Ultra-fast passive GraphQL reconnaissance tool for bug hunters and security researchers. Launches a Chromium browser, observes all network traffic during normal browsing, captures GraphQL operations and responses, downloads JS bundles, extracts embedded queries, deduplicates everything, and saves results in real-time as .txt, .json, and .graphql files.
go build -o graphoper .Requires Chromium/Chrome installed on the system (or specify path with -chrome).
# Browse a target — opens visible browser window
./graphoper https://target.example.com
# Headless mode
./graphoper -headless https://target.example.com
# Fast mode (disables image/media loading for high-speed scanning)
./graphoper -headless -fast https://target.example.com
# Custom output directory
./graphoper -out ./my-target https://target.example.com
# Inject custom headers (tokens, cookies, auth)
./graphoper -header "Authorization: Bearer eyJ..." -header "Cookie: session=123" https://target.example.com
# Persist browser session (cookies, login state)
./graphoper -profile ./profile https://target.example.com
# Route through an intercepting proxy (Burp Suite / Caido / mitmproxy)
./graphoper -proxy http://127.0.0.1:8080 https://target.example.com
# Project-scoped output (saves to projects/<name>/)
./graphoper -project bugbounty-target https://target.example.com
# Specify custom Chrome executable
./graphoper -chrome /usr/bin/chromium-browser https://target.example.com
# Set a session timeout
./graphoper -timeout 30m https://target.example.com
# Verbose logging
./graphoper -v https://target.example.comExecute captured GraphQL operations against a target GraphQL API using session cookies or authentication tokens from another session:
# Replay captured queries using session cookies string
./graphoper -run -endpoint https://target.example.com/graphql -cookie "session=abc; token=xyz" -out output
# Replay using a cookies file (supports JSON from Cookie-Editor, Netscape format, or raw header)
./graphoper -run -endpoint https://target.example.com/graphql -cookie-file ./cookies.json -out output
# Custom operations file, concurrency, and delay
./graphoper -run -endpoint https://target.example.com/graphql -cookie-file ./cookies.json -ops output/operations.json -concurrency 10 -delay 100ms
# Include mutations (skipped by default for safety against state modification)
./graphoper -run -endpoint https://target.example.com/graphql -cookie "session=abc" -mutations
# Route runner through Burp Suite / Caido proxy
./graphoper -run -endpoint https://target.example.com/graphql -cookie "session=abc" -proxy http://127.0.0.1:8080| File | Content | Format |
|---|---|---|
operations.txt |
Clean list of captured GraphQL queries & mutations | Plaintext |
operations.json |
Detailed operations with hashes, names, variables, endpoints, and timestamps | JSON Array |
endpoints.txt |
Unique discovered GraphQL API endpoints (pipeable to httpx/nuclei) | Plaintext URL list |
schema.graphql |
Auto-reconstructed GraphQL SDL schema from observed __typename fields |
GraphQL SDL |
schema.json |
Observed GraphQL types and aggregated field mappings | JSON Object |
responses.json |
Intercepted/replayed HTTP responses linked to operations | JSON Array |
responses/ |
Individual response JSON files per operation | JSON files |
session.json |
Run parameters, UUID session identifier, mode, and timestamps | JSON Object |
bundles/ |
Downloaded JS bundle chunks containing queries | JavaScript files |
logs/ |
Timestamped session logs | Plaintext logs |
| Flag | Default | Description |
|---|---|---|
-session <id> |
auto-generated | Unique session identifier (UUIDv4 auto-generated if empty) |
-out <dir> |
output |
Directory to store exports (.txt, .json, .graphql) |
-project <name> |
"" |
Project name for per-project storage layout (projects/<name>/...) |
-bundles <dir> |
<out>/bundles |
JS bundle download directory |
-headless |
false |
Run Chromium silently in the background |
-fast |
false |
Disable image/media loading for ultra-fast browsing |
-chrome <path> |
"" |
Custom path to Chrome/Chromium binary executable |
-profile <dir> |
"" |
Browser profile directory for session persistence |
-proxy <url> |
"" |
HTTP/SOCKS5 proxy URL |
-header <key:val> |
"" |
Custom HTTP header (can be repeated) |
-timeout <dur> |
0 (unlimited) |
Maximum session duration (e.g. 15m, 1h) |
-no-color |
false |
Disable ANSI color codes (auto-disabled when redirected or piped) |
-color |
false |
Force ANSI colors even when output is piped |
-v |
false |
Detailed verbose event logging |
| Flag | Default | Description |
|---|---|---|
-run |
false |
Active runner mode: replay captured ops against endpoint |
-endpoint <url> |
"" |
Target GraphQL API endpoint (e.g. https://target.com/graphql) |
-cookie <str> |
"" |
Session cookie string for authentication |
-cookie-file <path> |
"" |
File containing session cookies (.json, Netscape, or raw) |
-ops <file> |
<out>/operations.json |
Operations file (.json or .txt) to replay |
-vars <json> |
"" |
Inject custom variables JSON (e.g. {"id": "1"}) |
-vars-file <path> |
"" |
File containing JSON variables to inject |
-auto-vars |
true |
Auto-generate mock values for required non-null variables |
-mutations |
false |
Execute mutation operations (skipped by default for safety) |
-concurrency <n> |
5 |
Number of concurrent workers for runner execution |
-delay <dur> |
50ms |
Delay between runner requests to avoid rate limits |
Private.