A method, device, electronic device and storage medium for scanning GraphQL vulnerabilities

Abstract

The embodiments of the present application provide a method, device, electronic device, and storage medium for scanning GraphQL vulnerabilities, wherein the method comprises: obtaining a GraphQL structure file; parsing the structure file to obtain a set of structure types for the GraphQL; constructing a request body according to the set of structure types; constructing a request according to the request body to obtain a GraphQL request; replacing the GraphQL request to obtain a replaced GraphQL request; and performing a vulnerability scan based on the replaced GraphQL request to obtain a response result. Implementing the embodiments of the present application can achieve automated scanning, improve the detection rate of GraphQL vulnerability scanning, quickly and accurately determine whether there are vulnerabilities in GraphQL, and simplify the scanning process.

Description

Technical Field

[0001] The present application relates to the fields of front-end and security technology, and more specifically, to a method, device, electronic device, and computer storage medium for scanning GraphQL vulnerabilities. Background Art

[0002] With the development of internet technology, front-end businesses are becoming increasingly complex. Traditional RESTful APIs cannot flexibly and accurately match front-end data needs. Often, retrieving a set of data requires calling dozens of API endpoints, reorganizing and filtering the data. Facebook created GraphQL to address this problem.

[0003] GraphQL is a structured query language similar to SQL. GraphQL uses a request structure to express the desired data format, so all request-related information is contained in the request body. When performing vulnerability scanning, traditional RESTful APIs carry various parameters, which can be injected to determine if vulnerabilities exist. However, because GraphQL requests use a structured body, it's not easy to retrieve parameter-related information. Typically, only by understanding the specific request can one identify the parameters, making automated scanning impossible. This also means that traditional web application scanning tools are ineffective. Summary of the Invention

[0004] The purpose of the embodiments of the present application is to provide a GraphQL vulnerability scanning method, device, electronic device and storage medium, which can realize automated scanning, improve the detection rate of GraphQL vulnerability scanning, quickly and accurately determine whether there are vulnerabilities in GraphQL, and simplify the scanning process.

[0005] In a first aspect, an embodiment of the present application provides a method for scanning GraphQL vulnerabilities, the method comprising:

[0006] Get the GraphQL structure file;

[0007] Parse the structure file to obtain the structure type set of the GraphQL;

[0008] Constructing a request body according to the structure type set;

[0009] Construct a request according to the request body to obtain a GraphQL request;

[0010] Performing a replacement process on the GraphQL request to obtain a replaced GraphQL request;

[0011] A vulnerability scan is performed according to the replaced GraphQL request to obtain a response result.

[0012] In the above implementation process, after parsing the structure file, a set of GraphQL structure types is obtained. Then, the request body and GraphQL request are constructed according to the set of structure types. This can realize automated scanning, improve the detection rate of GraphQL vulnerability scanning, quickly and accurately determine whether there are vulnerabilities in GraphQL, and simplify the scanning process.

[0013] Furthermore, the step of constructing a request body according to the structure type set includes:

[0014] Selecting an operation type from the set of structure types;

[0015] Traversing the current operation type in the operation types;

[0016] Determining whether the recursion depth of the current operation type reaches a preset recursion depth;

[0017] If not, determining whether the current operation type is a preset type according to the field of the current operation type;

[0018] If the current operation type is the preset type, determining whether the current operation type is a scalar type;

[0019] If the current operation type is the scalar type, the request body is constructed according to the fields of the current operation type.

[0020] In the above implementation process, whether the current operation type is a preset type is determined based on the recursion depth and the field of the current operation type, and then the request body is constructed according to the operation type. This can simplify the process of constructing the request body and make the request body contain more valid information.

[0021] Furthermore, the step of constructing the request body according to the field of the current operation type includes:

[0022] Traversing the parameters of the fields of the current operation type;

[0023] Construct the request body of JSON type according to the traversed parameters.

