A Burp Suite extension for advanced GraphQL security testing, featuring vulnerability scanning, batch attacks, and schema analysis.
InQL is a Burp Suite extension for advanced GraphQL security testing. It provides tools for scanning GraphQL endpoints, detecting vulnerabilities like circular references, performing batch attacks, and analyzing schemas even when introspection is disabled. It solves the problem of efficiently testing GraphQL APIs for security flaws within a familiar penetration testing environment.
Security researchers, penetration testers, and bug bounty hunters who need to assess the security of GraphQL APIs, particularly those using Burp Suite as their primary testing platform.
Developers choose InQL for its deep integration with Burp Suite, comprehensive vulnerability detection capabilities, and advanced features like schema bruteforcing and batch query attacks, which are not typically available in generic GraphQL tools.
InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Detects circular references and other schema-based vulnerabilities through Points of Interest scans, as highlighted in the Scanner feature for structured analysis.
Seamlessly integrates with Burp, allowing query generation from any GraphQL request and sending to other Burp tools, enhancing workflow efficiency.
Can recreate GraphQL schemas even when introspection is disabled, using regex pattern matching based on the Clairvoyance CLI tool.
Offers adjustable query depth, indentation, and targeted scans, providing flexibility for different testing scenarios.
Includes GraphiQL and GraphQL Voyager servers for enhanced schema analysis and visualization directly within the tool.
Requires the most recent Burp version and Java 17 or later, which can complicate setup for users with older installations.
Building from source necessitates installing Taskfile and managing Kotlin dependencies, which may be challenging for non-developers.
As a Burp extension, it cannot be used independently, restricting its utility for teams not using Burp Suite.