gsmith257-cyber / graphcrawler Goto Github PK

View Code? Open in Web Editor NEW

284.0 5.0 23.0 1.43 MB

GraphQL automated security testing toolkit

License: MIT License

Python 99.60% Dockerfile 0.40%

api automated-testing cybersecurity graphql graphql-api pentesting api-hacking graphql-security

graphcrawler's Introduction

GraphCrawler

THE GraphQL automated testing tookit

Graph Crawler is the most powerful automated testing toolkit for any GraphQL endpoint.

Version 1.2 is out!!

NEW: Can search for endpoints for you using Escape Technology's powerful Graphinder tool. Just point it towards a domain and add the '-e' option and Graphinder will do subdomain enumeration + search popular directories for GraphQL endpoints. After all this GraphCrawler will take over and work through each find. If the schema can not be introspected, you can supply it as a json file with the '-s' option.

It will run through and check if mutation is enabled, check for any sensitive queries available, such as users and files, and it will also test any easy queries it find to see if authentication is required.

If introspection is not enabled on the endpoint it will check if it is an Apollo Server and then can run Clairvoyance to brute force and grab the suggestions to try to build the schema ourselves. (See the Clairvoyance project for greater details on this). It will then score the findings 1-10 with 10 being the most critical.

If you want to dig deeper into the schema you can also use graphql-path-enum to look for paths to certain types, like user IDs, emails, etc.

I hope this saves you as much time as it has for me

Usage

As Baremetal Install

python graphCrawler.py -u https://test.com/graphql/api -o <fileName> -a "<headers>"


 ██████╗ ██████╗  █████╗ ██████╗ ██╗  ██╗ ██████╗██████╗  █████╗ ██╗    ██╗██╗     ███████╗██████╗ 
██╔════╝ ██╔══██╗██╔══██╗██╔══██╗██║  ██║██╔════╝██╔══██╗██╔══██╗██║    ██║██║     ██╔════╝██╔══██╗
██║  ███╗██████╔╝███████║██████╔╝███████║██║     ██████╔╝███████║██║ █╗ ██║██║     █████╗  ██████╔╝
██║   ██║██╔══██╗██╔══██║██╔═══╝ ██╔══██║██║     ██╔══██╗██╔══██║██║███╗██║██║     ██╔══╝  ██╔══██╗
╚██████╔╝██║  ██║██║  ██║██║     ██║  ██║╚██████╗██║  ██║██║  ██║╚███╔███╔╝███████╗███████╗██║  ██║
 ╚═════╝ ╚═╝  ╚═╝╚═╝  ╚═╝╚═╝     ╚═╝  ╚═╝ ╚═════╝╚═╝  ╚═╝╚═╝  ╚═╝ ╚══╝╚══╝ ╚══════╝╚══════╝╚═╝  ╚═╝

The output option is not required and by default it will output to schema.json 2. As Docker Note: As graphcrawler uses some options that need files as input or produce output, it is advised to keep all those file a working directory and mount it at container path /workspace. Your all output will be saved to that mounted directory

docker build -t graphcrawler:1.2 .
docker run -v /path_to_workspace:/workspace -it graphcrawler:1.2 -u https://test.com/graphql/api  -o <filename> -a "<headers>"

Example output:

Requirements

Python3
Docker
Install all Python dependencies with pip

Wordlist from google-10000-english

TODO

Add option for "full report" following the endpoint search where it will run clairvoyance and all other aspects of the toolkit on the endpoints found
Default to "simple scan" to just find endpoints when this feature is added
Way Future: help craft queries based of the shema provided

graphcrawler's People

Contributors

Stargazers

Watchers

graphcrawler's Issues

Docker

Tool looks 🔥🔥,

Can you add docker support.

Impossible to Map Introspection Disabled GQL APIs for Specific URLs (Apollo Servers Detected)

If anyone could give me a hand -- running into this issue with pretty much every GraphQL enumeration / mapping tool or library for the following URLs. I'm not sure if there is some additional variable I'm missing that I need to be including or potentially a different URL? No clue.

https://api.hypedrop.com/graphql
[Apollo | Introspection Disabled]

https://api.hypeup.com/graphql
[Apollo | Introspection Disabled]

http://api.csgoroll.com/graphql
[Apollo | Introspection Disabled]

Seriously any and all help appreciated as this has been driving me insane!

