A dependency-aware GraphQL API fuzzing tool that automatically generates and executes security tests based on schema introspection.
GraphQLer is a security testing tool designed specifically for GraphQL APIs. It automates the discovery of vulnerabilities by introspecting the API schema, understanding dependencies between operations, and executing context-aware fuzzing attacks. It solves the problem of manual, repetitive security testing by providing an automated, intelligent pipeline for uncovering issues like IDOR and injection flaws.
Security engineers, penetration testers, and developers responsible for securing GraphQL-based applications who need an automated tool to find vulnerabilities beyond basic schema introspection.
Developers choose GraphQLer because it is the only open-source tool that performs dependency-aware fuzzing, automatically constructing realistic attack chains that mirror how an attacker would interact with the API, leading to more accurate and severe vulnerability findings compared to naive fuzzers.
🔍A cutting edge context aware GraphQL API fuzzing tool!
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Constructs realistic multi-step attack chains by analyzing dependencies between queries and mutations, simulating complex attacker workflows as emphasized in the philosophy section.
Automatically identifies insecure direct object references using dual-profile chain replay with primary and secondary authentication tokens, a key feature highlighted in the README.
Provides a full terminal user interface for compiling, fuzzing, and exploring results without complex command-line arguments, making it accessible for interactive use as shown in the TUI description.
Offers extensive configuration via TOML files and CLI flags, including proxy support, attack toggles, and custom plugins, detailed in the advanced features section.
Relies on GraphQL introspection queries to build the schema; if disabled on the target API, the tool cannot function without manual intervention, limiting its use in locked-down environments.
Requires configuration of authentication, proxies, and optional LLM settings, with multiple modes and flags that can be overwhelming for users new to GraphQL security testing.
Fuzzing with dependency chains and multiple iterations can be time-consuming and network-heavy, especially for large schemas, as indicated by the max iterations and time settings.