19 |
22 | {children}
23 |
24 | );
25 | };
26 |
27 | export default ModalAccordion;
28 |
--------------------------------------------------------------------------------
/src/__tests__/api-backend.js:
--------------------------------------------------------------------------------
1 | // import request from 'supertest';
2 | // import server from '../../server/server';
3 |
4 | test('should return empty array when no test are selected', async () => {
5 | // const payload = {
6 | // API: 'https://swapi-graphql.netlify.app/.netlify/functions/index',
7 | // tests: [],
8 | // };
9 |
10 | // const response = await request(server).post('/api/runpentest').send(payload);
11 | // expect(response.body).toEqual([]);
12 | });
13 |
14 | test('should return status code 200 when tests are submitted', async () => {
15 | // const payload = {
16 | // API: 'https://example.com/graphql',
17 | // tests: ['Batching', 'Circular'],
18 | // };
19 |
20 | // const response = await request(server).post('/api/runpentest').send(payload);
21 | // expect(response.statusCode).toBe(200);
22 | });
23 |
--------------------------------------------------------------------------------
/.eslintrc.cjs:
--------------------------------------------------------------------------------
1 | module.exports = {
2 | root: true,
3 | env: { browser: true, es2021: true },
4 | extends: [
5 | 'airbnb-typescript',
6 | 'eslint:recommended',
7 | 'plugin:@typescript-eslint/recommended',
8 | 'plugin:react-hooks/recommended',
9 | 'prettier'
10 | ],
11 | ignorePatterns: ['dist', '.eslintrc.cjs'],
12 | parser: '@typescript-eslint/parser',
13 | plugins: ['react-refresh','react','import',"prettier"],
14 | parserOptions: {
15 | project: './tsconfig.json', //can delete later not sure what it does
16 | },
17 | rules: {
18 | 'react/jsx-filename-extension': [1, { extensions: ['.jsx', '.tsx'] }],
19 | 'react-refresh/only-export-components': [
20 | 'warn',
21 | { allowConstantExport: true },
22 | ],
23 | "@typescript-eslint/no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
24 | "no-loop-func": "off",
25 | },
26 | }
27 |
--------------------------------------------------------------------------------
/tsconfig.json:
--------------------------------------------------------------------------------
1 | {
2 | "compilerOptions": {
3 | "target": "ES2020",
4 | "useDefineForClassFields": true,
5 | "lib": ["ES2020", "DOM", "DOM.Iterable"],
6 | "module": "ESNext",
7 | "esModuleInterop": true,
8 | "skipLibCheck": true,
9 |
10 | /* Bundler mode */
11 | "moduleResolution": "bundler",
12 | "allowImportingTsExtensions": true,
13 | "resolveJsonModule": true,
14 | "isolatedModules": true,
15 | "noEmit": true,
16 | "jsx": "react-jsx",
17 |
18 | /* Linting */
19 | "strict": true,
20 | "noUnusedLocals": false /* change to true after development */,
21 | "noUnusedParameters": false /* change to true after development */,
22 | "noFallthroughCasesInSwitch": true
23 | },
24 | "include": ["src", "server/**/*"],
25 | "exclude": ["node_modules", "dist", "build"],
26 | "references": [{ "path": "./tsconfig.node.json" }],
27 | "ts-node": {
28 | "esm": true,
29 | }
30 | }
31 |
--------------------------------------------------------------------------------
/src/components/statusIconRenderer.tsx:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 | import '../stylesheets/ag-theme-custom.scss';
3 |
4 | interface InitParams {
5 | data: {
6 | status: string;
7 | };
8 | }
9 |
10 | export class StatusIcons {
11 |
12 | eGui: HTMLElement | null = null
13 | init(params: InitParams) {
14 | const element = document.createElement('span');
