Logs Don't Lie: How a GraphQL Debug Endpoint Spilled the Entire Database 🗄️

Logs Don’t Lie: How a GraphQL Debug Endpoint Spilled the Entire Database 🗄️ | by Iski

August 12, 2025

🕵️‍♂️ Step 1 — Mass Recon & Weird GraphQL Subdomain. I was running my usual recon workflow: subfinder -d target.com -silent | httpx -silent -mc 200.