Package: inql
InQL ScannerA security testing tool to facilitateGraphQLtechnology security auditing efforts.InQL can be used as a stand-alone script or as aBurp Suiteextension.InQL Stand-Alone CLIRunninginqlfrom Python will issue anIntrospectionquery to the target GraphQL endpoint in order fetch metadata information for:Queries, mutations, subscriptionsIts fields and argumentsObjects and custom object typesCycles inside the graphql definitionInQL can inspect the introspection query results and generate clean documentation in different formats such as
HTML and JSON schema. InQL is also able to generate templates (with optional placeholders) for all known basic data types.For all supported options, check the command line help:usage: inql [-h] [-t TARGET] [-f SCHEMA_JSON_FILE] [-k KEY] [-p PROXY]
            [--header HEADERS HEADERS] [-d] [--no-generate-html]
            [--no-generate-schema] [--no-generate-queries] [--generate-cycles]
            [--cycles-timeout CYCLES_TIMEOUT] [--cycles-streaming]
            [--generate-tsv] [--insecure] [-o OUTPUT_DIRECTORY]

InQL Scanner

optional arguments:
  -h, --help            show this help message and exit
  -t TARGET             Remote GraphQL Endpoint (https://<Target_IP>/graphql)
  -f SCHEMA_JSON_FILE   Schema file in JSON format
  -k KEY                API Authentication Key
  -p PROXY              IP of a web proxy to go through
                        (http://127.0.0.1:8080)
  --header HEADERS HEADERS
  -d                    Replace known GraphQL arguments types with placeholder
                        values (useful for Burp Suite)
  --no-generate-html    Generate HTML Documentation
  --no-generate-schema  Generate JSON Schema Documentation
  --no-generate-queries
                        Generate Queries
  --generate-cycles     Generate Cycles Report
  --cycles-timeout CYCLES_TIMEOUT
                        Cycles Report Timeout (in seconds)
  --cycles-streaming    Some graph are too complex to generate cycles in
                        reasonable time, stream to stdout
  --generate-tsv        Generate TSV representation of query templates. It may
                        be useful to quickly search for vulnerable I/O.
  --insecure            Accept any SSL/TLS certificate
  -o OUTPUT_DIRECTORY   Output DirectoryInQL Burp Suite ExtensionSince version 1.0.0 of the tool, InQL was extended to operate within Burp Suite. In this mode, the tool will retain all the stand-alone script capabilities and add a handy user interface for manipulating queries.Using theinqlextension for Burp Suite, you can:Search for known GraphQL URL paths; the tool will grep and match known values to detect GraphQL endpoints within the target websiteSearch for exposed GraphQL development consoles (GraphiQL,GraphQL Playground, and other standard consoles)Use a custom GraphQL tab displayed on each HTTP request/response containing GraphQLLeverage the templates generation by sending those requests to Burp's Repeater tool ("Send to Repeater")Leverage the templates generation and editor support by sending those requests to embedded GraphIQL ("Send to GraphiQL")Configure the tool by using a custom settings tabTo useinqlin Burp Suite, import the Python extension:Download theJythonJarStart Burp SuiteExtender Tab > Options > Python Enviroment > Set the location of Jython standalone JARExtender Tab > Extension > Add > Extension Type > Select PythonDownload the latestinql_burp.pyreleasehereExtension File > Set the location ofinql_burp.py> NextThe output should now show the following message:InQL Scanner Started!Burp Extension UsageGetting started with theinqlBurp extension is easy:Load a GraphQL endpoint or a JSON schema file location inside the top input fieldPress the "Load" buttonAfter a few seconds, the left panel will refresh, loading the directory structure for the selected endpoint as in the following example:urlquerytimestamp 1query1.queryquery2.querytimestamp 2query1.queryquery2.querymutationsubscriptionSelecting anyquery/mutation/subscriptionwill load the corresponding template in the main text areaInQL Stand-Alone UISince version 2.0.0, InQL UI is able to operate without requiring BURP.
It is now possible to install InQL stand-alone forjythonand run the Scanner UI.In this mode, InQL maintains most of the Burp Scanner capabilities except for advanced
interactions such as "Send To Repeater" and automatic authorization header generation, available through BURP.To useinqlstand-alone UI:Download and InstallJython. Jython can be obtained on macOS through brewbrew install jythonor on Ubuntu derivates throughapt-get install -y jythonDownload inqlgit clone https://github.com/doyensec/inqlChange directory to inql withcd inqlStart the UI through jython withjython -m inqlNDR: At the current stage Jython does not support HTTP/2. Any request to an HTTP/2 server will fail silently.
We advise to use the Burp to bypass this limitation temporarily.Burp GraphQL Query TimerSince version 3.0.0, InQL has an integrated Query Timer.
This Query Timer is a reimagination ofRequest Timer, which can filter for query name and body.The Query Timer is enabled by default and especially useful in conjunction with the Cycles detector. A tester can switch between graphql-editor modes (Repeater and GraphIQL) to identifyDoS queries. Query Timer demonstrates the ability to attack such vulnerable graphql endpoints by counting the execution time of each and every query.InQL Documentation GeneratorIn either BURP or Stand-Alone mode, InQL can generate meaningful documentation for available GraphQL entities.
Results are available as HTML pages or query templates.The resulting HTML documentation page will contain details for all availableQueries,Mutations, andSubscriptionsas shown here:The following screenshot shows the use of templates generation:InQL Precise QueriesBased on InQL's introspection intermediate representation (IIR), the tool is able to generate arbitrarily nested queries with support to
any scalar type, enumerations, arrays, and objects.query{Character(id_not_in:[1334],sort:[ROLE_DESC],search:"code",id_not:1334,id:1334,id_in:[1334]){image{large}siteUrlfavouritesmodNotesdescription(asHtml:true)media(sort:[TITLE_ROMAJI],type:ANIME,perPage:1334,page:1334){edges{isMainStudio}}name{last}idisFavouriteupdatedAt}}While this enables seamless "Send to Repeater" functionality from the Scanner to the other tool components (Repeater and GraphiQL console), it is still not possible for the tool to infer placeholders forGraphQL Custom Scalars.InQL Cycles DetectorThe new introspection intermediate representation (IIR) allows to inspect for cycles in defined graphql schemas by requiring access to graphql introspection-enabled endpoint only.This functionality is especially useful and automates bothersome testing practices employing graph solving algorithm. In our test, the tool was able to find millions of cycles in a matter of minutes.CreditsAuthor and Maintainer:Andrea Brancaleoni (@nJoyneer-thypon)This project was made with love inDoyensec Research island.