InQL - GraphQL Scanner

This extension is designed to assist in your GraphQL security testing efforts. It simplifies the identification of vulnerabilities within GraphQL endpoints by offering intuitive tools for schema analysis, query generation, and vulnerability detection. The main tool provided is a customizable scanner that analyzes a GraphQL endpoint or a local introspection schema file. It generates all possible queries and mutations, presenting them in an organized view for thorough analysis. Scanner results can be sent to Burp's Repeater or Intruder tools for further testing.

Features

• Scanner: The core feature for analyzing GraphQL endpoints or introspection schema files. It auto-generates queries, mutations, and subscriptions, offering customizable scan options, including query depth, indentation, and points of interest analysis for detecting vulnerabilities. It also supports circular reference detection, enhanced Burp integration, and custom headers per domain for more precise testing.
• Batch Queries: Run batch GraphQL attacks to test for rate limit bypasses and DoS vectors.
• GraphQL Tab in Burp Message Editor: Visualize and modify GraphQL payloads directly within Burp's native HTTP message editor.
• Schema Visualization: Send analyzed schemas to GraphiQL or GraphQL Voyager servers for enhanced analysis and visualization.

Scanner details

• Customizable Scans: InQL offers the flexibility to customize your scans. Adjust the depth of generated queries or the number of spaces used for indentation. You can also perform "Points of Interest" scans to detect potential vulnerabilities in the GraphQL schema.
• Points of Interest Analysis: After running a Points of Interest scan, you are presented with a rich data set covering a variety of potential vulnerabilities. You can enable or disable these categories according to your needs.
• Circular References Detection: InQL implements circular reference detection. After analyzing the schema, it displays potentially vulnerable queries in the scanner results view.
• Enhanced Interactions with Burp: InQL seamlessly integrates with Burp, enabling you to generate queries directly from any GraphQL request in Burp. You can also send auto-generated queries to other Burp tools for further analysis.
• Custom Headers: You have the ability to set custom headers per domain, with the domain list auto-populated from observed traffic.