GraphQL Field Suggestion Enumeration for Hidden Schema Mapping

Programs love to say "introspection is off." That rarely means the schema is invisible. Many GraphQL servers still whisper field names back at you when you guess wrong.

You are not looking for a CVE. You are building a map so later authz tests hit real fields.

Trigger the suggestion engine

Send a query with a near-miss field name on a known type:

{ viewer { nam } }

If the error says Did you mean "name"? you just confirmed a field. Repeat on nested selections. Keep a local wordlist of verbs the product UI uses: invoice, workspace, billing, impersonate, internal.

Some stacks suggest enum values the same way. Wrong enum literals that return "did you mean" lists are free documentation. Argument names sometimes suggest too—orgId vs organizationId typos can reveal the canonical arg before you ever open the docs.

Disable pretty clients for a minute. Raw error JSON is easier to diff in Burp than a colored IDE panel. Sort suggestion strings; duplicates across requests mean you are circling the same type.

When suggestions are muted

If suggestions are off, you still have:

Batch probing of common field names and measuring Cannot query field vs auth errors
UI bundle mining—React apps often embed operation documents with full selection sets
Mobile apps and old SPA chunks that still call deprecated fields
Public Postman collections, partner docs, and changelog entries that name operations the web UI never exposes

I keep a spreadsheet: field, parent type, first seen (suggestion / bundle / traffic), auth required. When triage asks "how did you know this field existed?" you answer in one line.

Auth errors are useful. Unauthorized on a field that "does not exist" for anonymous users sometimes means the field is real and gated. Compare anonymous vs low-priv vs admin tokens on the same typo and the same correct name.

Abuse the map, do not stop at the map

Enumeration alone is low severity. Pair it with IDOR or sensitive field reads. ssn, passwordHash, debugToken, internalNotes—once you know the name, ask for it under a low-privilege session.

Also probe mutations that the UI never shows. Suggestion engines sometimes reveal deleteTenant sitting next to deleteTenantMember. That is where privilege bugs hide. Same for subscriptions: a suggested onPaymentFailed event can leak billing metadata to the wrong subscriber.

Reporting without looking noisy

Do not dump a thousand suggestion probes into a report. Summarize the technique, list the sensitive fields you confirmed, and prove one unauthorized read or call. Mention whether introspection was disabled so the program understands residual disclosure.

If the only outcome is a prettier mental model of the API, keep it in your notes. Ship the ticket when a suggested field returns data you should not see.

One more habit: after each suggestion hit, immediately try the corrected field with a minimal selection set under the lowest privilege token you have. Do not wait until "recon week" ends. The map goes stale when engineering renames fields, and the authz proof is what pays.

Field suggestions are a recon accelerator. Use them to aim, then shoot at authorization.

Trigger the suggestion engine

Send a query with a near-miss field name on a known type:

{ viewer { nam } }