performing-graphql-depth-limit-attack

# Performing GraphQL Depth Limit Attack ## Overview GraphQL depth limit attacks exploit the recursive nature of GraphQL schemas to craft deeply nested queries that consume excessive server resources, leading to denial of service. Unlike REST APIs with fixed endpoints, GraphQL allows clients to request arbitrary data structures. When schemas contain circular relationships (e.g., User -> Posts -> Author -> Posts), attackers can create queries that recurse indefinitely, overwhelming the server's CPU, memory, database connections, and network bandwidth. ## When to Use - When conducting security assessments that involve performing graphql depth limit attack - When following incident response procedures for related security events - When performing scheduled security testing or auditing activities - When validating security controls through hands-on testing ## Prerequisites - Target GraphQL API endpoint with introspection enabled or known schema - GraphQL client tools (GraphiQL, Altair, Insomnia, or curl) - Python 3.8+ with requests library for automated testing - Burp Suite or mitmproxy for traffic analysis - Authorization to perform security testing on the target > **Legal Notice:** This skill is for authorized security testing and educational purposes only. Unauthorized use against systems you do not own or have written permission to test is illegal and may violate computer fraud laws. ## Core Attack Techniques ### 1. Recursive Depth Attack When a GraphQL schema has ...