GraphQL

GraphQL: GraphQL IDE Monorepo.

GraphQLmap: A scripting engine to interact with a graphql endpoint for pentesting purposes.

InQL + burpsuite: InQL can be used as a stand-alone script, or as a Burp Suite extension (available for both Professional and Community editions).

Configuration Burpsuite

Add Bearer- token

Use the context menu to send it to the Repeater (inql: Sent to graphiQL)

References

Hacking GraphQL for Fun and Profit — Part 1 — Understanding GraphQL BasicsMedium

Hacking GraphQL for Fun and Profit — Part 2— Methodology and ExamplesMedium