# Week 34 - GraphQL Bruteforcing

Have you ever tried to brute force a parameter with a GraphQL query? Executing one query at a time can be slow and a pain-in-the-butt, especially with a more complex ID. So, what’s the solution???

Execute a bunch of queries with one request!! This is enabled out-of-box with ApolloServer and is called GraphQL Batching.

First, minify your query to be as light as possible, only retrieving one field enabling you to determine a valid ID from an invalid one.

Second, create a ton of queries with a different value in the parameter of each (allowing you to brute force).

Third, combine all queries into the JSON POST data of the request. Then let it rip!! Most applications in the wild will let you perform anywhere from 500 to 10,000 queries/mutations WITH JUST ONE REQUEST! Meaning a brute force attack that would have taken \~1 billion attempts can be drastically reduced to 1-2 million.

This attack can allow you to bypass 2FA lockouts, brute force low-entropy IDs, guess passwords, bypass rate limits, etc. I just found out about this attack yesterday. Hit me with a like if you didn’t know this either!

![](/files/vLhqwMRD1w8ltebWk1su)

![](/files/ffXrx6a1D10RV37chevR)


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://www.webhackingtips.com/week-34-graphql-bruteforcing.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.