nikitastupin / clairvoyance

Obtain GraphQL API schema even if the introspection is disabled
Apache License 2.0
1.02k stars 92 forks source link

Idea: add brute-force as fallback #67

Open nikitastupin opened 1 year ago

nikitastupin commented 1 year ago

Sometimes suggestions aren't working but it's nevertheless possible to retrieve a portion of the schema. This can be achieved by the good old brute-force technique. To amplify its efficiency permutations may be used as with subdomain enumeration techniques.

We may also probe if suggestions are enabled and if they aren't fallback to brute-force.

Though it's good to have a flag to choose the method manually.