GraphCrawler: GraphQL automated testing tookit
GraphCrawler
Graph Crawler is an automated testing toolkit for any GraphQL endpoint. It will run through and check if the mutation is enabled, check for any sensitive queries available, such as users and files, and it will also test any easy queries it finds to see if authentication is required.
If introspection is not enabled on the endpoint it will check if it is an Apollo Server and then can run Clairvoyance to brute force and grab the suggestions to try to build the schema ourselves. (See the Clairvoyance project for greater details on this). It will then score the findings 1-10 with 10 being the most critical.
If you want to dig deeper into the schema you can also use graphql-path-enum to look for paths to certain types, like user IDs, emails, etc.
Download
git clone https://github.com/gsmith257-cyber/GraphCrawler.git
Use
The output option is not required and by default, it will output to schema.json
TODO
- Add endpoint searching when pointed to base URL
- Add option for “full report” following the endpoint search where it will run clairvoyance and all other aspects of the toolkit on the endpoints found
- Default to “simple scan” to just find endpoints when this feature is added
- Way Future: help craft queries based on the shema provided
Copyright (c) 2022 gsmith257-cyber
