graphw00f

What it is

graphw00f is a command-line GraphQL fingerprinting tool (main.py) by Dolev Farhi. The summary covers what it detects; what it doesn't cover is how you actually operate it — the two-mode workflow, the endpoint-discovery step, and header/cookie configuration for authenticated targets.

How it works

Two modes that are meant to be combined. Detect mode (-d) locates where GraphQL lives on a host (optionally guided by a wordlist of candidate endpoint paths via -w); fingerprint mode (-f) then sends the benign/malformed queries against a known endpoint to identify the engine. It handles both GET- and POST-based querying. The underlying weakness it exploits is that implementations respond distinguishably to crafted queries, mutations, and subscriptions — classified as CWE-200 (information exposure). On a successful fingerprint it prints the matching GraphQL Threat Matrix doc plus a direct "Attack Surface Matrix" URL for that engine.

What to do

If you already know the endpoint path, fingerprint it directly:

python3 main.py -f -t https://demo.hypergraphql.org:8484/graphql

If you don't know where GraphQL lives, chain detect + fingerprint:

python3 main.py -f -d -t http://localhost:5000

Install requires only python3 and requests:

git clone https://github.com/dolevf/graphw00f.git

Useful flags: -p for an HTTP(S) proxy (http://user:pass@host:port), -T request timeout, -o CSV output, -r to suppress following 3xx redirects, -l to list all detectable engines.

For authenticated or cookie-gated endpoints, set headers/cookies in conf.py:

# Custom Headers
HEADERS = {'User-Agent':'graphw00f'}
# Custom Cookies
COOKIES = {"PHPSESS":"DEADBEEF"}

Or pass them at the command line with -H "Authorization: Bearer ..." and -u for the user-agent. Note the precedence: a command-line --user-agent overrides any User-Agent set in conf.py.

Caveats

graphw00f only identifies the engine and surfaces its documented default defenses/CVEs via the Threat Matrix — it does not itself exploit anything or confirm a given CVE is present in the target's specific version. The engine list is a moving target (the README shows tool versions v1.0.7 through v1.1.2 in its examples); run -l against your installed copy for the authoritative set rather than trusting a cached list.