Thank you so much for an amazing repo & tool. I hope to be able to utilize it!

macOS support?

I know in the original repo, graphql-path-enum, for supporting macOS an issue still exists: https://gitlab.com/dee-see/graphql-path-enum/-/issues/3, but, have you supported it in your repo? cause when I run it, I get:

Do you want to get more paths? (y/n): y
Type of the sensative node: user
[+] Getting possible paths to user
sh: ./support/graphql-path-enum: cannot execute binary file

Dosen't work on api.site.com/graphql

Hi,
i tried 3 known with a path similar to https://api.site.com/graphql all with introspection enabeled and it says......
.[+] Downloading schema for https://api.site.com/graphql ...
.[-] Error downloading schema, is introspection enabled?
.[-] Exiting...
.[+] Done

any ideas what's going on?

Docker: Arguments not being passed

I had an issue (on mac) passing args to run the dockerfile in that they weren't being picked up by graphCrawler.py

Apparently, you need to use the exec form of ENTRYPOINT and not the shell form for args to propagate.

If I, therefore, change the ENTRYPOINT command from what it is currently to ENTRYPOINT ["python3", "/app/graphCrawler.py"] it works as expected.

Crash

[+] Mutation enabled! Name: Mutation
[+] Located mutation in schema : 312
[+] I'll leave this for you to test, scipts arent gentle with editing data
[+] Located queries location in schema : 10
[+] Located sensative query in schema : 0
[+] 1 sensative queries found
[+] products is a sensative query
[+] Checking authorization...
[+] Found easy query in schema : 0
[+] Found easy query in schema : 1
[+] Found easy query in schema : 2
[+] Found easy query in schema : 3
[+] Found easy query in schema : 4
[+] Found easy query in schema : 6
[+] Found easy query in schema : 10
[+] Found easy query in schema : 11
[+] Found easy query in schema : 14
[+] Found easy query in schema : 16
[+] Found easy query in schema : 20
[+] Found easy query in schema : 24
[+] Found easy query in schema : 37
[+] Found easy query in schema : 38
[+] Testing easy query : products
Traceback (most recent call last):
File "/root/tools/GraphCrawler/graphCrawler.py", line 469, in
main(args.url, args)
File "/root/tools/GraphCrawler/graphCrawler.py", line 373, in main
query = gql(
File "/usr/local/lib/python3.10/dist-packages/gql/gql.py", line 17, in gql
return parse(source)
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 113, in parse
return parser.parse_document()
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 241, in parse_document
definitions=self.many(TokenKind.SOF, self.parse_definition, TokenKind.EOF),
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 1149, in many
nodes = [parse_fn()]
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 300, in parse_definition
return getattr(self, f"parse_{method_name}")()
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 325, in parse_operation_definition
selection_set=self.parse_selection_set(),
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 366, in parse_selection_set
selections=self.many(
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 1149, in many
nodes = [parse_fn()]
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 374, in parse_selection
return (
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 393, in parse_field
selection_set=self.parse_selection_set()
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 366, in parse_selection_set
selections=self.many(
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 1149, in many
nodes = [parse_fn()]
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 374, in parse_selection
return (
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 381, in parse_field
name_or_alias = self.parse_name()
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 232, in parse_name
token = self.expect_token(TokenKind.NAME)
File "/usr/local/lib/python3.10/dist-packages/graphql/language/parser.py", line 1045, in expect_token
raise GraphQLSyntaxError(
graphql.error.syntax_error.GraphQLSyntaxError: Syntax Error: Expected Name, found '}'.

GraphQL request:2:31
1 |
2 | query {products{}}
| ^
3 |

Add endpoint searching when pointed to base URL

Hey @gsmith257-cyber this is not really an issue but I saw you wanted to Add endpoint searching when pointed to base URL. I really encourage you to use https://github.com/Escape-Technologies/graphinder which we created exactly for this purpose ;) We can help if needed once you plan this feature!

See the blog post too: https://blog.escape.tech/graphinder-lightweight-and-blazing-fast-graphql-endpoint-finder/