v2.4.0: add GraphQL-specific checks (field suggestions + query batching)

.github/workflows/build.yml

@@ -27,13 +27,13 @@ jobs:
       - name: Confirm fat JAR
         run: |
           set -e
-          test -f target/burp-api-scanner-2.3.2.jar
-          ls -lh target/burp-api-scanner-2.3.2.jar
+          test -f target/burp-api-scanner-2.4.0.jar
+          ls -lh target/burp-api-scanner-2.4.0.jar
 
       - name: Upload JAR
         uses: actions/upload-artifact@v4
         with:
           name: burp-api-scanner-${{ github.sha }}
-          path: target/burp-api-scanner-2.3.2.jar
+          path: target/burp-api-scanner-2.4.0.jar
           if-no-files-found: error
           retention-days: 30

BAPP_DESCRIPTION.md

@@ -14,6 +14,7 @@ This extension provides coverage of all ten OWASP API Security Top 10 (2023) cat
 * All ten OWASP API Security Top 10 (2023) categories in a single extension, with every finding labelled by category so scan output maps straight onto the framework for reporting.
 * Coverage of the four API-specific risks that native scanning does not address: unrestricted resource consumption, unrestricted access to sensitive business flows, improper inventory management, and unsafe consumption of APIs.
 * Active discovery of deprecated API versions left reachable in production, by probing earlier versions of any `/vN/` path.
+* GraphQL-specific checks that native scanning does not perform: field-suggestion leakage ("Did you mean …", which lets an attacker recover the schema even when introspection is disabled) and array query batching (a rate-limit-bypass and brute-force amplification primitive).
 * Detection tuned to keep noise down: broken object level authorization fires only when a manipulated identifier returns a materially different object, and parameter pollution measures an endpoint's natural response variation before reporting length-based differences.
 * Optional AI assistance that filters false positives on noise-prone passive checks and suggests context-specific mass-assignment fields to test.
 

BURP_DAST_GUIDE.md

@@ -16,12 +16,12 @@ The extension is shipped as a single fat JAR. Build with:
 mvn clean package -DskipTests
 ```
 
-Output: `target/burp-api-scanner-2.3.2.jar`.
+Output: `target/burp-api-scanner-2.4.0.jar`.
 
 In DAST:
 
 1. **Settings → Extensions → Add extension**
-2. Upload `burp-api-scanner-2.3.2.jar`
+2. Upload `burp-api-scanner-2.4.0.jar`
 3. Enable the extension
 
 There is no per-DAST configuration — once loaded and enabled, the
@@ -35,7 +35,7 @@ startup banner in (that surface only exists in Professional / Community).
 Verify the extension in DAST like this:
 
 1. Open the scan's **Settings** tab and confirm the extension is listed
-   under **Extensions** (e.g. `burp-api-scanner-2.3.2.jar`). This proves
+   under **Extensions** (e.g. `burp-api-scanner-2.4.0.jar`). This proves
    it loaded and was applied to the scan.
 2. After the scan runs, open the **Issues** tab and confirm findings
    labelled `APIx:2023` are present — this confirms the extension's
@@ -53,7 +53,7 @@ extension's Output tab and reads:
 
 ```
 ====================================
-OWASP API Security Top 10 Scanner v2.3.2
+OWASP API Security Top 10 Scanner v2.4.0
 OWASP API Security Top 10 (2023) coverage
 Edition: Burp Suite Professional
 AI features: enabled       (or "disabled" if Burp AI is off)
@@ -62,7 +62,7 @@ AI features: enabled       (or "disabled" if Burp AI is off)
 
