> For the complete documentation index, see [llms.txt](https://notes.programmersecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.programmersecurity.com/web-pentesting-stuff/pentesting-port-80-443/pentesting-graphql.md).

# Pentesting Graphql

## Introspection Query

We can test for introspection query if it is enabled or not by using Burpsuite Extension Called **GRAPHQL.** A Normal GraphQL Request and Response Looks like below

<figure><img src="/files/GSiqWoJky00ZwnnaHPs5" alt=""><figcaption></figcaption></figure>

now go to GRAPHQL at the top and then **Right Click > GRAPHQL > SET INTROSPECTION QUERY** and the Query will be auto Generated and we can see introspection enabled.

<figure><img src="/files/mdPkxEoKWERuyDdVYNA4" alt=""><figcaption></figcaption></figure>