> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/graphql-attack/graphql-mutation-pentesting-web.md).
# GraphQL 变更
{% hint style="info" %}
另一方面， **GraphQL 变更** 是一种允许客户端修改 API 中数据的操作。与只允许读取数据的查询不同，变更允许客户端添加、更新或删除数据。这意味着，变更有可能被用来对 API 底层数据库执行重大更改。如果没有得到妥善保护，攻击者就可以利用变更在 API 中执行恶意修改，例如删除重要数据或创建新记录。
{% endhint %}
我们\*\*找到\*\*以下内容来创建帖子：
我们 **拦截** 使用 Burp Suite 拦截请求：
如果我们更改以下的编号 **author/\_id**，我们看到我们能够在冒充他人的情况下创建帖子：
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web-vulnerabilities/graphql-attack/graphql-mutation-pentesting-web.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.