15 | const imageElement = document.createElement('img');
16 | if (params.data.status === 'Fail') {
17 | imageElement.src = '../src/assets/cross.png';
18 | imageElement.alt = 'red x indicating status failed';
19 | imageElement.className = 'ag-status-icons';
20 | } else {
21 | imageElement.src = '../src/assets/tick.png';
22 | imageElement.alt = 'green check indicating status passed';
23 | imageElement.className = 'ag-status-icons';
24 | }
25 | element.appendChild(imageElement);
26 | this.eGui = element;
27 | }
28 |
29 | getGui(): HTMLElement | null {
30 | return this.eGui;
31 | }
32 | }
--------------------------------------------------------------------------------
/src/stylesheets/_variables.scss:
--------------------------------------------------------------------------------
1 | /* reset default styles */
2 |
3 | //Sass variables
4 |
5 | // Other colors
6 | $red: rgb(232, 28, 38);
7 | $white: rgb(255, 255, 255);
8 | $black: rgb(0, 0, 0);
9 | $purple: rgba(112, 8, 128, 0.5);
10 |
11 | // AG Colors
12 | $green: rgb(143, 217, 168);
13 | $red: rgb(232, 28, 38);
14 |
15 | $row-fail-color: rgba($red, 0.1);
16 | $row-pass-color: rgba($green, 0.2);
17 |
18 | // Color Palette
19 | $primary-color: rgb(75, 119, 141);
20 | $secondary-color: rgb(40, 181, 181);
21 | $tertiary-color: rgb(143, 217, 168);
22 | $quatenary-color: rgb(210, 230, 156);
23 | $seventy-color: rgba($primary-color, 0.7);
24 | $fifty-color: rgba($primary-color, 0.5);
25 | $thirty-color: rgba($primary-color, 0.3);
26 | $ten-color: rgba($primary-color, 0.1);
27 | $five-color: rgba($primary-color, 0.05);
28 |
29 | // Colors for specific elements
30 | $background-color: rgba(208, 204, 204, 0.441);
31 | $slider-color: rgb(173, 172, 172);
32 | $slider-color-selected: rgb(65, 105, 225, 0.42);
33 | // $slider-color-selected: $green;
34 | $border-color: rgb(121, 118, 118);
35 |
--------------------------------------------------------------------------------
/server/functionsAndInputs/types.ts:
--------------------------------------------------------------------------------
1 | import { RequestHandler } from "express";
2 |
3 | export type PentestType = {
4 | generateQueries: RequestHandler;
5 | attack: RequestHandler;
6 | };
7 | export interface GraphQLType {
8 | name: string;
9 | kind: string;
10 | fields?: GraphQLField[];
11 | }
12 | export interface GraphQLField {
13 | name: string;
14 | args?: GraphQLArgs[];
15 | type: GraphQLTypeReference;
16 | fields?: GraphQLField;
17 | }
18 | export interface GraphQLArgs {
19 | name: string;
20 | type?: GraphQLTypeReference;
21 | }
22 | export interface GraphQLTypeReference {
23 | kind: string;
24 | name?: string;
25 | ofType?: GraphQLTypeReference;
26 | fields?: GraphQLField[];
27 | }
28 | export interface QueryResult {
29 | id: string;
30 | status: string;
31 | title: string;
32 | details: {
33 | error?: string;
34 | query: string;
35 | response: string;
36 | description: string;
37 | solution: string;
38 | link: string;
39 | }
40 | severity: string | number;
41 | testDuration: string | number;
42 | lastDetected: string | number;
43 | }
44 |
--------------------------------------------------------------------------------
/src/components/Checkbox.tsx:
--------------------------------------------------------------------------------
1 | /**
2 | * ************************************
3 | *
4 | * @module Checkbox.tsx
5 | * @author MADR Productions - MK
6 | * @date 01-13-24
7 | * @description This file defines a React functional component called Checkbox, which represents a checkbox element with associated properties like value, label, and description.
