dolevf/graphql-copGraphQL API의 자동화된 보안 감사를 위한 경량 Python 유틸리티입니다. cURL 재현 명령어를 사용하여 잘못된 구성, 정보 유출, 서비스 거부 취약점을 탐지합니다.
GraphQL Cop은 GraphQL API에 대해 일반적인 보안 테스트를 수행하는 소형 Python 유틸리티입니다. GraphQL Cop은 GraphQL에서 CI/CD 검사를 실행하는 데 적합합니다. 가볍고 GraphQL의 흥미로운 보안 문제를 다룹니다.
GraphQL Cop은 발견된 취약점에 대해 cURL 명령을 제공하여 결과를 재현할 수 있게 해줍니다.
아래 명령어를 실행하여 종속성을 설치해야 합니다.
python3 -m venv path/to/venv
source path/to/venv/bin/activate
python3 -m pip install -r requirements.txt
첫 번째 명령어는 path/to/venv 디렉터리에 가상 환경을 생성합니다.
두 번째 명령어는 가상 환경을 활성화합니다.
마지막 명령어는 requirements.txt에 나열된 모든 Python 패키지를 설치합니다.
$ python3 graphql-cop.py -h
Usage: graphql-cop.py -t http://example.com -o json
Options:
-h, --help show this help message and exit
-t URL, --target=URL target url with the path - if a GraphQL path is not
provided, GraphQL Cop will iterate through a series of
common GraphQL paths
-H HEADER, --header=HEADER
Append Header(s) to the request '{"Authorization":
"Bearer eyjt"}' - Use multiple -H for additional
Headers
-o FORMAT, --output=FORMAT
json
-e EXCLUDED_TESTS, --excluded-tests=EXCLUDED_TESTS
Exclude specific tests
-l, --list-tests List available tests
-f, --force Forces a scan when GraphQL cannot be detected
-d, --debug Append a header with the test name for debugging
-x PROXY, --proxy=PROXY
HTTP(S) proxy URL in the form
http://user:pass@host:port
-w WORDLIST, --wordlist=WORDLIST
Path to a list of custom GraphQL endpoints
-v, --version Print out the current version and exit.
-T, --tor Sends the request through the Tor network (ensure Tor
is running and properly configured)
$ python3 graphql-cop.py -t https://mywebsite.com/graphql
[HIGH] Introspection Query Enabled (Information Leakage)
[LOW] GraphQL Playground UI (Information Leakage)
[HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service)
[HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service)
$ python3 graphql-cop.py -t https://mywebsite.com/graphql -e field_duplication
[HIGH] Introspection Query Enabled (Information Leakage)
[LOW] GraphQL Playground UI (Information Leakage)
[HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service)
[HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service)
python3 graphql-cop.py -t https://mywebsite.com/graphql -o json
{'curl_verify': 'curl -X POST -H "User-Agent: graphql-cop/1.2" -H '
'"Accept-Encoding: gzip, deflate" -H "Accept: */*" -H '
'"Connection: keep-alive" -H "Content-Length: 33" -H '
'"Content-Type: application/json" -d \'{"query": "query { '
'__typename }"}\' \'http://localhost:5013/graphql\'',
'description': 'Tracing is Enabled',
'impact': 'Information Leakage',
'result': False,
'severity': 'INFO',
'color': 'green',
'title': 'Trace Mode'},
{'curl_verify': 'curl -X POST -H "User-Agent: graphql-cop/1.2" -H '
'"Accept-Encoding: gzip, deflate" -H "Accept: */*" -H '
'"Connection: keep-alive" -H "Content-Length: 64" -H '
'"Content-Type: application/json" -d \'{"query": "query { '
'__typename @aa@aa@aa@aa@aa@aa@aa@aa@aa@aa }"}\' '
"'http://localhost:5013/graphql'",
'description': 'Multiple duplicated directives allowed in a query',
'impact': 'Denial of Service',
'result': True,
'severity': 'HIGH',
'color': 'red',
'title': 'Directive Overloading'}]
$ python3 graphql-cop.py -t https://mywebsite.com/graphql --proxy=http://127.0.0.1:8080 --header '{"Authorization": "Bearer token_here"}'
[HIGH] Introspection Query Enabled (Information Leakage)
[LOW] GraphQL Playground UI (Information Leakage)
[HIGH] Alias Overloading with 100+ aliases is allowed (Denial of Service)
[HIGH] Queries are allowed with 1000+ of the same repeated field (Denial of Service)
git clone https://github.com/dolevf/graphql-cop.git
cd graphql-cop
docker build -t graphql-cop:latest .
다음과 같이 Docker 컨테이너를 실행하고 graphql-cop 스크립트에 인수를 전달할 수 있습니다:
docker run --rm -it graphql-cop:latest -t <GRAPHQL_ENDPOINT> -H '{"<HEADER_KEY>": "<HEADER_VALUE>"}'
다음은 컨테이너 실행 예제입니다:
docker run --rm -it graphql-cop:latest -t https://example.com/graphql -H '{"Authorization": "Bearer abc123xyz"}'
사용 가능한 모든 옵션 목록을 보려면 다음을 실행하세요:
docker run --rm -it graphql-cop:latest --help
문제 해결