Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint.
NEW: Can search for endpoints for you using Escape Technology’s powerful Graphinder tool. Just point it towards a domain and add the ‘-e’ option and Graphinder will do subdomain enumeration + search popular directories for GraphQL endpoints. After all this GraphCrawler will take over and work through each find. If the schema can not be introspected, you can supply it as a json file with the ‘-s’ option.
It will run through and check if mutation is enabled, check for any sensitive queries available, such as users and files, and it will also test any easy queries it find to see if authentication is required.
If introspection is not enabled on the endpoint it will check if it is an Apollo Server and then can run Clairvoyance to brute force and grab the suggestions to try to build the schema ourselves. (See the Clairvoyance project for greater details on this). It will then score the findings 1-10 with 10 being the most critical.
If you want to dig deeper into the schema you can also use graphql-path-enum to look for paths to certain types, like user IDs, emails, etc.
I hope this saves you as much time as it has for me
python graphCrawler.py -u https://test.com/graphql/api -o -a “”
██████╗ ██████╗ █████╗ ██████╗ ██╗ ██╗ ██████╗██████╗ █████╗ ██╗ ██╗██╗ ███████╗██████╗
██╔════╝ ██╔══██╗██╔══██╗██╔══██╗██║ ██║██╔════╝██╔══██╗██╔══██╗██║ ██║██║ ██╔════╝██╔══██╗
██║ ███╗██████╔╝███████║██████╔╝███████║██║ ██████╔╝███████║██║ █╗ ██║██║ █████╗ ██████╔╝
██║ ██║██╔══██╗██╔══██║██╔═══╝ ██╔══██║██║ ██╔══██╗██╔══██║██║███╗██║██║ ██╔══╝ ██╔══██╗
╚██████╔╝██║ ██║██║ ██║██║ ██║ ██║╚██████╗██║ ██║██║ ██║╚███╔███╔╝███████╗███████╗██║ ██║
╚═════╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚═╝ ╚═════╝╚═╝ ╚═╝╚═╝ ╚═╝ ╚══╝╚══╝ ╚══════╝╚══════╝╚═╝ ╚═╝
The output option is not required and by default it will output to schema.json
Wordlist from google-10000-english
phpMyAdmin is a free, open-source PHP application that provides a browser-based interface for managing MySQL and…
Zabbix is a mature open-source infrastructure monitoring platform that collects metrics from network devices, servers, virtual…
Gradle is a powerful open-source build automation tool used primarily for Java, Kotlin, Groovy, and Android…
TeamViewer is a proprietary cross-platform remote access application for remote control, desktop sharing, file transfer, and online meetings. It is one of the most widely used remote support tools in the world, available for Windows, macOS, Linux, iOS, and Android. TeamViewer is not included in the Ubuntu repositories because it is proprietary software. This guide covers how to install TeamViewer on Ubuntu 18.04 using the official .deb package. The same steps apply to Ubuntu 16.04, Debian, Linux Mint, and Elementary OS. <strong>Prerequisite:</strong> You need sudo access. Install TeamViewer on Ubuntu: Download the .deb Package Download the official TeamViewer .deb package. The _amd64.deb suffix indicates this package is for 64-bit x86-64 systems. For ARM-based machines, download the appropriate package from the TeamViewer Linux downloads page: bashwget https://download.teamviewer.com/download/linux/teamviewer_amd64.deb Install the package using apt. The ./ prefix tells apt this is a local file path, not a package name from the repositories:…
Nagios is one of the most widely used open-source infrastructure monitoring systems in the world. It…
Laravel is an open-source PHP web application framework built around an expressive, developer-friendly syntax. It is…