InQL v5.0 - Burp Extension for Advanced GraphQL Testing

🚀 Introduction

Welcome to InQL v5.0, a major update for our open-source GraphQL testing tool. This version provides new and improved features aimed at enhancing your GraphQL testing capabilities, making it more efficient and effective.

We appreciate your trust in InQL. Happy testing!

⚠️ Significant Updates and Breaking Changes

We've strategically revised certain aspects of InQL v5.0, leading to the deprecation of some features from v4. Notably, standalone and CLI modes, the embedded GraphiQL server, and the Timer tab are no longer available.

This streamlining allows us to focus on refining InQL's core functionality, though we recognize it may affect your established workflows. This is especially pertinent as some of these features were highlighted in the renowned Black Hat GraphQL book.

Our goal is to achieve full feature parity with v4 in the upcoming v5.1 version. In the interim, please consider using the last v4.0.7 release or building InQL from the v4 branch.

❗ GQLSpection - The Successor of Standalone and CLI Modes

In order to simplify our code base, standalone mode and CLI, which allowed for InQL use outside of Burp, have been removed in InQL v5.0. These functionalities are now bundled within GQLSpection, a multi-use CLI tool and a Python 2/3/Jython compatible library.

GQLSpection facilitates sending introspection queries, parsing results, generating queries and mutations, and executing Points of Interest searches.

❗ Deprecation of the Timer Tab

The Timer tab from InQL v4 has been discontinued in v5.0, as Burp's built-in Logger tool offers a more accurate and thorough alternative for visualizing query execution times. Here's a quick guide to use Burp's Logger instead:

• Enter the GraphQL endpoint as your search term.
• Show the "Start response timer" & "End response timer" columns.
  • End response timer: This denotes the time taken by the server to completely send back the response. It mirrors the data provided by the deprecated Timer tab but is more precise.
  • Start response timer: This represents the time taken by the server to process the response before starting to send it back, a crucial metric for DoS conditions.

❗ GraphiQL and Circular Relationship Detection

Owing to time constraints, these features are temporarily absent from the v5.0 release. However, we're dedicated to reintroducing them in v5.1.

🌟 Features

The InQL user interface is equipped with two primary components: the Scanner and the Attacker.

🔎 Scanner

scanner.mp4

The Scanner is the core of InQL v5.0, where you can analyze a GraphQL endpoint or a local introspection schema file. It auto-generates all possible queries and mutations, organizing them into a structured view for your analysis.

✅ Customizable Scans

InQL v5.0 offers the flexibility to customize your scans. Adjust the depth of generated queries or the number of spaces used for indentation. You can also perform 'Points of Interest' scans to detect potential vulnerabilities in the GraphQL schema.

✅ Points of Interest Analysis

After running a Points of Interest scan, you are presented with a rich data set covering a variety of potential vulnerabilities. You can enable or disable these categories according to your needs.

✅ Enhanced Interactions with Burp

InQL v5.0 seamlessly integrates with Burp, enabling you to generate queries directly from any GraphQL request in Burp. You can also send auto-generated queries to other Burp tools for further analysis.

✅ Custom Headers

You have the ability to set custom headers per domain, with the domain list auto-populated from observed traffic.

⚔️ Attacker

attacker.mp4

The Attacker component lets you run batch GraphQL attacks, which can be useful for circumventing poorly implemented rate limits.

📝 Burp's Native Message Editors

Burp's native message editors now come with an additional 'GraphQL' tab, providing an efficient way to view and modify GraphQL requests.

⬇️ Installation

To successfully install InQL v5.0, ensure you meet the following requirements:

Burp:

• Support is only provided for the most recent version of Burp.
• Compatible with both "Professional" and "Community" editions.

Java:

• The Montoya API needs Java 17 or later.

💻 Building the InQL extension from git

1. Install Java 17+, for example in Debian-based distros:

$ sudo apt install -y openjdk-17-jdk
$ java --version
openjdk 17.0.6 2023-01-17

2. Clone the repo and pull submodules:

$ git clone https://github.com/doyensec/inql
$ cd inql
$ git checkout dev
$ git submodule init
$ git submodule update

3. Build the InQL extension:

$ ./gradlew

Load the file build/InQL.jar into Burp as a Java extension.

🛠️ Setting up development environment

After building InQL as described above, you can prepare your development environment.

Begin by setting up a virtual environment with Python 2.7 for Jython compatibility. Note that necessary headers are required to build libraries with pip. For instance, using virtualenv:

$ sudo apt install -y python2.7 python2.7-dev python2-setuptools-whl python2-pip-whl python3-virtualenv
$ virtualenv -p python2.7 ./venv/

Using venv, pyenv, etc will also work.

Once you have the venv set up, activate it and install development requirements:

$ . ./venv/activate
$ pip install -r requirements_dev.txt

Install the GQLSpection from a submodule (as a development library so you can edit it directly):

$ pip install -e lib/GQLSpection/

Install pre-commit script to automatically run checks before each commit:

$ pre-commit install

Now a bunch of tests, including isort and pylint, should run on each commit. However, it will also change the files if necessary and cancel commit in this case for you to inspect. So, make sure to check what's up, manually add the changes (git add) and run git commit again (as the original commit didn't go through).

Your environment is ready for development of InQL! Note that GQLSpection requires its own setup. Oh, and if the GQLSpection submodule gets out of date you'll see a message about it in git status. Fix it by running:

$ git submodule update

(this can also be done automatically when needed by modifying ~/.gitconfig)

🤝 Contributing

InQL thrives on community contributions. Whether you're a developer, researcher, designer, or bug hunter, your expertise is invaluable to us. We welcome bug reports, feedback, and pull requests. Your participation helps us continue to improve InQL, making it a stronger tool for the community.

Interactions are best carried out through the Github issue tracker, but you can also reach us on social media (@Doyensec). We look forward to hearing from you!

👥 Contributors

A special thanks to our contributors. Your dedication and commitment have been instrumental in making InQL what it is today.

Current:

• Maintainer: Andrew Konstantinov @execveat (Twitter) / @execveat (Mastodon)
• Contributor: Matteo Oldani @matteoldani (Github)

Historical:

• Author: Andrea Brancaleoni @nJoyneer (Twitter) / thypon (Github)
• List of other contributors: AUTHORS

This project was made with support of Doyensec.