diff --git a/README.md b/README.md index 85b733f..57d0e6c 100644 --- a/README.md +++ b/README.md @@ -59,6 +59,7 @@ graphw00f currently attempts to discover the following GraphQL engines: * Agoo - Ruby * Mercurius - JavaScript * morpheus-graphql - Haskell +* jaal - Golang # GraphQL Threat Matrix The graphw00f project uses the [GraphQL Threat Matrix Project](https://github.com/nicholasaleks/graphql-threat-matrix/) as its technology security matrix database. When graphw00f successfully fingerprints a GraphQL endpoint, it will print out the threat matrix document. This document helps security engineers to identify how mature the technology is, what security features it offers, and whether it contains any CVEs. diff --git a/graphw00f/helpers.py b/graphw00f/helpers.py index 2101362..b07ca43 100644 --- a/graphw00f/helpers.py +++ b/graphw00f/helpers.py @@ -237,6 +237,12 @@ def get_engines(): 'url':'https://github.com/morpheusgraphql/morpheus-graphql', 'ref':'https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/morpheus-graphql', 'technology':['Haskell'] + }, + 'jaal':{ + 'name':'jaal', + 'url':'https://github.com/appointy/jaal', + 'ref':'https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/jaal', + 'technology':['Golang'] } } diff --git a/graphw00f/lib.py b/graphw00f/lib.py index 4b94669..6455d29 100644 --- a/graphw00f/lib.py +++ b/graphw00f/lib.py @@ -43,6 +43,8 @@ def execute(self, url): self.url = url if self.engine_lighthouse(): return 'lighthouse' + elif self.engine_jaal(): + return 'jaal' elif self.engine_morpheus(): return 'morpheus-graphql' elif self.engine_mercurius(): @@ -623,3 +625,12 @@ def engine_morpheus(self): return False + def engine_jaal(self): + query = '''{}''' + response = self.graph_query(self.url, payload=query, operation='{}') + + if error_contains(response, 'must have a single query') or error_contains(response, 'offset'): + return True + + return False + diff --git a/version.py b/version.py index 9d04529..6d7bc52 100644 --- a/version.py +++ b/version.py @@ -1 +1 @@ -VERSION = '1.1.5' +VERSION = '1.1.6'