[0024] In the above implementation process, the request body is constructed after traversing the parameters of the fields of the current operation type, so that the request body can be applied to GraphQL vulnerability scanning and the construction process of the request body is simplified.

[0025] Furthermore, the step of constructing a request according to the request body to obtain a GraphQL request includes:

[0026] Get the request method and request path;

[0027] Adding a Content-Type field to the request body to obtain a request header;

[0028] Generate the GraphQL request according to the request method, the request path, the request body, and the request header.

[0029] In the above implementation process, a GraphQL request is constructed according to the request method, request path, request header, and request body, so that the GraphQL request contains more valid information, reduces data redundancy, and improves the practicality of the GraphQL request.

[0030] Furthermore, the step of replacing the GraphQL request to obtain a replaced GraphQL request includes:

[0031] Traverse the parameters in the GraphQL request to obtain injection point parameters;

[0032] The injection point parameters are replaced to obtain the replaced GraphQL request.

[0033] In the above implementation process, the injection point parameters are replaced so that the replaced GraphQL request can detect vulnerabilities more quickly, reduce errors in the vulnerability detection process, and improve detection efficiency.

[0034] Furthermore, the step of replacing the injection point parameters to obtain the replaced GraphQL request includes:

[0035] Get the existing payload;

[0036] The value of the injection point parameter is replaced with the existing payload to obtain the replaced GraphQL request.

[0037] In the above implementation process, the value of the injection point parameter is replaced, and a quick search can be performed based on the injection point parameter, thereby improving the application efficiency of the injection point parameter and simplifying the replacement process of the injection point parameter.

[0038] In a second aspect, an embodiment of the present application further provides a GraphQL vulnerability scanning device, the device comprising:

[0039] Get module, used to get the GraphQL structure file;

[0040] A parsing module, configured to parse the structure file to obtain a set of structure types of the GraphQL;

[0041] A construction module, configured to construct a request body according to the set of structure types; and further configured to construct a request according to the request body to obtain a GraphQL request;

[0042] A replacement module, configured to perform replacement processing on the GraphQL request to obtain a replaced GraphQL request;

[0043] The vulnerability scanning module is used to perform vulnerability scanning according to the replaced GraphQL request and obtain a response result.

[0044] In the above implementation process, after parsing the structure file, a set of GraphQL structure types is obtained. Then, the request body and GraphQL request are constructed according to the set of structure types. This can realize automated scanning, improve the detection rate of GraphQL vulnerability scanning, quickly and accurately determine whether there are vulnerabilities in GraphQL, and simplify the scanning process.

[0045] Furthermore, the construction module is also used for:

[0046] Selecting an operation type from the set of structure types;

[0047] Traversing the current operation type in the operation types;

[0048] Determining whether the recursion depth of the current operation type reaches a preset recursion depth;

[0049] If not, determining whether the current operation type is a preset type according to the field of the current operation type;

[0050] If the current operation type is the preset type, determining whether the current operation type is a scalar type;

[0051] If the current operation type is the scalar type, the request body is constructed according to the fields of the current operation type.

[0052] In the above implementation process, whether the current operation type is a preset type is determined based on the recursion depth and the current operation type field, and then the request body is constructed based on the current operation type. This can simplify the process of constructing the request body and allow the request body to contain more valid information.

[0053] In a third aspect, an embodiment of the present application provides an electronic device, comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the method described in any one of the first aspects when executing the computer program.

[0054] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which instructions are stored. When the instructions are executed on a computer, the computer executes the method as described in any one of the first aspects.

[0055] In a fifth aspect, an embodiment of the present application provides a computer program product, which, when running on a computer, enables the computer to execute the method as described in any one of the first aspects.

[0056] Other features and advantages of the present disclosure will be set forth in the following description, or some features and advantages may be inferred or unambiguously determined from the description, or may be learned by practicing the above-mentioned technology of the present disclosure.

