From 9cc7bf86ca474932565acc6b9dc49e7e4035d85b Mon Sep 17 00:00:00 2001 From: dolevf Date: Sun, 21 Aug 2022 22:58:52 -0400 Subject: [PATCH 1/2] add morpheus graphql --- README.md | 1 + graphw00f/helpers.py | 6 ++++++ graphw00f/lib.py | 19 +++++++++++++++++-- version.py | 2 +- 4 files changed, 25 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index df9cbc0..85b733f 100644 --- a/README.md +++ b/README.md @@ -58,6 +58,7 @@ graphw00f currently attempts to discover the following GraphQL engines: * Lighthouse - PHP * Agoo - Ruby * Mercurius - JavaScript +* morpheus-graphql - Haskell # GraphQL Threat Matrix The graphw00f project uses the [GraphQL Threat Matrix Project](https://github.com/nicholasaleks/graphql-threat-matrix/) as its technology security matrix database. When graphw00f successfully fingerprints a GraphQL endpoint, it will print out the threat matrix document. This document helps security engineers to identify how mature the technology is, what security features it offers, and whether it contains any CVEs. diff --git a/graphw00f/helpers.py b/graphw00f/helpers.py index 921e7b3..2101362 100644 --- a/graphw00f/helpers.py +++ b/graphw00f/helpers.py @@ -231,6 +231,12 @@ def get_engines(): 'url':'https://github.com/mercurius-js/mercurius', 'ref':'https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/agoo.md', 'technology':['JavaScript', 'Node.js', 'TypeScript'] + }, + 'morpheus-graphql':{ + 'name':'morpheus-graphql', + 'url':'https://github.com/morpheusgraphql/morpheus-graphql', + 'ref':'https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/morpheus-graphql', + 'technology':['Haskell'] } } diff --git a/graphw00f/lib.py b/graphw00f/lib.py index c405972..32b1b68 100644 --- a/graphw00f/lib.py +++ b/graphw00f/lib.py @@ -43,8 +43,10 @@ def execute(self, url): self.url = url if self.engine_lighthouse(): return 'lighthouse' - if self.engine_mercurius(): - return 'mercurius' + elif self.engine_morpheus(): + return 'morpheus-graphql' + elif self.engine_mercurius(): + return 'mercurius-graphql' elif self.engine_graphql_yoga(): return 'graphql_yoga' elif self.engine_agoo(): @@ -608,3 +610,16 @@ def engine_mercurius(self): return True return False + def engine_morpheus(self): + query = '''' + queryy { + __typename + } + ''' + response = self.graph_query(self.url, payload=query) + + if error_contains(response, 'expecting white space') or error_contains(response, 'offset'): + return True + + return False + diff --git a/version.py b/version.py index d749da4..9d04529 100644 --- a/version.py +++ b/version.py @@ -1 +1 @@ -VERSION = '1.1.4' +VERSION = '1.1.5' From 3941a44404d016fd6200427b46f115f0826dd102 Mon Sep 17 00:00:00 2001 From: dolevf Date: Sun, 21 Aug 2022 22:59:43 -0400 Subject: [PATCH 2/2] space --- graphw00f/lib.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/graphw00f/lib.py b/graphw00f/lib.py index 32b1b68..4b94669 100644 --- a/graphw00f/lib.py +++ b/graphw00f/lib.py @@ -612,9 +612,9 @@ def engine_mercurius(self): def engine_morpheus(self): query = '''' - queryy { - __typename - } + queryy { + __typename + } ''' response = self.graph_query(self.url, payload=query)