search

doyensec / inql

InQL is a robust, open-source Burp Suite extension for advanced GraphQL testing, offering intuitive vulnerability detection, customizable scans, and seamless Burp integration.
https://doyensec.com/
Apache License 2.0
1.52k stars 156 forks source link

Stop scraping headers from proxy traffic #67

Closed execveat closed 1 year ago

execveat commented 1 year ago

Describe the bug Sending requests from "InQL Scanner" to "Repeater" should inherit headers used during introspection query, not headers seen in other traffic.

To Reproduce Steps to reproduce the behavior:

  1. Enter GraphQL endpoint into "InQL Scanner" navigation bar and click "Load"
  2. Load some traffic through proxy that uses the same endpoint on a regular webpage
  3. Right click on a query in "InQL Scanner" list and send it to Repeater
  4. Go to Repeater tab and observe that request has headers (and even path) of the last proxied request

Expected behavior Only generic headers used during querying GraphQL schema should be sent to the Repeater.

execveat commented 1 year ago

This was probably meant as a convenience option - to autoguess auth headers from the observed traffic. However due to race conditions it makes testing on some websites very annoying.

Consider making it a toggleable option. Or maybe expose observed headers in a separate UI element.

thypon commented 1 year ago

This was probably meant as a convenience option - to autoguess auth headers from the observed traffic. However due to race conditions it makes testing on some websites very annoying.

Yup, that was to auto-guess auth headers. It's the magic sauce of the Burp InQL version.

execveat commented 1 year ago

This part is done. Right now headers are passed alongside request when it's sent from Repeater or other Burp interface. Still need to reimplement UI for custom headers, but that's another issue.