A tool that extracts all GraphQL endpoints from a given domain using subdomain enumeration, script analysis, and brute force.
Graphinder is a security tool that automatically discovers GraphQL endpoints exposed by a target domain. It uses subdomain enumeration, script analysis, and brute force techniques to find hidden or undocumented GraphQL APIs, helping identify potential security vulnerabilities. The tool is designed for speed and accuracy, making it useful for security assessments and reconnaissance.
Security researchers, penetration testers, and developers conducting security audits on applications that may expose GraphQL endpoints. It's particularly valuable for those assessing web application attack surfaces.
Developers choose Graphinder because it combines multiple discovery methods into a single, fast tool specifically tailored for GraphQL endpoints. Its precision mode and configurable scanning options provide flexibility and reliability compared to manual or generic endpoint discovery methods.
🕸️ Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce. 🕸️
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Combines subdomain enumeration, script analysis, and brute force to comprehensively find GraphQL endpoints, as outlined in the usage options for expanded coverage.
Offers precision mode for accuracy and toggleable bruteforce/script search, allowing users to balance speed and thoroughness based on reconnaissance needs.
Supports scanning multiple domains from a file with adjustable concurrent workers, enabling efficient large-scale reconnaissance, as noted in the max-workers feature.
Available via Docker and Pip installations, making it accessible for various setups without complex dependencies, with clear commands provided in the README.
Exports findings to JSON and can send notifications via Discord webhooks, streamlining workflow integration for security teams with real-time alerts.
Stops at endpoint discovery; doesn't perform API testing or vulnerability scanning, which requires additional tools for comprehensive security assessment.
Precision mode is slower, and high worker counts can cause networking bottlenecks, as acknowledged in the README's troubleshooting notes about reducing workers.
Command-line only interface may be less user-friendly for those accustomed to visual security tools or automated dashboards, limiting accessibility for non-technical users.
Brute force methods, even with precision mode, can yield inaccurate results, necessitating manual verification of discovered endpoints and reducing efficiency.