nikitastupin / clairvoyance

Obtain GraphQL API schema even if the introspection is disabled
Apache License 2.0
960 stars 87 forks source link

error #101

Open suljov opened 1 month ago

suljov commented 1 month ago

hello. not sure whats the problem so just put it out here.

i installed it with the command

pip3 install clairvoyance

since Python 2.7 reached the end of its life on January 1st, 2020 and is deprecated etc

clairvoyance https://<academy URL>/graphql/v1

2024-06-06 14:37:54     INFO    | Starting blind introspection on https://0a9100b803ab64ce809f301500730089.web-security-academy.net/graphql/v1...
2024-06-06 14:37:54     INFO    | Iteration 1
2024-06-06 14:37:55     WARNING | Error posting to https://0a9100b803ab64ce809f301500730089.web-security-academy.net/graphql/v1: Cannot connect to host 0a9100b803ab64ce809f301500730089.web-security-academy.net:443 ssl:default [Connect call failed ('34.246.129.62', 443)]
2024-06-06 14:37:55     WARNING | Error posting to https://0a9100b803ab64ce809f301500730089.web-security-academy.net/graphql/v1: Cannot connect to host 0a9100b803ab64ce809f301500730089.web-security-academy.net:443 ssl:default [Connect call failed ('79.125.84.16', 443)]
2024-06-06 14:37:56     WARNING | Error posting to https://0a9100b803ab64ce809f301500730089.web-security-academy.net/graphql/v1: Cannot connect to host 0a9100b803ab64ce809f301500730089.web-security-academy.net:443 ssl:default [Connect call failed ('34.246.129.62', 443)]
Traceback (most recent call last):
  File "/home/kali/.local/lib/python3.11/site-packages/clairvoyance/oracle.py", line 425, in probe_typeref
    raise Exception(f"""Unable to get TypeRef for {documents} in context {context}.
Exception: Unable to get TypeRef for ['query { xbox }', 'query { xbox { lol } }'] in context FuzzingContext.FIELD.
                            It is very likely that Field Suggestion is not fully enabled on this endpoint.

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/home/kali/.local/bin/clairvoyance", line 8, in <module>
    sys.exit(cli())
             ^^^^^
  File "/home/kali/.local/lib/python3.11/site-packages/clairvoyance/cli.py", line 142, in cli
    asyncio.run(
  File "/usr/lib/python3.11/asyncio/runners.py", line 190, in run
    return runner.run(main)
           ^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/runners.py", line 118, in run
    return self._loop.run_until_complete(task)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/base_events.py", line 654, in run_until_complete
    return future.result()
           ^^^^^^^^^^^^^^^
  File "/home/kali/.local/lib/python3.11/site-packages/clairvoyance/cli.py", line 89, in blind_introspection
    schema = await oracle.clairvoyance(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/.local/lib/python3.11/site-packages/clairvoyance/oracle.py", line 594, in clairvoyance
    field, args = await task
                  ^^^^^^^^^^
  File "/usr/lib/python3.11/asyncio/tasks.py", line 615, in _wait_for_one
    return f.result()  # May raise f.exception().
           ^^^^^^^^^^
  File "/home/kali/.local/lib/python3.11/site-packages/clairvoyance/oracle.py", line 525, in explore_field
    typeref = await probe_field_type(
              ^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/.local/lib/python3.11/site-packages/clairvoyance/oracle.py", line 444, in probe_field_type
    return await probe_typeref(documents, FuzzingContext.FIELD)
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/.local/lib/python3.11/site-packages/clairvoyance/oracle.py", line 428, in probe_typeref
    raise Exception(e) from e
Exception: Unable to get TypeRef for ['query { xbox }', 'query { xbox { lol } }'] in context FuzzingContext.FIELD.
                            It is very likely that Field Suggestion is not fully enabled on this endpoint.
2024-06-06 14:37:59     ERROR   | Unclosed client session
client_session: <aiohttp.client.ClientSession object at 0x7f2af6b1d090>
Privat33r-dev commented 4 weeks ago

Hi!

First of all, you just replaced URL in the command, while it's clearly visible elsewhere in the logs (as well as your Python version, path, OS). Secondly, it appears to be an issue with your endpoint.

What can be done from our perspective: improve error logging: add request and response details for further analysis, handle connection errors gracefully improve error handling, close aiohttp connection to avoid flood in the error output

What can be done from your perspective to improve the report: Ensure host availability, try to do the request manually/trace the requests from clairvoyance. If you are sure that the issue is with clairvoyance, then, please provide as much details as possible: request+response, GraphQL server engine (if available).