8 | *
9 | * ************************************
10 | */
11 | import React from 'react';
12 |
13 | interface ICheckboxProps {
14 | value: string;
15 | label: string;
16 | description: string;
17 | isChecked: boolean;
18 | onChange: (value: string, isChecked: boolean) => void;
19 | }
20 |
21 | const Checkbox: React.FC
31 |
35 |
38 |
39 | );
40 | };
41 |
42 | export default Checkbox;
--------------------------------------------------------------------------------
/server/functionsAndInputs/query.ts:
--------------------------------------------------------------------------------
1 | import { QueryResult } from './types';
2 | export function createQueryResult(
3 | category: string,
4 | query: string,
5 | ID: number,
6 | ): QueryResult {
7 | return {
8 | id: `${category}-${ID}`,
9 | status: 'Pass',
10 | title: '',
11 | details: {
12 | query: query,
13 | response: '',
14 | description: '',
15 | solution: '',
16 | link: '',
17 | },
18 | severity: 'P1',
19 | testDuration: '',
20 | lastDetected: `${new Date().toLocaleTimeString('en-GB')} - ${new Date()
21 | .toLocaleDateString('en-GB')
22 | .split('/')
23 | .reverse()
24 | .join('-')}`,
25 | };
26 | }
27 | export function createErrorResult(
28 | category: string,
29 | query: string,
30 | ID: number,
31 | ): QueryResult {
32 | return {
33 | id: `${category}-${ID}`,
34 | status: 'Error',
35 | title: 'Failed to Run Test',
36 | details: {
37 | query: '',
38 | response: '',
39 | description: '',
40 | solution: '',
41 | link: '',
42 | },
43 | severity: 'P1',
44 | testDuration: '',
45 | lastDetected: `${new Date().toLocaleTimeString('en-GB')} - ${new Date()
46 | .toLocaleDateString('en-GB')
47 | .split('/')
48 | .reverse()
49 | .join('-')}`,
50 | };
51 | }
52 |
--------------------------------------------------------------------------------
/server/functionsAndInputs/inputsAndKeywords.ts:
--------------------------------------------------------------------------------
1 | export const SQLInputs = [
2 | // Boolean Based SQL Injection
3 | "' OR 1 = 1; --",
4 | "1' OR '1' = '1 /*",
5 | "admin' OR '1'='1'--",
6 |
7 | // Error Based SQL Injection
8 | "'",
9 | ';',
10 | '--',
11 |
12 | // Time-Based Blind SQL Injection
13 | '; SELECT SLEEP(15) --', // MySQL, MariaDB
14 | '; SELECT pg_sleep(15); --', // PostgreSQL
15 | "; IF (1=1) WAITFOR DELAY '00:00:15'--", // Another example for MySQL
16 | ];
17 | export const sqlErrorKeywords = [
18 | 'syntax error',
19 | 'unexpected',
20 | 'mysql_fetch',
21 | 'invalid query',
22 | ];
23 | export const batchingErrorKeywords: string[] = [
24 | 'too many operations',
25 | 'batch size exceeds',
26 | 'operation limit',
27 | 'query complexity exceeds',
28 | 'rate limit exceeded',
29 | 'throttle',
30 | 'unauthorized batch request',
31 | 'unexpected token',
32 | 'batching not supported',
33 | 'anonymous operation',
34 | 'must be the only defined operation',
35 | 'batch',
36 | 'rate limit',
37 | 'server error',
38 | 'api limit exceeded',
39 | ];
40 | export const verboseErrorKeywords: string[] = [
41 | 'did you mean ',
42 | 'syntax error graphql',
43 | 'expected',
44 | 'found',
45 | 'is required',
46 | 'not provided',
47 | 'argument',
48 | 'sub selection',
49 | ];
50 |
--------------------------------------------------------------------------------
/public/vite.svg:
--------------------------------------------------------------------------------
1 |
--------------------------------------------------------------------------------
/src/__tests__/misc.js:
--------------------------------------------------------------------------------
1 | import React from 'react';
2 | import '@testing-library/jest-dom';
3 | import { render, screen, waitFor } from '@testing-library/react';
4 | import userEvent from '@testing-library/user-event';
5 | import SecurityDashboard from '../components/SecurityDashboard';
6 |
7 | jest.mock('react-modal', () => ({
8 | ...jest.requireActual('react-modal'),
9 | setAppElement: () => {},
10 | }));
11 |
12 | global.fetch = jest.fn(() =>
13 | Promise.resolve({
14 | ok: true,
15 | json: () => Promise.resolve([]),
16 | }),
17 | );
18 |
19 | beforeEach(() => {
20 | fetch.mockClear();
21 | });
22 |
23 | test('Dashboard initally renders config form and not result or loading screen', () => {
24 | render(
56 |
90 | );
91 | };
92 |
93 | export default SecurityDashboard;
94 |
--------------------------------------------------------------------------------
/server/pentesting/getSchema.ts:
--------------------------------------------------------------------------------
1 | /**
2 | * ************************************
3 | *
4 | * @module getSchema.ts
5 | * @author MADR Productions - AY
6 | * @date 9-23-23
7 | * @description middleware for all tests to generate introspection query to acquire schema for generating other queries.