[0057] It can be implemented according to the contents of the specification. The following is a detailed description of the preferred embodiments of the present application with reference to the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following is a brief introduction to the drawings required for use in the embodiments of the present application. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the range values. For ordinary technicians in this field, other relevant drawings can be obtained based on these drawings without creative work.

[0059] Figure 1 A flowchart of a GraphQL vulnerability scanning method provided in an embodiment of the present application;

[0060] Figure 2 A schematic diagram of the structural composition of a GraphQL vulnerability scanning device provided in an embodiment of the present application;

[0061] Figure 3 A schematic diagram of the structural composition of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0063] It should be noted that similar reference numerals and letters represent similar items in the following drawings. Therefore, once an item is defined in one drawing, it does not need to be further defined or explained in subsequent drawings. At the same time, in the description of this application, the terms "first", "second", etc. are only used to distinguish the description and should not be understood as indicating or implying relative importance.

[0064] The following embodiments are used to illustrate the present invention, but are not intended to limit the scope of the present invention.

[0065] Example 1

[0066] Figure 1 This is a flow chart of a method for scanning GraphQL vulnerabilities provided by an embodiment of the present application. Figure 1 As shown, the method includes:

[0067] S1, obtain the GraphQL structure file;

[0068] S2, parse the structure file to obtain the GraphQL structure type set;

[0069] S3, construct the request body according to the structure type set;

[0070] S4, construct a request according to the request body to obtain a GraphQL request;

[0071] S5, replace the GraphQL request to obtain a replaced GraphQL request;

[0072] S6, perform vulnerability scanning based on the replaced GraphQL request and obtain the response result.

[0073] In the above implementation process, after parsing the structure file, a set of GraphQL structure types is obtained. Then, the request body and GraphQL request are constructed according to the set of structure types. This can realize automated scanning, improve the detection rate of GraphQL vulnerability scanning, quickly and accurately determine whether there are vulnerabilities in GraphQL, and simplify the scanning process.

[0074] This embodiment of the application uses a tool to parse a GraphQL structure file and construct a GraphQL request, which includes a request path, request method, request headers, and request body. Elements are then injected to perform relevant processing of the request body during the automated audit process. This, combined with an existing web application scanning tool, can enable vulnerability scanning of GraphQL APIs.

[0075] In S2, a lexical parsing tool is used to parse the GraphQL structure file into a structure recognizable by the programming language. The parsed result is a set of multiple types. Combined with the classification of GraphQL types, a set of structural types is obtained.

[0076] Furthermore, S3 includes:

[0077] Select the operation type from the structure type set;

[0078] Traverse the current operation type in the operation type;

[0079] Determine whether the recursion depth of the current operation type reaches the preset recursion depth;

[0080] If not, determine whether the current operation type is a preset type based on the current operation type field;

[0081] If the current operation type is a preset type, determine whether the current operation type is a scalar type;

[0082] If the current operation type is a scalar type, construct the request body according to the fields of the current operation type.

[0083] In the above implementation process, whether the operation type is a preset type is determined based on the recursion depth and the current operation type field, and then the request body is constructed based on the operation type. This can simplify the process of constructing the request body and allow the request body to contain more valid information.

[0084] Operation types include Query, Mutation, and Subscription.

[0085] The preset types are those defined by GraqhQL, including Scalar, Object, Union, Interface, Enum, Input Object, List, and Non-Null.

[0086] The current operation type may be any one of the operation types, any one of the preset types, or a user-defined type.

[0087] Each type includes one or more field attributes (constituting fields), and each field attribute is composed of parameters and return types, where parameters are a collection of multiple types.

[0088] Select an operation type from the set of structure types and determine whether the recursion depth of the current operation type reaches the preset recursion depth (you can set different preset recursion depths for field types and parameters). If so, exit the recursion; otherwise, traverse the fields of the operation type.

