Open xerox0x1 opened 6 months ago
Thanks, it's clearly a bug in InQL and I'll look into it. Btw, if you notice any other issues when going through Portswigger labs (or get ideas for feature requests), please do share with us.
Thanks for showing interest, I'll inform you about any other errors. btw, Thanks for the great effort you && your team put in this tool, It's really Awesome, Looking forward for the next release <3
('NoneType' object is not iterable) Error Message in Batch Attack
The issue brought up to surface, when performing a Batch Attack in a Portswigger lab, Till then, I was not quite sure if the problem in INQL itself, or the lab, However by taking a look at INQL error, I found that the error comes from this python request implemented in the tool https://github.com/doyensec/inql/blob/master/python/inql/attacker/request.py
To Reproduce
Try any batch Attack, on a request you choose to bypass a rate limit with INQL, I suggest you try this Portswigger lab to test it's "login" function. https://portswigger.net/web-security/graphql/lab-graphql-brute-force-protection-bypass
Modify the intended value with documented tool regex
Try to send the request, In my scenario it throwed an Error.
Expected behavior I expected the Tool will try to bypass the rate limit by providing a list with the second regex, I tried the simplest one first, but Unfortunately it did not work.