graphql_get.yaml

id: graphql-get

info:
  name: Graphql Get
  author: panch0r3d
  severity: info

requests:
  - method: GET
    path:
      - "{{BaseURL}}/graphql-devtools"
      - "{{BaseURL}}/graphql"
      - "{{BaseURL}}/graphql/v1"
      - "{{BaseURL}}/v1/graphql"
      - "{{BaseURL}}/lol/graphql"
      - "{{BaseURL}}/lol/graphql/v1"
      - "{{BaseURL}}/api/graphql/v1"
      - "{{BaseURL}}/portal-graphql"
      - "{{BaseURL}}/graphiql"
      - "{{BaseURL}}/graphql?query=query{%20__schema%20{%20types%20{%20name%20}%20}%20}"
      - "{{BaseURL}}/graphql-playground"
      - "{{BaseURL}}/laravel-graphql-playground"
      - "{{BaseURL}}/query-explorer"
      - "{{BaseURL}}/sphinx-graphiql"
      - "{{BaseURL}}/graphql/console"
      - "{{BaseURL}}/graphql.php"
      - "{{BaseURL}}/express-graphql"
      - "{{BaseURL}}/query"
      - "{{BaseURL}}/HyperGraphQL"
      - "{{BaseURL}}/graphql/graphql-playground"
      - "{{BaseURL}}/graphql-playground-html"
      - "{{BaseURL}}/graph_cms"
      - "{{BaseURL}}/query-api"
      - "{{BaseURL}}/api/cask/graphql-playground"
      - "{{BaseURL}}/graphql-console"
      - "{{BaseURL}}/query-laravel"
    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200
      - type: regex
        regex:
          - "(Query |QUERY |query ).*?"
          - "(Graph|GRAPH|graph).*?"
          - "__schema"
          - "(Introspection|INTROSPECTION|introspection).*?"
          - ".*?operation not found.*?"
        part: body