[0089] Get the parameters of the current operation type and traverse the parameters (when traversing parameters, the operation type is parameter; when processing parameters, the operation type is field);

[0090] The current operation type is judged. If it is a preset type, then determine whether the current operation type is a Scalar type (scalar type); otherwise, reselect the operation type; if it is a scalar type, exit the recursion; after the traversal is completed, process the parameters and reselect the current operation type to determine whether the recursion depth of the current operation type reaches the preset recursion depth.

[0091] After all traversals are completed, a JSON request body is constructed, where query is the query structure and variables are the query parameters.

[0092] Furthermore, the step of constructing the request body according to the fields of the current operation type includes:

[0093] Traverse the parameters of the fields of the current operation type;

[0094] Construct a JSON request body based on the traversed parameters.

[0095] In the above implementation process, the request body is constructed after traversing the parameters of the fields of the current operation type, so that the request body can be applied to the scanning of GraphQL vulnerabilities, simplifying the construction process of the request body.

[0096] Furthermore, S4 includes:

[0097] Get the request method and request path;

[0098] Add the Content-Type field to the request body to get the request header;

[0099] Generates a GraphQL request based on the request method, request path, request body, and request headers.

[0100] In the above implementation process, a GraphQL request is constructed according to the request method, request path, request header, and request body, so that the GraphQL request contains more valid information, reduces data redundancy, and improves the practicality of the GraphQL request.

[0101] Request path: The request endpoint of the GraphQL API is fixed, so all request paths are the same. Users can configure the endpoint of the service.

[0102] Request method: Since the GraphQL request is initiated using the request body, the request method is POST.

[0103] Request header: Since the request body is in JSON format, the Content-Type field is added to the request header and its value is application / json.

[0104] Furthermore, S5 includes:

[0105] Traverse the parameters in the GraphQL request to obtain the injection point parameters;

[0106] Replace the injection point parameters to get the replaced GraphQL request.

[0107] In the above implementation process, the injection point parameters are replaced so that the replaced GraphQL request can detect vulnerabilities more quickly, reduce errors in the vulnerability detection process, and improve detection efficiency.

[0108] Furthermore, the step of replacing the injection point parameters to obtain the replaced GraphQL request includes:

[0109] Get the existing payload;

[0110] Replace the value of the injection point parameter with the existing payload to obtain the replaced GraphQL request.

[0111] In the above implementation process, the value of the injection point parameter is replaced, and a quick search can be performed based on the injection point parameter, thereby improving the application efficiency of the injection point parameter and simplifying the replacement process of the injection point parameter.

[0112] The general process of a web application scanning tool is to extract the elements that can be injected from the scanned page, inject the payloads by calling the audit plug-in, initiate a request, and then determine whether the response result has characteristics corresponding to the payloads to determine whether there are any vulnerabilities.

[0113] Combined with the process of the WEB application scanning tool, the element injection operation is performed on the GraphQL request.

[0114] Get the real injection point data: Since the request body is in JSON format, where variables represent the parameters of the current query, the real injection point data is the various fields of the variables.

[0115] Traverse the injection point data and construct payloads injection pairs (injection point data): that is, arrange and combine each injection point data and the corresponding payloads into multiple data pairs to obtain injection pair data.

[0116] Bring each set of injection data into the request body of the GraphQL request and re-encode it into JSON format.

[0117] In this way, each request parameter carries the injected data, and traditional web application scanning tools can be used to automatically scan the GraphQL API.

[0118] Alternatively, since GraphQL API vulnerabilities are not limited to injection vulnerabilities, there are other types of vulnerabilities that cannot be detected by injection. Therefore, it is necessary to add some plug-ins to the web application scanning tool, for example:

[0119] DoS attack: The characteristics of GraphQL determine that it can carry multiple queries 5 operations in a single request. Therefore, when encountering time-consuming queries, the query operation is repeated hundreds or more times, causing the server to be overwhelmed by requests, resulting in a denial of service problem.

[0120] Information Disclosure: GraphQL has an integrated development environment called GraphQL, which allows building queries in a friendly user interface. The address of GraphQL can be guessed by enumeration.