 ## OWASP API Top 10 coverage
 
-Complete OWASP API Security Top 10 (2023) coverage — 15 checks. Several
+Complete OWASP API Security Top 10 (2023) coverage — 16 checks. Several
 checks overlap Burp's native scanner; that overlap is intentional (one
 extension, all ten categories, OWASP-labelled) and each overlapping issue
 links to the native check in its detail. Run the native scanner alongside
@@ -73,12 +73,12 @@ this extension for the deepest results.
 | **API1:2023** — Broken Object Level Authorization | Active | Broken access control |
 | **API2:2023** — Broken Authentication | Active | JWT signature not verified; JWT *none* algorithm; JWT weak HMAC secret; JSON Web Key Set disclosed; Cleartext submission of password |
 | **API3:2023** — Broken Object Property Level Authorization | Active + Passive | Password returned in later response; Credit card numbers disclosed; Private key disclosed |
-| **API4:2023** — Unrestricted Resource Consumption | Passive | — (API-specific) |
+| **API4:2023** — Unrestricted Resource Consumption | Active + Passive | — (API-specific; incl. GraphQL query batching) |
 | **API5:2023** — Broken Function Level Authorization | Active | Broken access control |
 | **API6:2023** — Unrestricted Access to Sensitive Business Flows | Passive | — (API-specific) |
 | **API7:2023** — Server-Side Request Forgery | Active | Out-of-band resource load (HTTP); External service interaction; File path traversal |
 | **API8:2023** — Security Misconfiguration | Active + Passive | CORS; Content security policy; Strict transport security not enforced; Frameable response; Unencrypted communications; Source code disclosure; HTTP TRACE method is enabled |
-| **API9:2023** — Improper Inventory Management | Active + Passive | — (API-specific) |
+| **API9:2023** — Improper Inventory Management | Active + Passive | GraphQL introspection enabled (for the GraphQL field-suggestion check); otherwise API-specific |
 | **API10:2023** — Unsafe Consumption of APIs | Active + Passive | — (API-specific) |
 
 Each overlapping issue carries a **"Related Burp Scanner checks"** line in
@@ -97,12 +97,10 @@ here: if our duplicate marker flips a 200 to a 400, the server is reading
 the last value and discarding the legitimate first one — a genuine
 override primitive. Confirm exploitability manually.
 
-**Parameter Pollution note:** the HPP check fires on *any* status change
-between the baseline and the polluted request, in either direction
-(reported Tentative). A `200 → 400` is **not** treated as safe rejection
-here: if our duplicate marker flips a 200 to a 400, the server is reading
-the last value and discarding the legitimate first one — a genuine
-override primitive. Confirm exploitability manually.
+**GraphQL note:** on GraphQL endpoints the extension adds two checks native
+scanning does not — field-suggestion leakage ("Did you mean …", API9) and
+array query batching (API4). Endpoint discovery and introspection remain
+native; the field-suggestion issue cross-references them.
 
 ## Burp AI features
 

CLAUDE.md

@@ -6,7 +6,7 @@ This is a Burp Suite extension implementing OWASP API Security Top 10
 (2023) coverage. It is built on the Montoya API and targets Burp Suite
 Professional and Burp Suite DAST.
 
-> **Coverage note.** `main` is the **full build** (15 checks) — complete
+> **Coverage note.** `main` is the **full build** (16 checks) — complete
 > OWASP API Top 10 (2023) coverage in one extension, and this is what we
 > submit to the BApp Store (renamed **"OWASP API Security Top 10 Scanner"**).
 > Several checks intentionally overlap Burp's native scanner (injection,
@@ -40,9 +40,9 @@ src/main/java/com/security/burp/
 │   │                              #   (BusinessFlow, ExcessiveDataExposure,
 │   │                              #   InventoryManagement, ResourceConsumption,
 │   │                              #   SecurityMisconfig, UnsafeApiConsumption)
-│   └── active/                    # 9 active checks, all extend AbstractActiveCheck
+│   └── active/                    # 10 active checks, all extend AbstractActiveCheck
 │       └── injection/             #   (BrokenObjectAuth, BrokenAuth, DeprecatedVersionProbe,
-│                                  #   FunctionLevelAuth, Injection, MassAssignment,
+│                                  #   FunctionLevelAuth, GraphQl, Injection, MassAssignment,
 │                                  #   MethodFuzzing, ParameterPollution, Ssrf).
 │                                  #   InjectionCheck splits into injection/{AuthBypassTester,
 │                                  #   InjectionPayloads}.
@@ -66,13 +66,13 @@ export PATH="$JAVA_HOME/bin:$PATH"
 mvn clean package -DskipTests
 ```
 
-Output: `target/burp-api-scanner-2.3.2.jar` (~370 KB fat JAR).
+Output: `target/burp-api-scanner-2.4.0.jar` (~370 KB fat JAR).
 
 Load in Burp via **Extensions → Installed → Add → Java**.
 
 ## Conventions
 
-These are the patterns established across all 15 checks. Stick to them
+These are the patterns established across all 16 checks. Stick to them
 when adding new ones — Hannah's review feedback was the catalyst for the
 v2 rewrite, and breaking these breaks the property she cared about
 (reviewable code).

README.md

@@ -36,7 +36,7 @@ registered only under Professional.
 mvn clean package -DskipTests
 ```
 
