: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice GraphQL Vulnerabilities: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 7 challenges across 3 platforms — 1 HackTheBox · 5 PortSwigger · 1 TryHackMe. 1 with a Spanish writeup, 1 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. PortSwigger — Accessing private GraphQL posts (Apprentice) · 🇬🇧
2. TryHackMe — Intro to GraphQL Hacking (Easy · ~30 min) · 🇬🇧
3. PortSwigger — Accidental exposure of private GraphQL fields (Practitioner) · 🇬🇧
4. PortSwigger — Bypassing GraphQL brute force protections (Practitioner) · 🇬🇧
5. PortSwigger — Finding a hidden GraphQL endpoint (Practitioner) · 🇬🇧
6. PortSwigger — Performing CSRF exploits over GraphQL (Practitioner) · 🇬🇧

Curated resources

Source	Link
PortSwigger	https://portswigger.net/web-security/graphql

HTB machines practicing GraphQL Vulnerabilities (1)

Machine	OS	Difficulty	Writeup
OverGraph	Linux	HARD	🇪🇸 🇬🇧 📹

PortSwigger labs practicing GraphQL Vulnerabilities (5)

Lab	Difficulty	Topic	Official
Accessing private GraphQL posts	APPRENTICE	GraphQL	Open
Accidental exposure of private GraphQL fields	PRACTITIONER	GraphQL	Open
Bypassing GraphQL brute force protections	PRACTITIONER	GraphQL	Open
Finding a hidden GraphQL endpoint	PRACTITIONER	GraphQL	Open
Performing CSRF exploits over GraphQL	PRACTITIONER	GraphQL	Open

TryHackMe rooms practicing GraphQL Vulnerabilities (1)

Room	Difficulty	Type	Access	Official
Intro to GraphQL Hacking	EASY	Walkthrough	🔵 VIP	Open

---

← Back to the full glossary

Last updated: 2026-08-13