diff --git a/README.md b/README.md index df9cbc0..85b733f 100644 --- a/README.md +++ b/README.md @@ -58,6 +58,7 @@ graphw00f currently attempts to discover the following GraphQL engines: * Lighthouse - PHP * Agoo - Ruby * Mercurius - JavaScript +* morpheus-graphql - Haskell # GraphQL Threat Matrix The graphw00f project uses the [GraphQL Threat Matrix Project](https://github.com/nicholasaleks/graphql-threat-matrix/) as its technology security matrix database. When graphw00f successfully fingerprints a GraphQL endpoint, it will print out the threat matrix document. This document helps security engineers to identify how mature the technology is, what security features it offers, and whether it contains any CVEs. diff --git a/graphw00f/helpers.py b/graphw00f/helpers.py index 921e7b3..2101362 100644 --- a/graphw00f/helpers.py +++ b/graphw00f/helpers.py @@ -231,6 +231,12 @@ def get_engines(): 'url':'https://github.com/mercurius-js/mercurius', 'ref':'https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md', 'technology':['JavaScript', 'Node.js', 'TypeScript'] + }, + 'morpheus-graphql':{ + 'name':'morpheus-graphql', + 'url':'https://github.com/morpheusgraphql/morpheus-graphql', + 'ref':'https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/morpheus-graphql', + 'technology':['Haskell'] } } diff --git a/graphw00f/lib.py b/graphw00f/lib.py index c405972..4b94669 100644 --- a/graphw00f/lib.py +++ b/graphw00f/lib.py @@ -43,8 +43,10 @@ def execute(self, url): self.url = url if self.engine_lighthouse(): return 'lighthouse' - if self.engine_mercurius(): - return 'mercurius' + elif self.engine_morpheus(): + return 'morpheus-graphql' + elif self.engine_mercurius(): + return 'mercurius-graphql' elif self.engine_graphql_yoga(): return 'graphql_yoga' elif self.engine_agoo(): @@ -608,3 +610,16 @@ def engine_mercurius(self): return True return False + def engine_morpheus(self): + query = '''' + queryy { + __typename + } + ''' + response = self.graph_query(self.url, payload=query) + + if error_contains(response, 'expecting white space') or error_contains(response, 'offset'): + return True + + return False + diff --git a/version.py b/version.py index d749da4..9d04529 100644 --- a/version.py +++ b/version.py @@ -1 +1 @@ -VERSION = '1.1.4' +VERSION = '1.1.5'