GraphQL Support on ZAP

GraphQL Options

Mon, 01 Jan 0001 00:00:00 +0000

GraphQL Options

In this document, a ‘Query’ may refer to a GraphQL query, subscription or mutation.

Query Generator Configuration

The query generator uses the imported schema to generate queries for the target endpoint. If enabled, it may be configured with the following options.

GraphQL Variant

Mon, 01 Jan 0001 00:00:00 +0000

GraphQL Variant

The GraphQL variant is responsible for two things:

Correctly representing the nodes for a GraphQL request in the sites tree.
Allow injecting payloads in GraphQL queries (Active Scan Input Vector support).

The following sections will elaborate a little on each of these functionalities.

Sites Tree Representation

Each unique GraphQL request proxied through ZAP is represented in the sites tree. Requests are placed under a common node if they have the same operations. Two queries that have the same fields will be represented by the same node. The only exception is when a query is sent with inline arguments and also using variables. In this case, a prefix of either ‘0’ or ‘1’ is added to distinguish between them respectively.
For example, the following figure illustrates how two requests may be represented in the sites tree.

GraphQL Automation Framework Support

Mon, 01 Jan 0001 00:00:00 +0000

GraphQL Automation Framework Support

This add-on supports the Automation Framework.

The add-on will import GraphQL schemas using introspection if endpoints are found while spidering. However, specifying an endpoint and (optionally) a schema file or URL is recommended if they are available.

Job: graphql

The graphql job allows you to import GraphQL schemas locally or from a URL. It supports the following parameters:

GraphQL Alerts

Mon, 01 Jan 0001 00:00:00 +0000

GraphQL Alerts

The following alerts are raised by the GraphQL add-on.

Alert Reference	Name	Description	Latest Code
50007-1	GraphQL Endpoint Supports Introspection	This alert is raised when the spider discovers a GraphQL endpoint that supports introspection.	GraphQlParser.java
50007-2	GraphQL Server Implementation Identified	This alert is raised when the GraphQL implementation used by the server is identified. It utilises fingerprinting techniques adapted from the tool graphw00f. Note: If the Tech Detection (Wappalyzer) add-on is installed the fingerprinter will also add identified GraphQL Engines to the Technology tab/data.	GraphQlFingerprinter.java
50007-3	GraphQL Circular References in Schema	This alert is raised when cycles are found in the object types in the imported GraphQL schema. A new alert is raised for each unique cycle. The alert contains information about the cycle and a message with an example query. No requests are actually sent.	GraphQlCycleDetector.java

Alert ID: 50007.

GraphQL Support Script

Mon, 01 Jan 0001 00:00:00 +0000