Package: graphql-schema-parse
graphql_schema_parse解析GraphQL文档，并提供将其转成**.gql**(前端查询可用的query字符串)，.json(requests可用的json关键字参数接收数据)，.txt(sqlmap可用的扫描文件 --to sqlamp 支持的是 sqlmap -r 单接口, --to burp 支持的是sqlmap -l 多接口扫描)GraphQLGraphQL 既是一种用于 API 的查询语言也是一个满足你数据查询的运行时，详细内容点击标题访问官网
在实际工作种，最常用的是 query(查询), mutation(更改/新增), subscription当发起一个GraphQL请求之后，通过抓包能够发现，最终和RESTFul发送请求没多大区别，它指定了JSON格式传参数，大致如下{"query":" query users {\n        users{\n                  id\n                  username\n                 }\n             \n        }\n        ","variables":{},"operationName":"users"}{"query":"mutation addUser($username: String!, $password: String!) {\n  addUser(username: $username, password: $password) {\n    id\n    username\n  }\n}\n","variables":{"username":"gql","password":"gql1"},"operationName":"addUser"}{"query":"mutation addUserInput($user: AddUserInput!) {\n  addUserInput(user: $user) {\n    id\n    username\n  }\n}\n","variables":{"user":{"username":"haha","password":"gg"}},"operationName":"addUserInput"}query: 其实就是生成的查询部分语句，前端传字段后端定义有返回variables: 使用query语句中的变量名operationName: 则是后端在实现时指定的接口名称(暂时这么理解吧)这里用的Python语言，实际_会被转换成驼峰写法GraphQL示例应用提供的GraphQL示例应用源码地址：https://gitee.com/zy7y/starlette-example源码使用克隆gitclonehttps://gitee.com/zy7y/starlette-example安装依赖pipinstall-rrequirements.txtpipinstallstrawberry-graphql[debug-server]3. 启动cdinjection_service\graphql
strawberryserverschema访问：http://127.0.0.1:8000通过url获取接口文档# 转JSONgqlparsehttp://127.0.0.1:8000目录地址# 转GQLgqlparsehttp://127.0.0.1:8000--togql目录地址# 转sqlmap(-r HTTP请求信息.txt)# 带jsongqlparsehttp://127.0.0.1:8000--headers.\examples\headers.json--tosqlmap.\examples\sqlmap（json）示例# 不带jsongqlparsehttp://127.0.0.1:8000--tosqlmap.\examples\sqlmap示例需要Token认证// 新建headers.json 如下
{
"Authorization": "Bearer token"
}gqlparsehttp://127.0.0.1:8000--headersheaders.json目录地址使用graphql-schema-parse安装pipinstallgraphql-schema-parse通过SDL获取接口文档前置条件# 在执行启动服务相同目录下执行, 得到SDLstrawberryexport-schemaschema>schema.graphql2. 通过graphql文件转换成gqlsdl文件必须是utf-8编码，不是则自行修改gqlparseexamples\schema.graphql--togql目录地址测试gql文件(查询-query)将生成的users.gql 文件内容复制到127.0.0.1:8000当中gql文件(突变-mutation)将生成的addUser.gql 文件内容复制到127.0.0.1:8000当中json文件(查询-query)将生成的users.json 文件内容赋值给data，使用requests包发送请求，代码如下fromrequestsimportposturl="http://127.0.0.1:8000/graphql"data={"query":" query users {\nusers{\nid\nusername\n}\n\n}\n","variables":{},"operationName":"users"}print(post(url,json=data).json())4. json文件(突变-mutation)将生成的addUsers.json 文件内容赋值给data，使用requests包发送请求，代码如下fromrequestsimportposturl="http://127.0.0.1:8000/graphql"data={"query":" mutation addUserInput ($user: AddUserInput!){\naddUserInput (user: $user){\nid\nusername\n}\n\n}\n","variables":{"user":{"username":"","password":""}},"operationName":"addUserInput"}print(post(url,json=data).json())5. txt文件(sqlmap -r httpinfo.txt， 可用于sqlmap sql注入扫描)addUserInput.txt文件内容POST /graphql HTTP/1.1
HOST: 127.0.0.1:8000
Authorization: Bearer token
Content-Type: application/json

{"query": " mutation addUserInput ($user: AddUserInput!){\n        addUserInput (user: $user){\n                  id\n                  username\n                 }\n             \n        }\n        ", "variables": {"user": {"username": "*", "password": "*"}}, "operationName": "addUserInput"}# 安装sqlmappipinstallsqlmap# 进行SQL注入扫描， sqlmap详细用法前往sqlmap官网学习sqlmap-raddUserInput.txt--level5--risk3扫描过程中扫描结果（获取到了我的数据库为SQLlite）6. txt文件(sqlmap -l 可用的批量扫描文件)gqlparsehttp://127.0.0.1:8000--headersexamples\headers.json--toburpdemo1# output demo1/burp.txt====================================================================================================================================POST/graphqlHTTP/1.1
HOST:127.0.0.1:8000
Authorization:Bearertoken
Content-Type:application/json{"query":" query users {\n        users{\n                  id\n                  username\n                 }\n             \n        }\n        ","variables":{},"operationName":"users"}======================================================================================================================================================================================================POST/graphqlHTTP/1.1
HOST:127.0.0.1:8000
Authorization:Bearertoken
Content-Type:application/json{"query":" mutation addUser ($username: String!,$password: String!){\n        addUser (username:$username, password:$password){\n                  id\n                  username\n                 }\n             \n        }\n        ","variables":{"username":"*","password":"*"},"operationName":"addUser"}======================================================================================================================================================================================================POST/graphqlHTTP/1.1
HOST:127.0.0.1:8000
Authorization:Bearertoken
Content-Type:application/json{"query":" mutation addUserInput ($user: AddUserInput!){\n        addUserInput (user:$user){\n                  id\n                  username\n                 }\n             \n        }\n        ","variables":{"user":{"username":"*","password":"*"}},"operationName":"addUserInput"}======================================================================================================================================================================================================POST/graphqlHTTP/1.1
HOST:127.0.0.1:8000
Authorization:Bearertoken
Content-Type:application/json{"query":" mutation delUser ($id: Int!){\n        delUser (id:$id){\n                  errmsg\n                 }\n             \n        }\n        ","variables":{"id":0},"operationName":"delUser"}==================================================================扫描结果# 扫描命令sqlmap-ldemo1\burp.txt参数详情gqlparse--helpoutput:Usage:cli.pyparse[OPTIONS]FROM_PATHTO_DIRECTORY将Graphql接口文档转成gql文件/Json文件:paramfrom_path:接口文档地址,本地JSON文件地址(.json)或者本地SDL文件(.schema),或者服务器URL填入(服务器的IP:PORT):paramto:转换之后的文件类型,可选to_json(.json)/to_gql(.gql)/to_sqlmap(.txt)/to_burp(.txt):paramheaders:from_type为url时可选项，请求头文件地址(.json):paramdepth:query语句体中可用查询字段递归深度:paramto_directory:转换之后文件，保存目录:return:

Arguments:FROM_PATH接口文档地址,本地JSON文件地址(.json)或者本地SDL文件(.graphql),或者服务器URL填入(服务器的IP:PORT)[required]TO_DIRECTORY生成文件保存目录，不存在时，自动创建[required]Options:--headersTEXTurl方式获取接口文档时，可选项传入请求头json文件地址--to[json|gql|sqlmap|burp][default:ToType.to_json]--depthINTEGERquery语句体中可用查询字段递归深度[default:1]--helpShowthismessageandexit.