forcesunseen/graphquail

Burp Suite extension that offers a toolkit for testing GraphQL endpoints.

GraphQuail

GraphQuail is a Burp Suite extension that offers a toolkit for testing GraphQL endpoints. Here are the features currently implemented:

• Detection and building of a GraphQL schema from proxy traffic (and emulation of introspection query responses)
• Ability to add GraphiQL and Voyager to your endpoint right in your browser
• Introspection emulation with support for SDL and JSON schemas
• Custom headers injection for requests made from GraphiQL
• Context menus that let you extract GraphQL queries from requests

Features Backlog

These are features we would like to implement eventually.

• Support GraphQL GET requests and form POST bodies
• Active mode for proxy schema detection (using __typename to determine the real types)
• Active mode for schema detection using error feedback, like clairvoyance
• Auto refresh option in GraphiQl and Voyager
• Send query from repeater to GraphiQL and vice-versa
• Passive and active Burp Suite findings such as recursion DoS
• Proxy query transformer log for debugging

Usage

If you don't build your own JAR, you can use an already built one from the releases section. Refer to Burp Suite documentation for installing an extension. This extension is not currently hosted on BApp Store.

GraphiQL and Voyager

Sometimes you want to be able to easily use GraphiQL or Voyager within your browser against a GraphQL endpoint. This gives you the ability to easily make requests using cookie authentication and the ability to add custom headers right within Burp Suite.

1. Enable GraphiQL and/or Voyager emulation
2. Click on the "Generate" button next to GraphiQL identifier or Voyager identifier. Alternatively set your own identifier and click "Set"
3. Visit your GraphQL endpoint in a browser with the identifier appended such as: https://example.com/graphql/imxxgd

Behind the scenes, the requests will be modified to go to the real GraphQL endpoint.

Introspection Emulation

This is handy when the GraphQL endpoint doesn't have introspection enabled. If you haven't followed the steps in the GraphiQL and Voyager section yet, do that first.

1. Enable "Introspection Emulation"
2. Set the Schema Source to either: File or Proxy
3. If it is set to File, past the JSON or SDL schema in the box below and click on "Replace Schema". Otherwise past the exact GraphQL endpoint URL and click on "Set Target URL"
4. GraphiQL and Voyager will now receive an emulated introspection response when it is visited or refreshed

At any point you can reset the schema or copy it in JSON or SDL format.

If you are interested in the implementation and a demo you can read more about this feature on our blog.

Building

Run gradle build and JAR will be generated and saved in releases/

graphquail's Issues

Does it still work?

I followed the video tutorial and it doesn't build any schema. Is this tool out of date?

error while running gradle build

                                                                                                                                                                                                                                    (base) ┌──(photon㉿kali)-[~/graphquail]

└─$ gradle build
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
openjdk version "17.0.8-ea" 2023-07-18
OpenJDK Runtime Environment (build 17.0.8-ea+6-Debian-5)
OpenJDK 64-Bit Server VM (build 17.0.8-ea+6-Debian-5, mixed mode, sharing)
Picked up _JAVA_OPTIONS: -Dawt.useSystemAAFontSettings=on -Dswing.aatext=true
Starting a Gradle Daemon (subsequent builds will be faster)

FAILURE: Build failed with an exception.

• Where:
  Build file '/home/photon/graphquail/build.gradle' line: 39

• What went wrong:
  A problem occurred evaluating root project 'GraphQuail'.

Could not set unknown property 'destinationDirectory' for task ':jar' of type org.gradle.api.tasks.bundling.Jar.

• Try:
  Run with --stacktrace option to get the stack trace. Run with --info or --debug option to get more log output. Run with --scan to get full insights.

• Get more help at https://help.gradle.org

BUILD FAILED in 3s

error complied

error add in extension

java.lang.UnsupportedClassVersionError: burp/BurpExtender has been compiled by a more recent version of the Java Runtime (class file version 62.0), this version of the Java Runtime only recognizes class file versions up to 61.0 at java.base/java.lang.ClassLoader.defineClass1(Native Method) at java.base/java.lang.ClassLoader.defineClass(ClassLoader.java:1012) at java.base/java.security.SecureClassLoader.defineClass(SecureClassLoader.java:150) at java.base/java.net.URLClassLoader.defineClass(URLClassLoader.java:524) at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:427) at java.base/java.net.URLClassLoader$1.run(URLClassLoader.java:421) at java.base/java.security.AccessController.doPrivileged(AccessController.java:712) at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:420) at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:587) at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:520) at java.base/java.lang.Class.forName0(Native Method) at java.base/java.lang.Class.forName(Class.java:467) at burp.mrb.D(Unknown Source) at burp.mrb.<init>(Unknown Source) at burp.y6z.F(Unknown Source) at burp.q0z.lambda$panelLoaded$0(Unknown Source) at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:539) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635) at java.base/java.lang.Thread.run(Thread.java:833) GraphQuail-0.1.jar: The extension could not be loaded because it requires a later version of Java. To use this extension you will need to start Burp with the required or later Java version.

java version :

└─(14:51:24)──> java --version ──(Sat,Aug20)─┘ openjdk 12.0.1 2019-04-16 OpenJDK Runtime Environment (build 12.0.1+12) OpenJDK 64-Bit Server VM (build 12.0.1+12, mixed mode, sharing)