77 lines
2.5 KiB
Python
Executable File
77 lines
2.5 KiB
Python
Executable File
#!/usr/bin/python
|
|
import argparse
|
|
import json
|
|
import re
|
|
import readline
|
|
import requests
|
|
import sys
|
|
import time
|
|
from utils import *
|
|
from attacks import *
|
|
|
|
|
|
class GraphQLmap(object):
|
|
author = "@pentest_swissky"
|
|
version = "1.0"
|
|
endpoint = "graphql"
|
|
method = "POST"
|
|
args = None
|
|
url = None
|
|
headers = None
|
|
|
|
def __init__(self, args):
|
|
print(" _____ _ ____ _ ")
|
|
print(" / ____| | | / __ \| | ")
|
|
print(" | | __ _ __ __ _ _ __ | |__ | | | | | _ __ ___ __ _ _ __ ")
|
|
print(" | | |_ | '__/ _` | '_ \| '_ \| | | | | | '_ ` _ \ / _` | '_ \ ")
|
|
print(" | |__| | | | (_| | |_) | | | | |__| | |____| | | | | | (_| | |_) |")
|
|
print(" \_____|_| \__,_| .__/|_| |_|\___\_\______|_| |_| |_|\__,_| .__/ ")
|
|
print(" | | | | ")
|
|
print(" |_| |_| ")
|
|
print(" " * 30, end='')
|
|
print(f"\033[1mAuthor\033[0m: {self.author} \033[1mVersion\033[0m: {self.version} ")
|
|
self.args = args
|
|
self.url = args.url
|
|
self.method = args.method
|
|
self.headers = None if not args.headers else json.loads(args.headers)
|
|
|
|
while True:
|
|
query = input("GraphQLmap > ")
|
|
cmdlist.append(query)
|
|
if query == "exit" or query == "q":
|
|
exit()
|
|
|
|
elif query == "help":
|
|
display_help()
|
|
|
|
elif query == "debug":
|
|
display_types(self.url, self.method, self.headers)
|
|
|
|
elif query == "dump_new":
|
|
dump_schema(self.url, self.method, 15, self.headers)
|
|
|
|
elif query == "dump_old":
|
|
dump_schema(self.url, self.method, 14, self.headers)
|
|
|
|
elif query == "nosqli":
|
|
blind_nosql(self.url, self.method, self.headers)
|
|
|
|
elif query == "postgresqli":
|
|
blind_postgresql(self.url, self.method, self.headers)
|
|
|
|
elif query == "mysqli":
|
|
blind_mysql(self.url, self.method, self.headers)
|
|
|
|
elif query == "mssqli":
|
|
blind_mssql(self.url, self.method, self.headers)
|
|
|
|
else:
|
|
exec_advanced(args.url, self.method, query, self.headers)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
readline.set_completer(auto_completer)
|
|
readline.parse_and_bind("tab: complete")
|
|
args = parse_args()
|
|
GraphQLmap(args)
|