-Produces `target/burp-api-scanner-2.3.2.jar`. Load via **Extensions →
+Produces `target/burp-api-scanner-2.4.0.jar`. Load via **Extensions →
 Installed → Add → Java**.
 
 Requires JDK 17+ (Montoya API requirement) and Maven 3.6+.
@@ -45,7 +45,7 @@ The banner in the extension's Output tab will look like:
 
 ```
 ====================================
-OWASP API Security Top 10 Scanner v2.3.2
+OWASP API Security Top 10 Scanner v2.4.0
 OWASP API Security Top 10 (2023) coverage
 Edition: Burp Suite Professional
 AI features: enabled
@@ -54,19 +54,19 @@ AI features: enabled
 
 ## Coverage
 
-Full OWASP API Security Top 10 (2023), 15 checks:
+Full OWASP API Security Top 10 (2023), 16 checks:
 
 | OWASP category | Detection | Related native check(s) |
 |---|---|---|
 | API1:2023 — Broken Object Level Authorization | Active | Broken access control |
 | API2:2023 — Broken Authentication | Active | JWT signature not verified · JWT none algorithm · JWT weak HMAC secret · JSON Web Key Set disclosed · Cleartext submission of password |
 | API3:2023 — Broken Object Property Level Authorization | Active + passive | Password returned in later response · Credit card numbers disclosed · Private key disclosed |
-| API4:2023 — Unrestricted Resource Consumption | Passive | — (API-specific) |
+| API4:2023 — Unrestricted Resource Consumption | Active + passive | — (API-specific; incl. GraphQL query batching) |
 | API5:2023 — Broken Function Level Authorization | Active | Broken access control |
 | API6:2023 — Unrestricted Access to Sensitive Business Flows | Passive | — (API-specific) |
 | API7:2023 — Server-Side Request Forgery | Active | Out-of-band resource load (HTTP) · External service interaction · File path traversal |
 | API8:2023 — Security Misconfiguration | Active + passive | CORS · Content security policy · Strict transport security not enforced · Frameable response · Unencrypted communications · Source code disclosure · HTTP TRACE method is enabled |
-| API9:2023 — Improper Inventory Management | Active + passive | — (API-specific) |
+| API9:2023 — Improper Inventory Management | Active + passive | GraphQL introspection enabled (for the GraphQL field-suggestion check) |
 | API10:2023 — Unsafe Consumption of APIs | Active + passive | — (API-specific) |
 
 Every issue in the overlapping categories links to its native
@@ -86,6 +86,11 @@ equivalent — they are the unique coverage this extension adds.
 - **HTTP Parameter Pollution** — fires on any response change (in either
   direction) when a parameter is duplicated; a marker-induced `200 → 400`
   is treated as a real override primitive, not safe rejection.
+- **GraphQL checks native scanning skips** — flags field-suggestion
+  leakage ("Did you mean …", which lets an attacker recover the schema
+  even with introspection off) and array query batching (a rate-limit
+  bypass / brute-force amplification primitive). Endpoint discovery and
+  introspection stay native and are cross-referenced.
 - **Burp AI integration** (optional) — when `api.ai().isEnabled()` is
   true, two extra features activate automatically:
   - **Passive triage**: false-positive filter on noise-prone passive
@@ -118,14 +123,14 @@ com.security.burp/
 │   ├── AbstractPassiveCheck #   base classes — exception handling, triage
 │   ├── AbstractActiveCheck
 │   ├── passive/             # 6 passive checks
-│   └── active/              # 9 active checks
+│   └── active/              # 10 active checks
 │       └── injection/       #   InjectionCheck helpers (payloads, auth-bypass tester)
 ├── scanner/EndpointRegistry # shared state for the UI tab
 ├── ui/ScannerTab            # Swing tab listing discovered endpoints
 └── util/IssueBuilder        # fluent AuditIssue construction
 ```
 
