Week 34 - GraphQL Bruteforcing
Last updated
Last updated
Have you ever tried to brute force a parameter with a GraphQL query? Executing one query at a time can be slow and a pain-in-the-butt, especially with a more complex ID. So, what’s the solution???
Execute a bunch of queries with one request!! This is enabled out-of-box with ApolloServer and is called GraphQL Batching.
First, minify your query to be as light as possible, only retrieving one field enabling you to determine a valid ID from an invalid one.
Second, create a ton of queries with a different value in the parameter of each (allowing you to brute force).
Third, combine all queries into the JSON POST data of the request. Then let it rip!! Most applications in the wild will let you perform anywhere from 500 to 10,000 queries/mutations WITH JUST ONE REQUEST! Meaning a brute force attack that would have taken ~1 billion attempts can be drastically reduced to 1-2 million.
This attack can allow you to bypass 2FA lockouts, brute force low-entropy IDs, guess passwords, bypass rate limits, etc. I just found out about this attack yesterday. Hit me with a like if you didn’t know this either!