8 | *
9 | * ************************************
10 | */
11 |
12 | import { Request, Response } from 'express';
13 |
14 | const getSchema = async (req: Request, res: Response) => {
15 | const fetchModule = await import('node-fetch');
16 | const fetch = fetchModule.default;
17 |
18 | const query = `query IntrospectionQuery {
19 | __schema {
20 | queryType {
21 | name
22 | }
23 | mutationType {
24 | name
25 | }
26 | subscriptionType {
27 | name
28 | }
29 | types {
30 | ...FullType
31 | }
32 | directives {
33 | name
34 | description
35 | args {
36 | ...InputValue
37 | }
38 | }
39 | }
40 | }
41 |
42 | fragment FullType on __Type {
43 | kind
44 | name
45 | description
46 | fields(includeDeprecated: true) {
47 | name
48 | description
49 | args {
50 | ...InputValue
51 | }
52 | type {
53 | ...TypeRef
54 | }
55 | isDeprecated
56 | deprecationReason
57 | }
58 | inputFields {
59 | ...InputValue
60 | }
61 | interfaces {
62 | ...TypeRef
63 | }
64 | enumValues(includeDeprecated: true) {
65 | name
66 | description
67 | isDeprecated
68 | deprecationReason
69 | }
70 | possibleTypes {
71 | ...TypeRef
72 | }
73 | }
74 |
75 | fragment InputValue on __InputValue {
76 | name
77 | description
78 | type {
79 | ...TypeRef
80 | }
81 | defaultValue
82 | }
83 |
84 | fragment TypeRef on __Type {
85 | kind
86 | name
87 | ofType {
88 | kind
89 | name
90 | ofType {
91 | kind
92 | name
93 | ofType {
94 | kind
95 | name
96 | }
97 | }
98 | }
99 | }`;
100 | try {
101 | console.log('Executing Introspection Query...');
102 | const API = req.body.API;
103 | const response = await fetch(API, {
104 | method: 'POST',
105 | headers: {
106 | 'Content-Type': 'application/graphql',
107 | },
108 | body: query,
109 | });
110 |
111 | const result: any = await response.json();
112 | res.locals.schema = result;
113 | console.log('Retrieved Schema...');
114 | return;
115 | } catch (err) {
116 | console.log('getSchema middleware', err);
117 | res
118 | .status(400)
119 | .json('Unable to retrieve schema, please turn introspection on ');
120 | }
121 | };
122 |
123 | export default getSchema;
124 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | FortifyQL is a sophisticated security scanning tool designed to provide developers with deep insights into potential security vulnerabilities within their GraphQL API's. FortifyQL dynamically generates queries that emulate common attacks identified by the Open Web Application Security Project (OWASP). The responses are analyzed for insecure default configurations and missing security measures that may lead to Injection, Denial of Service (DOS), and Batching attacks. The data is displayed within an intuitive and user-friendly interface, making it accessible to developers of all skill levels.
2 |
3 | Let's further explore FortifyQL's initial robust test suites.
4 |
5 | ## Table of Contents
6 |
7 | 1. [Features](##Features)
8 | 2. [Setup](##Setup)
9 | 3. [Roadmap](##Roadmap)
10 | 4. [Contributors](##Contributors)
11 |
12 | ## Features:
13 |
14 | • SQL Injection (Boolean, Error, and Time-based): These tests check for vulnerabilities in different types of database systems, using various injection techniques to expose weaknesses.
15 |
16 | • Denial of Service (DoS: Circular): This test simulates a circular DoS-type attack, rendering a system unresponsive through excessive resource consumption.
17 |
18 | • Batching (Multiple Queries and Resource Exhaustive/Nested): Batching and nesting tests aim to uncover resource exhaustion and complex operations that could harm your server.
19 |
20 | • Verbose Error: This test identifies security misconfigurations by exposing excessive system information.
21 |
22 | 
23 |
24 | ## Setup:
25 |
26 | 1. Clone the FortifyQL repository locally and install required modules:
27 |
28 | ```bash
29 | npm install
30 | ```
31 | 2. Launch FortifyQL from the command line:
32 | -`npm run dev`: Runs frontend and backend development servers concurrently for an integrated development experience.
33 |
34 | 3. Enable introspection for GraphQL endpoint.
