GraphQLer: The Smart, Schema-Aware GraphQL API Security Tester
GraphQLer
GraphQLer is a cutting-edge tool designed to dynamically test GraphQL APIs with a focus on awareness. It offers a range of sophisticated features that streamline the testing process and ensure robust analysis of GraphQL APIs such as being able to automatically read a schema and run tests against an API using the schema. Furthermore, GraphQLer is aware of dependencies between objects queries and mutations which is then used to perform security tests against APIs.
Key features
- Dependency awareness: Run queries and mutations based on their dependencies!
- Dynamic testing: Keep track of resources created during testing
- Error correction: Try and fix requests so that the GraphQL API accepts them
- Statistics collection: Shows your results in a nice file
- Ease of use: All you need is the endpoint and the authentication token if needed
Advanced features
There are also varaibles that can be modified with the --config flag as a TOML file (see /examples/config.toml for an example). These correspond to specific features implemented in GraphQLer, and can be tuned to your liking.
| Variable Name | Variable Description | Variable Type | Default |
|---|---|---|---|
| MAX_LEVENSHTEIN_THRESHOLD | The levenshtein distance between objects and object IDs | Integer | 20 |
| MAX_OBJECT_CYCLES | Max number of times the same object should be materialized in the same query/mutation | Integer | 3 |
| MAX_OUTUPT_SELECTOR_DEPTH | Max depth the query/mutation’s output should be expanded (such as the case of infinitely recursive selectors) | Integer | 3 |
| USE_OBJECTS_BUCKET | Whether or not to store object IDs for future use | Boolean | True |
| USE_DEPENDENCY_GRAPH | Whether or not to use the dependency-aware feature | Boolean | True |
| ALLOW_DELETION_OF_OBJECTS | Whether or not to allow deletions from the objects bucket | Boolean | False |
| MAX_FUZZING_ITERATIONS | Maximum number of fuzzing payloads to run on a node | Integer | 5 |
| MAX_TIME | The maximum time to run in seconds | Integer | 3600 |
| TIME_BETWEEN_REQUESTS | Max time to wait between requests in seconds | Integer | 0.001 |
| DEBUG | Debug mode | Boolean | False |
| Custom Headers | Custom headers to be sent along with each request | Object | Accept = "application/json" |
Install & Use
Copyright (c) [2023] [GraphQLer]
