graphql-security 开源项目推荐（42 个）

awarexone /Agentic-Bug-Hunter

AI 驱动的漏洞赏金猎取工具包，无论是否订阅均可使用。

wallarm /gotestwaf

An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses

doyensec /inql

InQL是一个强大的开源Burp套件扩展，用于高级GraphQL测试，提供直观的漏洞检测、可定制的扫描和无缝的Burp集成。

dolevf /Damn-Vulnerable-GraphQL-Application

Damn Vulnerable GraphQL Application is an intentionally vulnerable GraphQL service implementation designed for learning about and practising GraphQL Security.

gsmith257-cyber /GraphCrawler

GraphQL automated security testing toolkit

Agent-Field /sec-af

AI-native code security auditor on AgentField that proves exploitability with verdicts, traces, and actionable evidence.

networknt /light-graphql-4j

GraphQL implementation based on light-4j

0xbigshaq /hackmegraph

a vulnerable GraphQL application

davinerd /gql_intruder

A plugin based GraphQL vulnerability assessment tool.

CYBWithFlourish /GraphqlNomad

An integrated tool to detect, fingerprint, and explore GraphQL endpoints.

Zuk4r1 /surface-hound

Extensión de bug bounty (Chrome/Firefox): mapea la superficie de ataque en vivo — IDOR con scoring, correlación de entidades, GraphQL, OAuth/OIDC, source maps y fingerprinting de tecnología — con cadenas de explotación sugeridas y puente a nuclei/httpx/etc.

FortressCommunity /FortressWAF

FortressWAF - Self-Hosted WAF & API Security Gateway. Enterprise Web Application Firewall with ML-powered threat detection, GraphQL/WebSocket/mTLS inspection, hot-reload config, SIEM export, and real-time detection. Built from scratch in Go.

nknaman5121a /GQLMap-

Automated GraphQL pentest and fuzzing tool for bug bounty hunting and security research.

sentient-zero /GQLHound

Burp Suite extension for passive GraphQL reconnaissance. Catalogs operations from proxy traffic, tracks variable shapes with sample values, stores original requests per signature, and sends to Intruder with auto-marked payload positions. Supports status triage, export/import for session persistence, and batched mutation detection.

muzuix /GraphQL-Pentest-Checklist-2026

Advanced GraphQL penetration testing checklist — covering introspection, auth bypass, injection, DoS, SSRF, subscription attacks & more. Built for security engineers & bug bounty hunters. 🔥

Nyxeara /nyxeara

DAST platform with WAF detection/evasion, OAST, SARIF 2.1.0, workflow automation, and cryptographically verified per-finding evidence. 22 check families, 22 tool integrations, evidence-first verification.

Sudo-Zaid /advanced-api-attack-toolkit

Active API exploitation CLI — GraphQL introspection abuse, injection fuzzing (SQLi/NoSQLi/command/SSTI), mass assignment and excessive data-exposure testing, confirmed from live responses.

TribuCibernetica /inyector

Wrapper inteligente sobre sqlmap: reconocimiento automatico de WAF/stack/ORM/GraphQL, seleccion de tampers, y deteccion propia de NoSQL injection (MongoDB). Corre 100 por ciento en Docker, sin instalar nada localmente.

GihanIT /Phantom-Crawler

A lightweight, multi-threaded web application reconnaissance and security testing tool. Features include crawling, JavaScript analysis, secret detection, GraphQL probing, JWT analysis, security header checks, and XSS fuzzing, with JSON and HTML reporting. For authorized security testing only (MIT License)

dheeraj-jayaswal /API-From-The-Trenches

Built in the trenches—this repository captures real-world API security insights, attack techniques, and practical penetration testing workflows.