35 |
36 | 4. Navigate to http://localhost:5173/ to view web application
37 |
38 | 5. Input GraphQL URI into input field
39 |
40 | 6. Toggle desired tests to execute
41 |
42 |
43 | ## Roadmap
44 | | Feature | Status |
45 | | ------------------------------------------------ | ------ |
46 | | Dynamic Query Generation | ✅ |
47 | | In-Depth Reporting | ✅ |
48 | | Increase Testing Coverage | ⏳ |
49 | | Expansion of Pentesting Suite | ⏳ |
50 | | Introspection and URI Authentication | ⏳ |
51 | | Node and Rate Limit Calculator | ⚡️ |
52 |
53 |
54 | - ✅ = Completed
55 | - ⏳ = In-Progress
56 | - ⚡️ = Backlog
57 |
58 | ## Contributors
59 |
60 | • Rachel Power: [LinkedIn](https://www.linkedin.com/in/rachel-b-power/) | [GitHub](https://github.com/rpower15)
61 |
62 | • Ayden Yip: [LinkedIn](https://www.linkedin.com/in/aydenyip/) | [GitHub](https://github.com/aydenyipcs)
63 |
64 | • Megan Kabat: [LinkedIn](https://www.linkedin.com/in/megan-kabat/) | [GitHub](https://github.com/mnkabat)
65 |
66 | • David Yoon: [LinkedIn](https://www.linkedin.com/in/davidlyoon/) | [GitHub](https://github.com/DYoonity)
67 |
68 |
69 |
70 |
--------------------------------------------------------------------------------
/src/components/ModalCellRender.tsx:
--------------------------------------------------------------------------------
1 | import React, { useEffect, useState } from 'react';
2 | import Modal from 'react-modal';
3 | import { ITestResult } from '../interfaces/results';
4 | import { prettifyJson, prettyPrintGraphQL } from '../utils/format';
5 | import ModalAccordion from './ModalAccordion';
6 |
7 | interface IModalCellRendererProps {
8 | isModalOpen: boolean;
9 | setIsModalOpen: React.Dispatch
57 | 
62 |
66 | {showConfigForm ? (
67 |
62 | 63 | FortifyQL 64 |
65 |
70 | {loading ? (
71 |
88 | )}
89 |
72 |
81 | ) : (
82 | Scanning...
73 |
47 |
48 | {isModalOpen && (
49 |
54 |
95 | )}
96 |
97 | );
98 | };
99 |
100 | export default ModalCellRenderer;
101 |
--------------------------------------------------------------------------------
/server/server.ts:
--------------------------------------------------------------------------------
1 | /**
2 | * ************************************
3 | *
4 | * @module server.ts
5 | * @author MADR Productions - AY
6 | * @date 9-21-23
7 | * @description server for FortifyQL
8 | *
9 | * ************************************
10 | */
11 |
12 | import express, { Request, Response, NextFunction } from 'express';
13 | // import path from 'path'
14 | import cors from 'cors';
15 |
16 | const server = express();
17 | const PORT = 3000;
18 |
19 | // REQUIRED ROUTES && MIDDLEWARE
20 | import getSchema from './pentesting/getSchema.ts';
21 | import { injection } from './pentesting/injection.ts';
22 | import { batching } from './pentesting/batching.ts';
23 | import { verboseError } from './pentesting/verboseError.ts';
24 | import { circularQuery } from './pentesting/circularQuery.ts';
25 | import { ITestResult } from '../src/interfaces/results.ts';
26 |
27 | // Use cors
28 | server.use(cors());
29 |
30 | // PARSE JSON
31 | server.use(express.urlencoded({ extended: true }));
32 | server.use(express.json());
33 |
34 | //GLOBAL ROUTE CHECK
35 | server.use((req, _res, next) => {
36 | console.log('Request received', req.method, req.path, req.body);
37 | return next();
38 | });
39 | //PATHS
40 | server.use('/api/runpentest', async (req: Request, res: Response) => {
41 | try {
42 | console.log('Starting Penetration Testing...');
43 | await getSchema(req, res);
44 |
45 | const testsMap: {
46 | [key: string]: { generate: Function; evaluate: Function };
47 | } = {
48 | SQL: {
49 | generate: injection.generateQueries,
50 | evaluate: injection.attack,
51 | },
52 | Verbose: {
53 | generate: verboseError.generateQueries,
54 | evaluate: verboseError.attack,
55 | },
56 | Circular: {
57 | generate: circularQuery.generateQueries,
58 | evaluate: circularQuery.attack,
59 | },
60 | Batching: {
61 | generate: batching.generateQueries,
62 | evaluate: batching.attack,
63 | },
64 | };
65 |
66 | const results: ITestResult[] = [];
67 |
68 | const runTest = async (test: string) => {
69 | if (req.body.tests.includes(test)) {
70 | await testsMap[test].generate(req, res);
71 | const testResult = await testsMap[test].evaluate(req, res);
72 | results.push(...testResult);
73 | }
74 | };
75 |
76 | const runAllTests = async () => {
77 | console.log('running all tests');
78 | await Promise.all(Object.keys(testsMap).map(runTest));
79 | };
80 |
81 | await runAllTests();
82 | console.log('sending response');
83 | return res.status(200).json(results);
