repository·main·Indexed 21 days ago
https://github.com/dolevf/graphw00fA GraphQL server fingerprinting tool that identifies specific GraphQL engines (such as Apollo, Graphene, and Hasura) by sending benign and malformed queries. It features a CLI with detection and fingerprinting modes, support for custom headers, proxies, and wordlists, and integrates with the GraphQL Threat Matrix to provide security insights.
To use graphw00f, you must have python3 and the requests library installed. Follow these steps to set up and run the tool:
git clone https://github.com/dolevf/graphw00f.gitmain.py with the desired flags.git clone https://github.com/dolevf/graphw00f.gitIf you need to provide authentication (like Authorization headers) or session information (Cookies) for a specific endpoint, you must modify the conf.py file in the repository.
Note: Using the --user-agent CLI flag will override any User-Agent defined in conf.py.
# Custom Headers
HEADERS = {'User-Agent':'graphw00f'}
# Custom Cookies
COOKIES = {"PHPSESS":"DEADBEEF"}You can customize the HTTP requests sent by graphw00f using the following methods:
-H or --header flag multiple times to append headers. The format must be "Key: Value".-u or --user-agent flag to override the default User-Agent defined in the configuration.Note: Custom headers and user-agents will override the default values provided in the conf.HEADERS configuration.
python3 main.py -t http://example.com -H "X-Custom-Header: value" -u "MyCustomAgent/1.0"If you only know the base URL of the server, use both -d (detect) and -f (fingerprint) flags. graphw00f will first attempt to find the GraphQL endpoint and then proceed to fingerprint it.
python3 main.py -f -d -t http://localhost:5000If you already know the exact URL of the GraphQL endpoint, use the -f flag with the -t target flag to identify the engine.
python3 main.py -f -t https://demo.hypergraphql.org:8484/graphqlThe following options are available for the main.py entrypoint:
| Flag | Long Flag | Description |
|---|---|---|
-h | --help | show this help message and exit |
-r | --noredirect | Do not follow redirections given by 3xx responses |
-t | --target=URL | target url with the path |
-f | --fingerprint | fingerprint mode |
-d | --detect | detect mode |
-p | --proxy=PROXY | HTTP(S) proxy URL in the form http://user:pass@host:port |
-T | --timeout=TIMEOUT | Request timeout in seconds |
-o | --output-file=OUTPUT_FILE | Output results to a file (CSV) |
-l | --list | List all GraphQL technologies graphw00f is able to detect |
-u | --user-agent=USERAGENT | Custom user-agent to use |
-H | --header=HEADER | Custom headers to send (e.g. "Authorization: Bearer ...") |
-w | --wordlist=WORDLIST | Path to a list of custom GraphQL endpoints |
-v | --version | Print out the current version and exit |
Usage: main.py -d -f -t http://example.com
Options:
-h, --help show this help message and exit
-r, --noredirect Do not follow redirections given by 3xx responses
-t URL, --target=URL target url with the path
-f, --fingerprint fingerprint mode
-d, --detect detect mode
-p PROXY, --proxy=PROXY
HTTP(S) proxy URL in the form
http://user:pass@host:port
-T TIMEOUT, --timeout=TIMEOUT
Request timeout in seconds
-o OUTPUT_FILE, --output-file=OUTPUT_FILE
Output results to a file (CSV)
-l, --list List all GraphQL technologies graphw00f is able to
detect
-u USERAGENT, --user-agent=USERAGENT
Custom user-agent to use (overrides the one from
headers configuration)
-H HEADER, --header=HEADER
Custom headers to send (e.g. "Authorization: Bearer
ey...").
-w WORDLIST, --wordlist=WORDLIST
Path to a list of custom GraphQL endpoints
-v, --version Print out the current version and exit.graphw00f is a CLI tool used to detect and fingerprint GraphQL engines. It works by sending a mix of benign and malformed queries to determine the backend implementation.
Core Modes:
-d, --detect): Scans the target URL to find where the GraphQL endpoint is located.-f, --fingerprint): Identifies the specific GraphQL engine (e.g., Apollo, Graphene, Hasura) once an endpoint is known.Common Flags:
-t URL, --target=URL: The target URL including the path.-p PROXY, --proxy=PROXY: HTTP(S) proxy URL (e.g., http://user:pass@host:port).-o OUTPUT_FILE, --output-file=OUTPUT_FILE: Save results to a CSV file.-u USERAGENT, --user-agent=USERAGENT: Custom User-Agent string.-H HEADER, --header=HEADER: Custom headers (e.g., "Authorization: Bearer ...").-w WORDLIST, --wordlist=WORDLIST: Path to a list of custom GraphQL endpoints.python3 main.py -d -f -t http://example.comThe following command-line options are available for graphw00f:
| Flag | Long Name | Description |
|---|---|---|
-t | --target | Target URL including the path. |
-d | --detect | Enable detection mode. |
-f | --fingerprint | Enable fingerprinting mode. |
-r | --noredirect | Do not follow redirections given by 3xx responses. |
-p | --proxy | HTTP(S) proxy URL (e.g., http://user:pass@host:port). |
-T | --timeout | Request timeout in seconds (default: 10). |
-o | --output-file | Output results to a CSV file. |
-l | --list | List all GraphQL technologies detectable by graphw00f. |
-u | --user-agent | Custom User-Agent (overrides configuration). |
-H | --header | Custom headers to send (e.g., -H "Authorization: Bearer ..."). |
-w | --wordlist | Path to a custom list of GraphQL endpoints. |
-v | --version | Print current version and exit. |
# Example of using custom headers and a proxy
python3 main.py -d -f -t http://example.com -H "Authorization: Bearer token" -p http://proxy:8080To save the results of a scan, use the -o or --output-file flag. The output is a CSV file containing the following columns:
url: The network location of the target.detected_engine: The name of the discovered GraphQL engine.timestamp: The time the scan was completed.python3 main.py -d -f -t http://example.com -o results.csv