[0121] The embodiments of the present application provide a method for parsing a GraphQL structure file to obtain its request structure and parameters, while solving the problem that traditional WEB application scanning tools cannot scan GraphQL APIs for injection vulnerabilities, and make up for the problem that traditional WEB application scanning tools cannot scan GraphQL APIs for non-injection vulnerabilities.

[0122] Example 2

[0123] In order to execute the method corresponding to the above embodiment 1 to achieve the corresponding functions and technical effects, a scanning device for GraphQL vulnerabilities is provided below, such as Figure 3 As shown, the device includes:

[0124] Acquisition module 1, used to obtain the GraphQL structure file;

[0125] Parsing module 2 is used to parse the structure file and obtain the structure type set of GraphQL;

[0126] Construction module 3, used to construct a request body according to the structure type set; and also used to construct a request according to the request body to obtain a GraphQL request;

[0127] The replacement module 4 is used to replace the GraphQL request to obtain a replaced GraphQL request;

[0128] The vulnerability scanning module 5 is used to perform vulnerability scanning according to the replaced GraphQL request and obtain a response result.

[0129] In the above implementation process, after parsing the structure file, a set of GraphQL structure types is obtained. Then, the request body and GraphQL request are constructed according to the set of structure types. This can realize automated scanning, improve the detection rate of GraphQL vulnerability scanning, quickly and accurately determine whether there are vulnerabilities in GraphQL, and simplify the scanning process.

[0130] Furthermore, the construction module 3 is also used to:

[0131] Select the operation type from the structure type set;

[0132] Traverse the current operation type in the operation type;

[0133] Determine whether the recursion depth of the current operation type reaches the preset recursion depth;

[0134] If not, determine whether the current operation type is a preset type based on the current operation type field;

[0135] If the current operation type is a preset type, determine whether the current operation type is a scalar type;

[0136] If the current operation type is a scalar type, construct the request body according to the fields of the current operation type.

[0137] In the above implementation process, whether the operation type is a preset type is determined based on the recursion depth and the current operation type field, and then the request body is constructed based on the current operation type. This can simplify the process of constructing the request body and allow the request body to contain more valid information.

[0138] Furthermore, the construction module 3 is also used to:

[0139] Traverse the parameters of the fields of the current operation type;

[0140] Construct a JSON request body based on the traversed parameters.

[0141] In the above implementation process, the request body is constructed after traversing the parameters of the fields of the current operation type, so that the request body can be applied to the scanning of GraphQL vulnerabilities, and the construction process of the request body is simplified, the construction time is shortened, and the efficiency of vulnerability scanning is further improved.

[0142] Furthermore, the construction module 3 is also used to:

[0143] Get the request method and request path;

[0144] Add the Content-Type field to the request body to get the request header;

[0145] Generates a GraphQL request based on the request method, request path, request body, and request headers.

[0146] In the above implementation process, a GraphQL request is constructed according to the request method, request path, request header, and request body, so that the GraphQL request contains more valid information, reduces data redundancy, and improves the practicality of the GraphQL request.

[0147] Furthermore, the replacement module 4 is further configured to:

[0148] Traverse the parameters in the GraphQL request to obtain the injection point parameters;

[0149] Replace the injection point parameters to get the replaced GraphQL request.

[0150] In the above implementation process, the injection point parameters are replaced so that the replaced GraphQL request can detect vulnerabilities more quickly, reduce errors in the vulnerability detection process, and improve detection efficiency.

[0151] Furthermore, the replacement module 4 is further configured to:

[0152] Get the existing payload;

[0153] Replace the value of the injection point parameter with the existing payload to obtain the replaced GraphQL request.

[0154] In the above implementation process, the value of the injection point parameter is replaced, and a quick search can be performed based on the injection point parameter, thereby improving the application efficiency of the injection point parameter and simplifying the replacement process of the injection point parameter.