84 | } catch (err) {
85 | return res.status(400).json('error running tests');
86 | }
87 | });
88 |
89 | // GLOBAL ERROR HANDLER
90 | interface CustomError {
91 | log?: string;
92 | status?: number;
93 | message?: {
94 | err: string;
95 | };
96 | }
97 |
98 | server.use(
99 | (err: CustomError, _req: Request, res: Response, _next: NextFunction) => {
100 | const defaultErr = {
101 | log: 'Express error handler caught unknown middleware error',
102 | status: 500,
103 | message: { err: 'An error occurred' },
104 | };
105 |
106 | const errorObj = { ...defaultErr, ...err };
107 | console.log(errorObj.log);
108 | return res.status(errorObj.status).json(errorObj.message);
109 | },
110 | );
111 |
112 | server.listen(PORT, () => console.log(`Listening on port ${PORT}`));
113 |
114 | export default server;
--------------------------------------------------------------------------------
/src/components/ScanResultsTable.tsx:
--------------------------------------------------------------------------------
1 | import { useState, useMemo } from 'react';
2 | import { AgGridReact } from 'ag-grid-react';
3 | import { ColDef, GridApi, RowClassParams } from 'ag-grid-community';
4 | import 'ag-grid-community/styles/ag-grid.css';
5 | import 'ag-grid-community/styles/ag-theme-alpine.css';
6 | import '../stylesheets/ag-theme-custom.scss';
7 | import ModalCellRenderer from './ModalCellRender';
8 | import { ITestResult } from '../interfaces/results';
9 | import { StatusIcons } from './statusIconRenderer';
10 |
11 | interface IResultsTableProps {
12 | resultsData: ITestResult[];
13 | handleDisplayTestConfig: () => void;
14 | }
15 |
16 | const ScanResultsTable: React.FC
55 |
60 |
94 | 61 | {modalData.title} 62 |
63 | 64 |
65 |
69 |
75 |
77 |
81 | {isError && (
82 |
93 | Description:
66 |{modalData.details.description}
67 |Query:
68 |
70 |
71 | {prettyPrintGraphQL(modalData.id, modalData.details.query)}
72 |
73 |
74 | Response:
76 |
78 | {prettifyJson(modalData.details.response)}
79 |
80 |
83 |
86 | )}
87 | Issue Detected:
84 |{data.details.error}
85 |Solution:
88 |{modalData.details.solution}
89 | 90 | {modalData.details.link}{' '} 91 | 92 |
88 |
110 | );
111 | };
112 |
113 | export default ScanResultsTable;
114 |
--------------------------------------------------------------------------------
/src/utils/format.ts:
--------------------------------------------------------------------------------
1 | /**
2 | * Prettify a JSON object by converting it to a pretty-printed JSON string
3 | * @param json - JSON object to be prettified
4 | * @returns A string containing the pretty-printed JSON representation
5 | */
6 | export const prettifyJson = (json: string): string => {
7 | return JSON.stringify(json, null, 2);
8 | };
9 |
10 | //
11 | /**
12 | *
13 | * Pretty-print GraphQL batching queries by adding line breaks and indentation.
14 | * @param queries - An array of input GraphQL query strings to be formatted.
15 | * @returns A string containing the pretty-printed GraphQL queries.
16 | */
17 | export const prettyPrintGraphQLBatch = (queries: string[]): string => {
18 | // Indentation string (two spaces)
19 | const indent = ' ';
20 | // Initialize the indentation level
21 | let level = 0;
22 | // Initialize the formatted query string
23 | let prettyQuery = '';
24 | // Function to add the current indentation
25 | function addIndent() {
26 | prettyQuery += `${indent.repeat(level)}`;
27 | }
28 | // Loop through each query in the array
29 | queries.forEach((query) => {
30 | // Loop through each character in the query
31 | for (let i = 0; i < query.length; i++) {
32 | const char = query[i];
33 | // When an opening curly brace is encountered, add a line break, increase the indentation level, and add the opening brace
34 | if (char === '{') {
35 | addIndent();
36 | prettyQuery += `{\n`;
37 | level++;
38 | }
39 | // When a closing curly brace is encountered, decrease the indentation level, add a line break, and then close the brace
40 | else if (char === '}') {
41 | level--;
42 | prettyQuery += `\n`;
43 | addIndent();
44 | prettyQuery += `}`;
45 | }
46 | // For all other characters, simply append them to the formatted query
47 | else {
48 | prettyQuery += char;
49 | }
50 | }
51 | // Add a separator line between queries in the batch
52 | prettyQuery += '\n\n';
53 | });
54 | // Remove trailing newlines
55 | prettyQuery = prettyQuery.trimEnd();
56 | // Return the formatted query
57 | return prettyQuery;
58 | };
59 |
60 | /**
61 | * Function to pretty-print a GraphQL query by adding line breaks and indentation.
