This tool is designed to help bug bounty hunters and penetration testers detect GraphQL endpoints within a specified URL. It goes through multiple steps to ensure the identification of GraphQL endpoints and schema. Below are the steps followed by the tool:
- Brute force all endpoints to find the GraphQL endpoint.
- Tries the introspection query to find the schema.
- If introspection is disabled, it attempts a GET query to find the schema.
- If the GET query doesn't work, it tries URL Encoding.
- Allows users to check common mutations once a valid GraphQL endpoint is detected. and displays the results of the mutation checks at the end.
Make sure you have Python 3.x installed. Use the following command to run the script:
pip install requirements.txt
python graphypy.py URL
Note: You might need to install the necessary Python packages specified in the requirements file before running the script.
If you find any issues in the tool, Feel free to create an issue here
Feel free to contribute and enhance the tool for better functionality and broader use cases.