GraphQL Security Tester

GraphQL Security Tester generates sophisticated malicious GraphQL test queries for authorized security testing. Features dynamic AI status monitoring, automatic and manual schema introspection, optional RAG integration for enhanced security knowledge, and intelligent query formatting that converts multi-line GraphQL to single-line format for streamlined testing workflows.

Features

• Burp AI integration generates malicious query variants targeting SQL injection, authorization bypass, DoS, information disclosure, input validation, NoSQL injection, and rate limiting vulnerabilities
• Dual schema extraction via automatic introspection of GraphQL endpoints or manual schema input and parsing
• Two generation modes: bulk testing for comprehensive vulnerability coverage or targeted testing to generate malicious variants of specific queries
• Custom AI messaging for specialized security guidance and tailored vulnerability analysis
• Optional RAG service integration with configurable relevance parameters and smart caching to prevent duplicate operations
• Single-line query formatting automatically converts multi-line GraphQL queries for easy testing and integration

Usage

1. Enable Burp AI features by checking the "Use AI" checkbox in the Extensions → Installed tab
2. Extract your GraphQL schema by entering the endpoint URL and clicking "Introspect Schema", or paste schema JSON manually and click "Parse Schema"
3. For targeted testing, paste a specific GraphQL query in the "Target Query/Mutation" field; for comprehensive testing, leave it empty
4. Specify attack types in the "Test Types" field such as SQL Injection, Authorization Bypass, DoS, Information Disclosure
5. Click "Generate Malicious Queries" to create AI-powered test cases with detailed attack vector explanations
6. Optionally use the "Custom Messages" tab to send specific security testing requests directly to Burp AI for specialized guidance
7. Configure optional RAG integration in the RAG Configuration tab to enhance testing with external security knowledge