doyensec/inqlInQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
Welcome to InQL, an open-source GraphQL testing tool. This tool provides features designed to enhance your GraphQL testing experience, making it more efficient and effective.
We appreciate your trust in InQL. Happy testing!
The InQL user interface is equipped with three primary components: the Scanner, the Batch Queries, and the Engine Fingerprinting tab
The Scanner is the core of InQL, where you can analyze a GraphQL endpoint or a local introspection schema file. It auto-generates all possible queries, mutations, and subscriptions, organizing them into a structured view for your analysis.
โ Customizable Scans
InQL offers the flexibility to customize your scans. Adjust the depth of generated queries or the number of spaces used for indentation. You can also perform 'Points of Interest' scans to detect potential vulnerabilities in the GraphQL schema.
โ Points of Interest Analysis
After running a Points of Interest scan, you are presented with a rich data set covering a variety of potential vulnerabilities. You can enable or disable these categories according to your needs.
โ Circular References Detection
InQL implements circular reference detection. After analyzing the schema, it displays potentially vulnerable queries in the scanner results view.
โ Enhanced Interactions with Burp
InQL seamlessly integrates with Burp, enabling you to generate queries directly from any GraphQL request in Burp. You can also send auto-generated queries to other Burp tools for further analysis.
โ Custom Headers
You have the ability to set custom headers per domain, with the domain list auto-populated from observed traffic.
The Batch Queries tab lets you run batch GraphQL attacks, which can be useful for circumventing poorly implemented rate limits.
Burp's native message editors now come with an additional 'GraphQL (InQL)' tab, providing an efficient way to view and modify GraphQL requests. It also supports schema highlighting for better readability.
InQL now implements GraphiQL and GraphQL Voyager servers. You can send the analysed schame into them to enhance the analysis even further!
This tab allows you to scan a GraphQL URL to retrieve information about the backend server technology.
This scanner is designed to recreate the schema when introspection is disabled. It is based on Clairvoyance CLI tool, using regex pattern matching to discover schema details.
To successfully install InQL, ensure you meet the following requirements:
Burp:
Java:
$ sudo apt install -y openjdk-17-jdk
$ java --version
openjdk 17.0.6 2023-01-17
$ # Mac OS & Homebrew:
$ brew install go-task
$ # Debian
$ sudo apt install -y task
$ git clone https://github.com/doyensec/inql
$ cd inql
$ # Optionally, checkout dev branch (might be broken / unstable!)
$ git checkout dev
$ task all
This should produce a file named InQL.jar or similar in the root of the repo. Load it into Burp
as a Java extension.
Development environment