Attack GraphQL APIs. Load on /graphql, /graphiql, /v1/graphql, a POST with {"query":"..."}, Apollo/Hasura/graphene stacks, or "query/mutation" language. Signals: introspection enabled, batched queries, deeply nested fields, __schema, aliases.