[0155] The above-mentioned GraphQL vulnerability scanning device can implement the method of the above-mentioned embodiment 1. The optional options in the above-mentioned embodiment 1 are also applicable to this embodiment and will not be described in detail here.

[0156] The rest of the contents of the embodiments of this application can refer to the contents of the above-mentioned embodiment 1, and will not be repeated in this embodiment.

[0157] Example 3

[0158] An embodiment of the present application provides an electronic device, including a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the GraphQL vulnerability scanning method of embodiment 1.

[0159] Optionally, the above-mentioned electronic device may be a server.

[0160] See Figure 3 , Figure 3This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. The electronic device may include a processor 31, a communication interface 32, a memory 33, and at least one communication bus 34. The communication bus 34 is used to enable direct communication between these components. The communication interface 32 of the device in the embodiment of the present application is used to communicate signaling or data with other node devices. The processor 31 may be an integrated circuit chip with signal processing capabilities.

[0161] The processor 31 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, or a discrete hardware component. It can implement or execute the various methods, steps, and logic block diagrams disclosed in the embodiments of this application. A general-purpose processor can be a microprocessor, or the processor 31 can also be any conventional processor.

[0162] The memory 33 may be, but is not limited to, a random access memory (RAM), a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), etc. The memory 33 stores computer-readable instructions. When the computer-readable instructions are executed by the processor 31, the device can perform the above-mentioned operations. Figure 1 The various steps involved in the method embodiment.

[0163] Optionally, the electronic device may further include a storage controller and an input / output unit. The memory 33, storage controller, processor 31, peripheral interfaces, and input / output units are electrically connected to each other, directly or indirectly, to enable data transmission or interaction. For example, these components may be electrically connected to each other via one or more communication buses 34. The processor 31 is configured to execute executable modules stored in the memory 33, such as software function modules or computer programs included in the device.

[0164] The input and output unit is used to provide users with the ability to create tasks and to create optional start time periods or preset execution times for the tasks to enable interaction between the user and the server. The input and output unit can be, but is not limited to, a mouse and keyboard.

[0165] I understand. Figure 3 The structure shown is only for illustration, and the electronic device may also include Figure 3 More or fewer components than shown, or with Figure 3 Different configurations shown. Figure 3 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0166] In addition, an embodiment of the present application further provides a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the GraphQL vulnerability scanning method of embodiment 1.

[0167] An embodiment of the present application further provides a computer program product, which, when running on a computer, enables the computer to execute the method described in the method embodiment.

[0168] In the several embodiments provided in this application, it should be understood that the disclosed devices and methods,

[0169] It can also be implemented in other ways. The device embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the devices, methods and computer program products according to multiple embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment or part of the code, which contains one or more executable programs for implementing the specified logical functions.

[0170] Instructions. It should also be noted that in some alternative implementations, the functions noted in the blocks may occur in a different order than that noted in the accompanying figures. For example, two consecutive blocks may actually be executed substantially in parallel, or they may sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each block in the block diagrams and / or flow charts, and combinations of blocks in the block diagrams and / or flow charts, may be implemented using dedicated hardware-based devices that perform the specified functions or actions, or may be implemented using a combination of dedicated hardware and computer instructions.

[0171] In addition, the functional modules in the various embodiments of the present application may be integrated together to form an independent part, or each module may exist independently, or two or more modules may be integrated to form an independent part.

[0172] If the functions are implemented in the form of software function modules and sold or used as independent products

[0173] When used, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application 0 is essentially or the part that contributes to the existing technology or the part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for making a computer device (which can be a personal computer, server, or network device, etc.) execute all or part of the steps of the method described in each embodiment of this application.

[0174] The storage medium includes: a U disk, a mobile hard disk, a ROM, a RAM, a magnetic disk or an optical disk, etc., which can store program codes.

