Pentesting GraphQL Applications

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

PENTESTING
GRAPHQL APPLICATIONS
Neelu Tripathy
Presented @ bSides Delhi & c0c0n 2018
1

▪ NotSoSecure Global Services
Limited
▪ 8+ years of InfoSec experience
▪ Speaker / Trainer : c0c0n, NullCon,
BlackHat 2017...

WHY?
01
How it
works
02
Pentesting
GQL
03
GQL
Security
04
GQLParser
& Scanner
05
Way
Forward
06
3

Rest
❑Data intensive per end point
❑Multiple API end points needed
❑Leads to Over fetching or Under
fetching
GraphQL
❑Flex...

❑Started 2011: Facebook
❑ Lee Byron, Nick Schrock
❑Usage
❑Made public in 2015
❑multiple interior endpoints to
a single for...

6
Multiple
language
support
Source:Npmjs.com

Source: www.howtographql.com
GQL Server with
Connected Database
GQLHybridArchitecture
7

8
type Query {
hero: Character
}
type Character {
id: ID!
name: String
friends: [Character]
homeWorld: Planet
species: Spe...

9
Query:
{
hero(id: “1q2w3e”){
name
friends {
homeworld{
name
climate
}
species {
name
lifespan
}
}
}
}

Mutation:
{
createHero(name:
"Lucas2") {
id
name
}
}
10

newHero
user1
user2
user4
user3
11
Subscription:
subscription {
newHero {
id
name
}
}
N
o
t
i
f
i
c
a
t
i
o
n

Pentesting Approach to GraphQL Applications
12

❑Strong Type System
❑Langsec
❑Lexing, Parsing,
Matching
❑Abstract Syntax Tree
13
LangSec
Input
Handling
Code
Input lang
Pr...

S
T
R
O
N
G
T
Y
P
E
S
Y
S
T
E
M 14

SQL Backend
▪ Unless it fails:
▪ Validation in Type
System(Schema)
▪ Resolver needs to sanitize
variables
15

${ users(search: "{"username": {"$regex": "sue"}, "email": {"$regex": "sue"}}", options: "{"skip": 0, "limit": 10}") { _id ...$

${ users(search: "{"email": {"$gte": ""}}", options: "{"skip": 0, "limit": 10}") { _id username fullname email } } { users(...$

18
QUERY STRUCTURE

19
DATA TYPE

▪ Affecting express-graphql package,
versions <0.4.11 >=0.4.0
var marked =
require('marked');
console.log(marked('<script>...

▪ Queries
❑Adding privileged
parameters, id values, key,
tokens to input params
❑Fetch more with unused
output params
▪ Mu...

22
How Not to do Authorization Correct Method

23
▪ /graphql
▪ /graphqlBatch
▪ /graphql.php
▪ /graphiql
▪ /graphql/console/
▪ /graphql.php?debug=
1
▪ Try other Ports for...

I
N
T
R
O
S
P
E
C
T
I
O
N
24

❑Error Verbosity, Stack Trace,
Exceptions
❑GraphQL, Client Errors
❑Error Policy:
▪ None
▪ Ignore
▪ All
❑Standard Response ...

❑Authentication
❑Authorization(GQLVs Biz Logic)
❑Error Handling
❑Tampering?(Injections, XSS, others)
❑Information Exposure...

C
i
r
c
u
l
a
r
a
n
d
N
e
s
t
e
d
Q
u
e
r
i
e
s
28

Best Practices: Implementation
❑Nullability
❑Pagination(Amount Limiting)
❑Server-Side Batching & Caching
❑Query Complexity...

30
{
"scripts": {
"postbuild": "persistgraphql src
api/query-whitelist.json"
}
}
import depthLimit from 'graphql-depth-lim...

33
ISSUES WHEN PENTESTING GRAPHQL

BEFORE 35

DEMO
GQLPARSER
&
SCANNER
A BURP SUITE
EXTENSION
36

Python Based Extension:
GQLParser
Loading in Burp Suite
37

▪ Extension Detects, Parses
GraphQL data
▪ Dynamic Input Fields presented
for testing and editing
▪ Integrates with Scanne...

AFTER
39
40
35
22
-5
0
5
10
15
20
0 2 4 6 8 10
NumberofAttackVectors
Injection Points
Percent of HTTP 400s

40
AUTOMATION >
OPTIMIZATION
CORE GRAPHQL ISSUES
SECURE IMPLEMENTATION

41
▪ http://graphql.org/
▪ https://www.howtographql.com/
▪ https://blog.graph.cool/
▪ https://github.com/rm3l/docker-api-g...