62 | * @param queryId - Test ID that contains test type to determine what type of pretty print to format
63 | * @param query - The input GraphQL query string to be formatted.
64 | * @returns A string containing the pretty-printed GraphQL query.
65 | */
66 |
67 | export const prettyPrintGraphQL = (
68 | queryId: string,
69 | query: string[] | string,
70 | ): string => {
71 | const queryArray = typeof query === 'string' ? [query] : query;
72 | if (queryId.toLowerCase().includes('batch')) {
73 | return prettyPrintGraphQLBatch(queryArray);
74 | }
75 |
76 | // Indentation string (two spaces)
77 | const indent = ' ';
78 |
79 | // Initialize the indentation level
80 | let level = 0;
81 |
82 | // Initialize the formatted query string
83 | let prettyQuery = '';
84 |
85 | // Loop through each character in the input query
86 | for (let i = 0; i < query.length; i++) {
87 | const char = query[i];
88 |
89 | // When an opening curly brace is encountered, add a line break and increase the indentation level
90 | if (char === '{') {
91 | prettyQuery += `{\n${indent.repeat(++level)}`;
92 | }
93 | // When a closing curly brace is encountered, add a line break and decrease the indentation level, then close the brace
94 | else if (char === '}') {
95 | prettyQuery += `\n${indent.repeat(--level)}}`;
96 | }
97 | // For all other characters, simply append them to the formatted query
98 | else {
99 | prettyQuery += char;
100 | }
101 | }
102 |
103 | // Return the formatted query
104 | return prettyQuery;
105 | };
106 |
--------------------------------------------------------------------------------
/src/components/ScanConfigForm.tsx:
--------------------------------------------------------------------------------
1 | /**
2 | * ************************************
3 | *
4 | * @module ScanConfigForm.tsx
5 | * @author MADR Productions - MK
6 | * @date 01-13-24
7 | * @description This component represents a form for configuring a security scan. It includes input fields for a GraphQL API URI, checkboxes for different scan types, and buttons to submit the form and select all available scan types. The component manages the state of selected tests and the URI textbox.
8 | *
9 | * ************************************
10 | */
11 | import React, { useState, FormEvent } from 'react';
12 | import Checkbox from './Checkbox';
13 |
14 | interface IConfigFormProps {
15 | onScanSubmit: (endpoint: string, tests: string[]) => void;
16 | }
17 |
18 | const ScanConfigForm: React.FCSecurity Scan Results
89 | 90 |
91 |
94 |
97 |
98 |
99 | setGridApi(params.api)}
106 | components={components}
107 | />
108 |
109 |
56 |
94 |
95 | );
96 | };
97 |
98 | export default ScanConfigForm;
--------------------------------------------------------------------------------
/server/info.ts:
--------------------------------------------------------------------------------
1 | export const info = {
2 | "Boolean Based SQL Injection": "A technique where attackers manipulate an application by sending SQL queries that produce true or false outcomes.By observing the application's behavior to these binary results, they can deduce valuable information about the underlying database.",
3 | "BBSQLI Solution": "Utilize parameterized queries or prepared statements to ensure data is securely handled. By doing this, you ensure that user input is always treated as data and not executable code. Regularly review and update your database permissions to limit unnecessary access.",
4 | "Error Based SQL Injection": "Attackers intentionally send erroneous SQL queries to provoke the application into revealing database error messages. These messages can inadvertently expose details about the database structure or other sensitive information.",
5 | "EBSQLI Solution": "Turn off detailed error messages for your production environments and use custom error handling to ensure system-specific details are never exposed to the user. Always use parameterized queries to separate user input from SQL logic.",
6 | "Time-Based Blind SQL Injection": "In this subtle attack, perpetrators submit specific SQL queries and then measure the response time of the application. Extended delays can hint at the validity of the attacker's query, allowing them to piece together database insights over time.",
7 | "TMSQLI Solution": "Along with using parameterized queries, implement input validation using a strict whitelist. Monitor and alert on unusual patterns in database response times which could indicate exploitation attempts.",
8 | "Multiple Identical Batching Attack": "By repeatedly sending the same or similar queries in bulk, attackers aim to either uncover vulnerabilities in the application's handling of batched requests or create disruptions in its operations.",
