search

SecurityRiskAdvisors / VECTR

VECTR is a tool that facilitates tracking of your red and blue team testing activities to measure detection and prevention capabilities across different attack scenarios
1.36k stars 161 forks source link

GraphQL API 400 Bad Request #142

Closed fuckup1337 closed 2 years ago

fuckup1337 commented 3 years ago

Hi guys,

I am trying to communicate with the API. But for some reason I am getting only 400 errors.

So far I tried Curl, Burp and psh, but it always fails.

I am using the format mentioned in the docs: BurpSuite: POST /sra-purpletools.rest/graphql Host: < hostname > Accept: application/json Authorization: VEC1 < KeyID >:< Secret >

{ "query": "testcases(db: \"DBNAME\") { nodes {id, name}} }

Do I need to enable it somewhere else? Or is there something I am missing.

Thanks!

doodleincode commented 3 years ago

I'm not sure if the sample you gave is what you're actually sending, but be sure to escape quotes in your JSON payload:

{
  "query": "testcases(db: \"DBNAME\") { nodes {id, name}}"
}

There's a known bug in our GraphQL API that is expecting the variables key in the JSON payload. This will be fixed in a future release, but for the time being, you can just include an empty variables in your payload:

{
  "query": "testcases(db: \"DBNAME\") { nodes {id, name}}",
  "variables": {}
}
carlvonderheid commented 2 years ago

Fixed in VECTR 7.1.9