{"id":13739470,"url":"https://github.com/dolevf/graphw00f","last_synced_at":"2025-10-08T03:54:21.214Z","repository":{"id":37887370,"uuid":"399690944","full_name":"dolevf/graphw00f","owner":"dolevf","description":"graphw00f is GraphQL Server Engine Fingerprinting utility for software security professionals looking to learn more about what technology is behind a given GraphQL endpoint.","archived":false,"fork":false,"pushed_at":"2025-06-09T13:33:26.000Z","size":571,"stargazers_count":644,"open_issues_count":2,"forks_count":78,"subscribers_count":6,"default_branch":"main","last_synced_at":"2025-06-09T14:36:58.156Z","etag":null,"topics":["enumeration","fingerprinting","graphql","information-gathering","penetration-testing","security"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/dolevf.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2021-08-25T04:39:06.000Z","updated_at":"2025-06-09T13:33:30.000Z","dependencies_parsed_at":"2024-04-17T11:35:16.422Z","dependency_job_id":"6f6ffb3f-0847-4e49-857b-5e51b1c7bea3","html_url":"https://github.com/dolevf/graphw00f","commit_stats":{"total_commits":116,"total_committers":16,"mean_commits":7.25,"dds":"0.31034482758620685","last_synced_commit":"52e25d376f5fd4dcad062ba79a1b6c3e5e1c68dc"},"previous_names":[],"tags_count":25,"template":false,"template_full_name":null,"purl":"pkg:github/dolevf/graphw00f","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dolevf%2Fgraphw00f","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dolevf%2Fgraphw00f/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dolevf%2Fgraphw00f/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dolevf%2Fgraphw00f/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/dolevf","download_url":"https://codeload.github.com/dolevf/graphw00f/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/dolevf%2Fgraphw00f/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":278886413,"owners_count":26062975,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-10-08T02:00:06.501Z","response_time":56,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["enumeration","fingerprinting","graphql","information-gathering","penetration-testing","security"],"created_at":"2024-08-03T04:00:34.285Z","updated_at":"2025-10-08T03:54:21.184Z","avatar_url":"https://github.com/dolevf.png","language":"Python","readme":"\u003ch1 align=\"center\"\u003e\n \u003cimg src=\"https://github.com/dolevf/graphw00f/blob/main/static/graphw00f.png?raw=true\" height=\"50%\" width=\"50%\" alt=\"graphw00f\"/\u003e\n \u003cbr\u003e\n\u003c/h1\u003e\n\n\u003ch5 align=\"center\"\u003e\n\u003csmall\u003eCredits to \u003ca href=\"https://github.com/nicholasaleks\"\u003eNick Aleks \u003c/a\u003efor the logo!\u003c/small\u003e\n\u003c/h5\u003e\n\n\u003ch1 align=\"center\"\u003e\n graphw00f - GraphQL Server Fingerprinting\n\u003c/h1\u003e\n\n# Table of Contents\n* [How does it work?](#how-does-it-work)\n* [Detections](#detections)\n* [GraphQL Threat Matrix](#graphql-threat-matrix)\n* [Prerequisites](#prerequisites)\n* [Installation](#installation)\n* [Configuration](#configuration)\n* [Example Usage](#example)\n  * [Fingerprinting GraphQL](#fingerprinting-graphql)\n  * [Detecting \u0026 Fingerprinting GraphQL](#detecting-and-fingerprinting-graphql)\n* [Support \u0026 Issues](#support-and-issues)\n* [Resources](#resources)\n\n\n# How does it work?\ngraphw00f (inspired by [wafw00f](https://github.com/EnableSecurity/wafw00f)) is the GraphQL fingerprinting tool for GQL endpoints, it sends a mix of benign and malformed queries to determine the GraphQL engine running behind the scenes.\ngraphw00f will make use of the GraphQL Threat Matrix project to provide insight into what security defences each technology provides out of the box, and whether they are on or off by default.\n\nSpecially crafted queries cause different GraphQL server implementations to respond uniquely to queries, mutations and subscriptions, this makes it trivial to fingerprint the backend engine and distinguish between the various GraphQL implementations. (CWE: [CWE-200](https://cwe.mitre.org/data/definitions/200.html))\n\ngraphw00f supports detecting and fingerprinting GraphQL servers that make use of either GET or POST-based querying.\n\n\n# Detections\ngraphw00f currently attempts to discover the following GraphQL engines:\n* Graphene - Python\n* Ariadne - Python\n* Apollo - TypeScript\n* graphql-go - Go\n* gqlgen - Go\n* WPGraphQL - PHP\n* GraphQL API for Wordpress - PHP\n* Gato GraphQL - PHP\n* graphql-ruby - Ruby\n* graphql-php - PHP\n* Hasura - Haskell\n* HyperGraphQL - Java\n* graphql-java - Java\n* Juniper - Rust\n* Sangria - Scala\n* Flutter - Dart\n* Diana.jl - Julia\n* Strawberry - Python\n* Tartiflette - Python\n* Dgraph - JavaScript\n* Directus - TypeScript\n* AWS AppSync\n* GraphQL Yoga - TypeScript\n* Lighthouse - PHP\n* Agoo - Ruby\n* Mercurius - JavaScript\n* morpheus-graphql - Haskell\n* Lacinia - Clojure\n* Caliban - Scala\n* jaal - Golang\n* absinthe-graphql - Elixir\n* GraphQL.NET - Microsoft .NET\n* pg_graphql - Rust\n* tailcall - Rust\n* Hot Chocolate - Microsoft .NET \n* Inigo - Go\n* ballerina-graphql - Ballerina\n\n# GraphQL Threat Matrix\nThe graphw00f project uses the [GraphQL Threat Matrix Project](https://github.com/nicholasaleks/graphql-threat-matrix/) as its technology security matrix database. When graphw00f successfully fingerprints a GraphQL endpoint, it will print out the threat matrix document. This document helps security engineers to identify how mature the technology is, what security features it offers, and whether it contains any CVEs.