> ## Documentation Index
> Fetch the complete documentation index at: https://rootea.es/llms.txt
> Use this file to discover all available pages before exploring further.

# GraphQL Vulnerabilities

> Cross-platform resources for GraphQL Vulnerabilities: curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

# GraphQL Vulnerabilities

This page aggregates **cross-platform resources to practice GraphQL Vulnerabilities**: retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

## Curated resources

| Source      | Link                                                                                         |
| ----------- | -------------------------------------------------------------------------------------------- |
| PortSwigger | [https://portswigger.net/web-security/graphql](https://portswigger.net/web-security/graphql) |

## HTB machines practicing GraphQL Vulnerabilities (1)

| Machine                                               | OS    | Difficulty                                       |
| ----------------------------------------------------- | ----- | ------------------------------------------------ |
| [OverGraph](/en/htb/machines/linux/dificil/overgraph) | Linux | <span className="dbadge dbadge-hard">HARD</span> |

## PortSwigger labs practicing GraphQL Vulnerabilities (5)

| Lab                                                                                                             | Difficulty                                                 | Topic   | Official                                                                                       |
| --------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------- | ---------------------------------------------------------------------------------------------- |
| [Accessing private GraphQL posts](/en/portswigger/labs/graphql/graphql-reading-private-posts)                   | <span className="dbadge dbadge-easy">APPRENTICE</span>     | GraphQL | [Open](https://portswigger.net/web-security/graphql/lab-graphql-reading-private-posts)         |
| [Accidental exposure of private GraphQL fields](/en/portswigger/labs/graphql/graphql-accidental-field-exposure) | <span className="dbadge dbadge-medium">PRACTITIONER</span> | GraphQL | [Open](https://portswigger.net/web-security/graphql/lab-graphql-accidental-field-exposure)     |
| [Bypassing GraphQL brute force protections](/en/portswigger/labs/graphql/graphql-brute-force-protection-bypass) | <span className="dbadge dbadge-medium">PRACTITIONER</span> | GraphQL | [Open](https://portswigger.net/web-security/graphql/lab-graphql-brute-force-protection-bypass) |
| [Finding a hidden GraphQL endpoint](/en/portswigger/labs/graphql/graphql-find-the-endpoint)                     | <span className="dbadge dbadge-medium">PRACTITIONER</span> | GraphQL | [Open](https://portswigger.net/web-security/graphql/lab-graphql-find-the-endpoint)             |
| [Performing CSRF exploits over GraphQL](/en/portswigger/labs/graphql/graphql-csrf-via-graphql-api)              | <span className="dbadge dbadge-medium">PRACTITIONER</span> | GraphQL | [Open](https://portswigger.net/web-security/graphql/lab-graphql-csrf-via-graphql-api)          |

## TryHackMe rooms practicing GraphQL Vulnerabilities (1)

| Room                                                                  | Difficulty                                       | Type        | Access | Official                                                 |
| --------------------------------------------------------------------- | ------------------------------------------------ | ----------- | ------ | -------------------------------------------------------- |
| [Intro to GraphQL Hacking](/en/tryhackme/rooms/introtographqlhacking) | <span className="dbadge dbadge-easy">EASY</span> | Walkthrough | 🔵 VIP | [Open](https://tryhackme.com/room/introtographqlhacking) |

***

← [Back to the full glossary](/en/glossary)

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"DefinedTerm","name":"GraphQL Vulnerabilities","termCode":"graphql","inLanguage":"en","url":"https://rootea.es/en/skills/graphql","inDefinedTermSet":{"@type":"DefinedTermSet","name":"Tactical pentesting glossary","url":"https://rootea.es/en/glossary"}}`}
</script>

<script type="application/ld+json">
  {`{"@context":"https://schema.org","@type":"ItemList","name":"HTB machines practicing GraphQL Vulnerabilities","numberOfItems":1,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://rootea.es/en/htb/machines/linux/dificil/overgraph","name":"OverGraph"}]}`}
</script>

*Last updated: 2026-06-07*