Welcome to InQL v5.0, a major update for our open-source GraphQL testing tool. This version provides new and improved features aimed at enhancing your GraphQL testing capabilities, making it more efficient and effective. We appreciate your trust in InQL. Happy testing! We've strategically revised certain aspects of InQL v5.0, leading to the deprecation of some features from v4. Notably, standalone and CLI modes, the embedded GraphiQL server, and the Timer tab are no longer available. This streamlining allows us to focus on refining InQL's core functionality, though we recognize it may affect your established workflows. This is especially pertinent as some of these features were highlighted in the renowned Black Hat GraphQL book. Our goal is to achieve full feature parity with v4 in the upcoming v5.1 version. In the interim, please consider using the last v4.0.7 release or building InQL from the v4 branch. ❗ GQLSpection - The Successor of Standalone and CLI Modes In order to simplify our code base, standalone mode and CLI, which allowed for InQL use outside of Burp, have been removed in InQL v5.0. These functionalities are now bundled within GQLSpection, a multi-use CLI tool and a Python 2/3/Jython compatible library. GQLSpection facilitates sending introspection queries, parsing results, generating queries and mutations, and executing Points of Interest searches. ❗ Deprecation of the Timer Tab The Timer tab from InQL v4 has been discontinued in v5.0, as Burp's built-in Logger tool offers a more accurate and thorough alternative for visualizing query execution times. Here's a quick guide to use Burp's Logger instead: ❗ GraphiQL and Circular Relationship Detection Owing to time constraints, these features are temporarily absent from the v5.0 release. However, we're dedicated to reintroducing them in v5.1. The InQL user interface is equipped with two primary components: the Scanner and the Attacker. https://github.com/doyensec/inql/assets/105389353/77ac7f1f-1aba-415e-8566-07cefa8a5075 The Scanner is the core of InQL v5.0, where you can analyze a GraphQL endpoint or a local introspection schema file. It auto-generates all possible queries and mutations, organizing them into a structured view for your analysis. ✅ Customizable Scans InQL v5.0 offers the flexibility to customize your scans. Adjust the depth of generated queries or the number of spaces used for indentation. You can also perform 'Points of Interest' scans to detect potential vulnerabilities in the GraphQL schema. ✅ Points of Interest Analysis After running a Points of Interest scan, you are presented with a rich data set covering a variety of potential vulnerabilities. You can enable or disable these categories according to your needs. ✅ Enhanced Interactions with Burp InQL v5.0 seamlessly integrates with Burp, enabling you to generate queries directly from any GraphQL request in Burp. You can also send auto-generated queries to other Burp tools for further analysis. ✅ Custom Headers You have the ability to set custom headers per domain, with the domain list auto-populated from observed traffic. https://github.com/doyensec/inql/assets/105389353/c7a89be3-dad8-4db6-b4a5-b8fefe043394 The Attacker component lets you run batch GraphQL attacks, which can be useful for circumventing poorly implemented rate limits. Burp's native message editors now come with an additional 'GraphQL' tab, providing an efficient way to view and modify GraphQL requests. To successfully install InQL v5.0, ensure you meet the following requirements: Burp: Java: Load the file After building InQL as described above, you can prepare your development environment. Begin by setting up a virtual environment with Python 2.7 for Jython compatibility. Note that necessary headers are required to build libraries with pip. For instance, using virtualenv: Using venv, pyenv, etc will also
work. Once you have the venv set up, activate it and install development requirements: Install the GQLSpection from a submodule (as a development library so you can edit it directly): Install pre-commit script to automatically run checks before each commit: Now a bunch of tests, including isort and pylint, should run on each commit.
However, it will also change the files if necessary and cancel commit in this
case for you to inspect. So, make sure to check what's up, manually add the
changes ( Your environment is ready for development of InQL! Note that GQLSpection
requires its own setup. Oh, and if the GQLSpection submodule gets out of date
you'll see a message about it in (this can also be done automatically when needed by modifying InQL thrives on community contributions. Whether you're a developer, researcher, designer, or bug hunter, your expertise is invaluable to us. We welcome bug reports, feedback, and pull requests. Your participation helps us continue to improve InQL, making it a stronger tool for the community. Interactions are best carried out through the Github issue tracker, but you can also reach us on social media (@Doyensec). We look forward to hearing from you! A special thanks to our contributors. Your dedication and commitment have been instrumental in making InQL what it is today. Current: Historical: This project was made with support of Doyensec.
$ sudo apt install -y openjdk-17-jdk
$ java --version
openjdk 17.0.6 2023-01-17
$ git clone https://github.com/doyensec/inql
$ cd inql
$ git checkout dev
$ git submodule init
$ git submodule update$ ./gradlew
build/InQL.jar into Burp as a Java extension.$ sudo apt install -y python2.7 python2.7-dev python2-setuptools-whl python2-pip-whl python3-virtualenv
$ virtualenv -p python2.7 ./venv/
$ . ./venv/activate
$ pip install -r requirements_dev.txt$ pip install -e lib/GQLSpection/
$ pre-commit install
git add) and run git commit again (as the original commit didn't go
through).git status. Fix it by running:$ git submodule update
~/.gitconfig)