ivision-research / vulnerable-graphql-api

A very vulnerable implementation of a GraphQL API.

GraphQL - Demo Vulnerable API

A simple GraphQL API demonstrating several common vulnerabilities.

Authored by Aidan Noll, Carve Systems, LLC.

Requirements

Node, NPM, and Python

Setup

# Install all dependencies.
npm install
# Build the TypeScript source.
npm run tsc
# Create the database and seed it with random users and comments.
npm run sequelize db:migrate
npm run sequelize db:seed:all

Running

To run the main API:

./run.sh

Usage

The GraphQL API is available on port 3000. Visiting the homepage will take you to a GraphIQL IDE for exploration.

The API provides a simple social media/blog system. Users are able to make and view posts from other users, and they can be marked private so that they can't be seen by other users.

vulnerable-graphql-api's Issues

won't install, sequelize core dumps

ubuntu 22.04. trying to install, got as far as the 2nd sequelize command:

$ npm run sequelize db:seed:all

[email protected] sequelize
sequelize db:seed:all

Sequelize CLI [Node: 16.17.0, CLI: 5.5.1, ORM: 5.22.5]

Loaded configuration file "config/config.json".
Using environment "development".
== 20190514193954-seed_users: migrating =======
Segmentation fault (core dumped)

Graphiql endpoint not working

Hello, I have installed the application, its working well on http://127.0.0.1:8081/ but it only shows a page having directory listing for / and two options

• assets

• secret
  trying to access http://127.0.0.1:8081/graphiql or http://127.0.0.1:8081/graphql leads in 404 error