Write Up PortSwigger Lab : Accessing private GraphQL posts

📰 Medium · Cybersecurity

Learn to access private GraphQL posts by identifying and manipulating GraphQL queries, a crucial skill for cybersecurity professionals and developers alike.

intermediate Published 19 Jun 2026

Action Steps

Identify the GraphQL query used to fetch public posts
Analyze the query to determine how it filters out private posts
Manipulate the query to include private posts
Test the modified query to access private posts
Apply this knowledge to real-world scenarios to improve GraphQL API security

Who Needs to Know This

This skill is beneficial for cybersecurity teams and developers who work with GraphQL APIs, as it helps them identify and exploit vulnerabilities in GraphQL queries, ultimately improving the security of their applications.

Key Insight

💡 Understanding how to identify and manipulate GraphQL queries is essential for accessing private data and improving API security.

Key Takeaways

Learn to access private GraphQL posts by identifying and manipulating GraphQL queries, a crucial skill for cybersecurity professionals and developers alike.

Full Article

Title: Write Up PortSwigger Lab : Accessing private GraphQL posts

URL Source: https://medium.com/@hanahelmispaces/write-up-portswigger-lab-accessing-private-graphql-posts-93050df01a45?source=rss------cybersecurity-5

Published Time: 2026-06-19T09:58:04Z

Markdown Content:
# Write Up PortSwigger Lab : Accessing private GraphQL posts | by hana | Jun, 2026 | Medium

[Sitemap](https://medium.com/sitemap/sitemap.xml)

[Open in app](https://play.google.com/store/apps/details?id=com.medium.reader&referrer=utm_source%3DmobileNavBar&source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2F%40hanahelmispaces%2Fwrite-up-portswigger-lab-accessing-private-graphql-posts-93050df01a45&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

[](https://medium.com/?source=post_page---top_nav_layout_nav-----------------------------------------)

Get app

[Write](https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fmedium.com%2Fnew-story&source=---top_nav_layout_nav-----------------------new_post_topnav------------------)

[Search](https://medium.com/search?source=post_page---top_nav_layout_nav-----------------------------------------)

Sign up

[Sign in](https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fmedium.com%2F%40hanahelmispaces%2Fwrite-up-portswigger-lab-accessing-private-graphql-posts-93050df01a45&source=post_page---top_nav_layout_nav-----------------------global_nav------------------)

![Image 1: Unknown user](https://miro.medium.com/v2/resize:fill:32:32/1*dmbNkD5D-u45r44go_cf0g.png)

# Write Up PortSwigger Lab : Accessing private GraphQL posts

[![Image 2: hana](https://miro.medium.com/v2/da:true/resize:fill:32:32/0*BYO8nvMZibNGEMsq)](https://medium.com/@hanahelmispaces?source=post_page---byline--93050df01a45---------------------------------------)

[hana](https://medium.com/@hanahelmispaces?source=post_page---byline--93050df01a45---------------------------------------)

Follow

2 min read

·

1 hour ago

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fvote%2Fp%2F93050df01a45&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40hanahelmispaces%2Fwrite-up-portswigger-lab-accessing-private-graphql-posts-93050df01a45&user=hana&userId=f450e46f2a8b&source=---header_actions--93050df01a45---------------------clap_footer------------------)

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Frepost%2Fp%2F93050df01a45&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40hanahelmispaces%2Fwrite-up-portswigger-lab-accessing-private-graphql-posts-93050df01a45&user=hana&userId=f450e46f2a8b&source=---header_actions--93050df01a45---------------------repost_header------------------)

[](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2F_%2Fbookmark%2Fp%2F93050df01a45&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40hanahelmispaces%2Fwrite-up-portswigger-lab-accessing-private-graphql-posts-93050df01a45&source=---header_actions--93050df01a45---------------------bookmark_footer------------------)

[Listen](https://medium.com/m/signin?actionUrl=https%3A%2F%2Fmedium.com%2Fplans%3Fdimension%3Dpost_audio_button%26postId%3D93050df01a45&operation=register&redirect=https%3A%2F%2Fmedium.com%2F%40hanahelmispaces%2Fwrite-up-portswigger-lab-accessing-private-graphql-posts-93050df01a45&source=---header_actions--93050df01a45---------------------post_audio_button------------------)

Share

Press enter or click to view image in full size

![Image 3](https://miro.medium.com/v2/resize:fit:700/1*2MZfyMEfHQt6nIcaIcXwWQ.png)

GraphQL is a way for a website to get data from the server, where we can pick exactly what data we want in one request. In this lab, one blog post was hidden from public view — the post with id 3 is missing from the list that’s normally shown.

Step 1 — Identify the GraphQL Query

We ope

Read full article → ← Back to Reads

Write Up PortSwigger Lab : Accessing private GraphQL posts

Key Takeaways

Full Article

Related Videos