9 | "MIBA Solution": "Implement rate-limiting to detect and block repeated identical queries from a single source. Utilize web application firewalls (WAFs) to monitor and filter out suspicious patterns in incoming traffic.",
10 | "Resource Exhaustive and Nested Batching Attack": "Attackers craft intricate and nested SQL queries, then send them in large batches. The goal is to overburden the database or application resources, potentially leading to failures or unintentional exposure of information.",
11 | "REANBA Solution": "Analyze and set limits on query depth and complexity. Ensure that your systems can detect nested query patterns and either reject or rate-limit them. Again, WAFs can be useful in filtering out such complex, resource-intensive requests.",
12 | "Verbose Errors": "Errors that provide detailed diagnostic information, often useful for debugging but can reveal system internals, configurations, or other sensitive data when displayed to end users. Attackers can exploit such verbose messages to gain insights into potential vulnerabilities within the system.",
13 | "VE Solution": "Use generic error messages in your production environments. Detailed errors can be logged internally for debugging purposes but should never be displayed to end-users. This prevents attackers from gaining insights from the error outputs.",
14 | "Circular DoS Queries": "Attackers send specially crafted SQL queries that create infinite loops or recursive operations in the database. Such queries can consume extensive server resources, leading to denial of service as the database gets overwhelmed and can't handle other requests.",
15 | "CDQ Solution": "Set reasonable timeouts for database queries. Implement monitoring tools that can detect unusual spikes in resource consumption or endless loop patterns, alerting administrators to potential attacks.",
16 | "INJ-URI": "https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html#injection-prevention",
17 | "VE-URI": "https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html#dont-return-excessive-errors",
18 | "BATCH-URI": "https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html#mitigating-batching-attacks",
19 | "DoS-URI": "https://cheatsheetseries.owasp.org/cheatsheets/GraphQL_Cheat_Sheet.html#dos-prevention"
20 | }
--------------------------------------------------------------------------------
/server/pentesting/batching.ts:
--------------------------------------------------------------------------------
1 | /**
2 | * ************************************
3 | *
4 | * @module batching.ts
5 | * @author MADR Productions - AY
6 | * @date 9-25-23
7 | * @description middleware for server.use('/injection') to generate and send queries to test for SQL injection and evaluate response
8 | *
9 | * ************************************
10 | */
11 |
12 | import { Request, Response } from 'express';
13 | import {
14 | PentestType,
15 | GraphQLType,
16 | QueryResult,
17 | } from '../functionsAndInputs/types.ts';
18 | import {
19 | generateBatchQuery,
20 | generateQueryNested,
21 | } from '../functionsAndInputs/generateHelper.ts';
22 | import {
23 | createQueryResult,
24 | createErrorResult,
25 | } from '../functionsAndInputs/query.ts';
26 | import { batchTitles } from '../functionsAndInputs/titles.ts';
27 | import { batchingErrorKeywords } from '../functionsAndInputs/inputsAndKeywords.ts';
28 | import { info } from '../info.ts';
29 |
30 |
31 | export const batching: PentestType = {
32 | generateQueries: async (req: Request, res: Response) => {
33 | console.log('Generating Batching Queries...');
34 | const schemaTypes: GraphQLType[] = res.locals.schema.data.__schema.types;
35 |
36 | /*
37 | Generates a nested GraphQL query string for selecting subfields
38 | of a given GraphQL type up to a specified maximum depth.
39 | */
40 |
41 | const arrOfQueries: (string | string[])[] = [];
42 | const arrOfNested: string[] = [];
43 |
44 | for (const typeName of ['queryType', 'mutationType']) {
45 | const name: string | null =
46 | res.locals.schema.data.__schema[typeName]?.name;
47 | if (!name) continue;
48 |
49 | const types: GraphQLType | undefined = schemaTypes.find(
50 | (type) => type.name === name,
51 | );
52 | if (!types?.fields) continue;
53 |
54 | for (const field of types.fields) {
55 | const singularQuery: string = generateBatchQuery(
56 | field,
57 | typeName,
58 | schemaTypes,
59 | );
60 | const identicalQuery: string[] = new Array(10).fill(singularQuery);
61 | arrOfQueries.push(identicalQuery);
62 | const nestedQuery = generateQueryNested(field, typeName, schemaTypes);
63 | arrOfNested.push(nestedQuery);
64 | }
65 | }
66 | arrOfQueries.push(arrOfNested);
67 | res.locals.batchingQueries = arrOfQueries;
68 | console.log('Generated Batching Queries...');
69 | return;
70 | },
71 | attack: async (req: Request, res: Response): Promise