[0175] The above description is only an embodiment of the present application and is not intended to limit the scope of protection of the present application. For those skilled in the art, the present application may have various changes and modifications. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application. It should be noted that similar reference numerals and letters in the following drawings represent

[0176] Similar items, therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0177] The above description is merely a specific embodiment of the present application, but the scope of protection of the present application is not limited thereto. Any changes or substitutions that can be easily conceived by a person skilled in the art within the technical scope disclosed in the present application should be included within the scope of protection of the present application. Therefore, the scope of protection of the present application should be based on the scope of protection of the claims.

[0178] It should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "include," "comprise," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that includes a series of elements includes not only those elements but also other elements not explicitly listed, or includes elements that are not explicitly listed for such process, method, article, or apparatus.

[0179] Inherent elements. In the absence of more constraints, an element defined by the phrase "comprises a ..." does not exclude the existence of other identical elements in the process, method, article or apparatus that includes the element.

Claims

1. A GraphQL vulnerability scanning method, characterized in that: The method comprises: Get the GraphQL structure file; Parse the structure file to obtain the structure type set of the GraphQL; Constructing a request body according to the structure type set; Construct a request according to the request body to obtain a GraphQL request; Performing a replacement process on the GraphQL request to obtain a replaced GraphQL request; Perform vulnerability scanning according to the replaced GraphQL request and obtain a response result; The step of constructing a request body according to the structure type set includes: Selecting an operation type from the set of structure types; Traversing the current operation type in the operation types; Determining whether the recursion depth of the current operation type reaches a preset recursion depth; If not, determining whether the current operation type is a preset type according to the field of the current operation type; If the current operation type is the preset type, determining whether the current operation type is a scalar type; If the current operation type is the scalar type, the request body is constructed according to the fields of the current operation type.

2. The GraphQL vulnerability scanning method according to claim 1, characterized in that: The step of constructing the request body according to the field of the current operation type includes: Traversing the parameters of the fields of the current operation type; Construct the request body of JSON type according to the traversed parameters.

3. The GraphQL vulnerability scanning method according to claim 1, characterized in that: The step of constructing a request according to the request body to obtain a GraphQL request includes: Get the request method and request path; Adding a Content-Type field to the request body to obtain a request header; Generate the GraphQL request according to the request method, the request path, the request body, and the request header.

4. The GraphQL vulnerability scanning method according to claim 1, characterized in that: The step of replacing the GraphQL request to obtain a replaced GraphQL request includes: Traverse the parameters in the GraphQL request to obtain injection point parameters; The injection point parameters are replaced to obtain the replaced GraphQL request.

5. The GraphQL vulnerability scanning method according to claim 4, characterized in that: The step of replacing the injection point parameters to obtain the replaced GraphQL request includes: Get the existing payload; The value of the injection point parameter is replaced with the existing payload to obtain the replaced GraphQL request.

6. A GraphQL vulnerability scanning device, characterized in that: The device comprises: Get module, used to get the GraphQL structure file; A parsing module, configured to parse the structure file to obtain a set of structure types of the GraphQL; A construction module, configured to construct a request body according to the set of structure types; and further configured to construct a request according to the request body to obtain a GraphQL request; A replacement module, configured to perform replacement processing on the GraphQL request to obtain a replaced GraphQL request; A vulnerability scanning module is used to perform vulnerability scanning according to the replaced GraphQL request and obtain a response result; The construction module is also used to: Selecting an operation type from the set of structure types; Traversing the current operation type in the operation types; Determining whether the recursion depth of the current operation type reaches a preset recursion depth; If not, determining whether the current operation type is a preset type according to the field of the current operation type; If the current operation type is the preset type, determining whether the current operation type is a scalar type; If the current operation type is the scalar type, the request body is constructed according to the fields of the current operation type.

7. An electronic device, characterized in that: The electronic device includes a memory and a processor, wherein the memory is used to store a computer program, and the processor runs the computer program to enable the electronic device to perform the GraphQL vulnerability scanning method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that It stores a computer program, which, when executed by a processor, implements the GraphQL vulnerability scanning method according to any one of claims 1 to 5.

Images