Why?
Capturing live examples of GraphQL queries and responses all in one place vastly simplifies recon.
When?
You most want to do this when introspection is disabled. Otherwise when you need examples to help make sense of the API's semantics, or to develop a better intuition for where the weaknesses may be.
How?
This script works out-of-the-box for the majority scenario: POST requests to /graphql that use the operationName parameter.
mitmdump -s capture.py capture.py:
import json import re from mitmproxy import http def response(flow: http.HTTPFlow) -> None: if flow.request.url.endswith('/graphql'): payload = json.loads(flow.request.content.decode('utf-8')) filename = re.sub(r'[^a-zA-Z0-9]', '_', payload['operationName']) + '.example.txt' with open(filename, 'w') as f: json.dump(payload, fp=f, indent=2) f.write(f"\n\n// ==== REQUEST ====\n\n") f.write(f"{payload['query']}\n\n") f.write("// ==== RESPONSE ====\n\n") json.dump(json.loads(flow.response.content), fp=f, indent=2) 
Top comments (0)