\n\n![GraphQL Threat Matrix](/static/threat-matrix.png?raw=true \"GraphQL Threat Matrix\")\n\n# Prerequisites\n* python3\n* requests\n\n# Installation\n## Clone Repository\n`git clone https://github.com/dolevf/graphw00f.git`\n\n## Run graphw00f\n```\nUsage: main.py -d -f -t http://example.com\n\nOptions:\n  -h, --help            show this help message and exit\n  -r, --noredirect      Do not follow redirections given by 3xx responses\n  -t URL, --target=URL  target url with the path\n  -f, --fingerprint     fingerprint mode\n  -d, --detect          detect mode\n  -p PROXY, --proxy=PROXY\n                        HTTP(S) proxy URL in the form\n                        http://user:pass@host:port\n  -T TIMEOUT, --timeout=TIMEOUT\n                        Request timeout in seconds\n  -o OUTPUT_FILE, --output-file=OUTPUT_FILE\n                        Output results to a file (CSV)\n  -l, --list            List all GraphQL technologies graphw00f is able to\n                        detect\n  -u USERAGENT, --user-agent=USERAGENT\n                        Custom user-agent to use (overrides the one from\n                        headers configuration)\n  -H HEADER, --header=HEADER\n                        Custom headers to send (e.g. \"Authorization: Bearer\n                        ey...\").\n  -w WORDLIST, --wordlist=WORDLIST\n                        Path to a list of custom GraphQL endpoints\n  -v, --version         Print out the current version and exit.\n```\n\n# Configuration\nThere aren't a whole lot of configurations required for graphw00f. But, if you need things like Authorization headers or Cookies set for a particular endpoint, use the `conf.py` file.\n\n```\n# Custom Headers\nHEADERS = {'User-Agent':'graphw00f'}\n\n# Custom Cookies\nCOOKIES = {\"PHPSESS\":\"DEADBEEF\"}\n```\n\nUsing `--user-agent` adds `User-Agent` key regardless if `conf.py` file has it, if the file already has one, command-line parameter overrides it.\n\n# Example\n## Fingerprinting GraphQL\nThis is an example how to fingerprint (`-f`) an endpoint where GraphQL's location is known ahead of time (`/graphql`)\n\n```\npython3 main.py -f -t https://demo.hypergraphql.org:8484/graphql\n\n                +-------------------+\n                |     graphw00f     |\n                +-------------------+\n                  ***            ***\n                **                  ***\n              **                       **\n    +--------------+              +--------------+\n    |    Node X    |              |    Node Y    |\n    +--------------+              +--------------+\n                  ***            ***\n                     **        **\n                       **    **\n                    +------------+\n                    |   Node Z   |\n                    +------------+\n\n                graphw00f - v1.0.7\n          The fingerprinting tool for GraphQL\n           Dolev Farhi \u003cdolev@lethalbit.com\u003e\n\n[*] Checking if GraphQL is available at https://demo.hypergraphql.org:8484/graphql...\n[*] Found GraphQL...\n[*] Attempting to fingerprint...\n[*] Discovered GraphQL Engine: (HyperGraphQL)\n[!] Attack Surface Matrix: https://github.com/dolevf/graphw00f/blob/main/docs/hypergraphql.md\n[!] Technologies: Java\n[!] Homepage: https://www.hypergraphql.org\n[*] Completed.\n```\n\n## Detecting and Fingerprinting GraphQL\nThis is an example how graphw00f can detect (`-d`) where GraphQL lives and then execute the fingerprinting process (`-f`).\n\n```\npython3 main.py -f -d -t http://localhost:5000\n\n                +-------------------+\n                |     graphw00f     |\n                +-------------------+\n                  ***            ***\n                **                  ***\n              **                       **\n    +--------------+              +--------------+\n    |    Node X    |              |    Node Y    |\n    +--------------+              +--------------+\n                  ***            ***\n                     **        **\n                       **    **\n                    +------------+\n                    |   Node Z   |\n                    +------------+\n\n                graphw00f - v1.1.2\n          The fingerprinting tool for GraphQL\n           Dolev Farhi \u003cdolev@lethalbit.com\u003e\n\n[*] Checking http://dvga.example.local:5000/graphql\n[!] Found GraphQL at http://dvga.example.local:5000/graphql\n[*] Attempting to fingerprint...\n[*] Discovered GraphQL Engine: (Graphene)\n[!] Attack Surface Matrix: https://github.com/nicholasaleks/graphql-threat-matrix/blob/master/implementations/graphene.md\n[!] Technologies: Python\n[!] Homepage: https://graphene-python.org\n[*] Completed.\n```\n\n# Support and Issues\nAny issues with graphw00f such as false positives, inaccurate detections, bugs, etc. please create a GitHub issue with environment details.\n\n# Resources\nWant to learn more about GraphQL? head over to my other project and hack GraphQL away: [Damn Vulnerable GraphQL Application](https://github.com/dolevf/Damn-Vulnerable-GraphQL-Application/)\n","funding_links":[],"categories":["Weapons","Tools","Python","Recon","Offensive Security"],"sub_categories":["Tools","Technologies","Discovery"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdolevf%2Fgraphw00f","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdolevf%2Fgraphw00f","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdolevf%2Fgraphw00f/lists"}