-15 scan checks total, registered individually with the appropriate
+16 scan checks total, registered individually with the appropriate
 `ScanCheckType` (`PER_INSERTION_POINT`, `PER_HOST`, or `PER_REQUEST`).
 See [CLAUDE.md](CLAUDE.md) for the full breakdown.
 

VALIDATION_GUIDE.md

@@ -201,6 +201,35 @@ deprecated on its own — it is the current version on most APIs.)
 - Check whether the old version misses security fixes documented for
   the new version.
 
+### API9:2023 — GraphQL field suggestions enabled
+
+**Finding:** a query for the misspelled meta-field `__typenaem` returned
+a "Did you mean …" hint, so the server leaks field names on unknown-field
+errors — schema recovery is possible even with introspection disabled.
+
+**Questions to answer:** Is introspection also on (then this is moot —
+the schema is already public)? If introspection is off, this defeats that
+control.
+
+**How to validate:** in Repeater, send `{ __typenaem }` and confirm the
+suggestion; then query another misspelled field name and observe the
+server hinting real field names. Cross-check Burp's native *GraphQL
+introspection enabled* issue for the same endpoint.
+
+### API4:2023 — GraphQL query batching enabled
+
+**Finding:** a JSON array of two operations was accepted and both were
+executed (a two-element result array returned).
+
+**Questions to answer:** Does the endpoint expose a sensitive operation
+(login, OTP, password reset) that batching/aliasing could amplify past a
+per-request rate limit?
+
+**How to validate:** in Repeater, batch (or alias) a sensitive mutation N
+times in one request and check whether all N attempts are processed and
+whether rate limiting counts operations or only HTTP requests. Batching
+alone is only impactful when paired with such an operation.
+
 ---
 
 ## TENTATIVE — heuristic, high false-positive rate

pom.xml

@@ -7,7 +7,7 @@
 
     <groupId>com.security</groupId>
     <artifactId>burp-api-scanner</artifactId>
-    <version>2.3.2</version>
+    <version>2.4.0</version>
     <packaging>jar</packaging>
 
     <name>OWASP API Security Top 10 Scanner</name>

src/main/java/com/security/burp/BurpExtender.java

@@ -12,6 +12,7 @@
 import com.security.burp.checks.active.BrokenObjectAuthCheck;
 import com.security.burp.checks.active.DeprecatedVersionProbeCheck;
 import com.security.burp.checks.active.FunctionLevelAuthCheck;
+import com.security.burp.checks.active.GraphQlCheck;
 import com.security.burp.checks.active.InjectionCheck;
 import com.security.burp.checks.active.MassAssignmentCheck;
 import com.security.burp.checks.active.MethodFuzzingCheck;
@@ -115,6 +116,8 @@ private void registerScanChecks(MontoyaApi api,
                 new BrokenAuthCheck(api),                         ScanCheckType.PER_HOST);
         api.scanner().registerActiveScanCheck(
                 new DeprecatedVersionProbeCheck(api),             ScanCheckType.PER_HOST);
+        api.scanner().registerActiveScanCheck(
+                new GraphQlCheck(api),                            ScanCheckType.PER_HOST);
 
         // Passive checks. PER_REQUEST runs once per HTTP transaction. AiTriage
         // filters out contextual false positives for each before they surface.
@@ -164,7 +167,7 @@ private void registerUnloadingHandler(MontoyaApi api,
 
     private void logBanner(MontoyaApi api, BurpSuiteEdition edition, boolean aiAvailable) {
         api.logging().logToOutput("====================================");
-        api.logging().logToOutput(EXTENSION_NAME + " v2.3.2");
+        api.logging().logToOutput(EXTENSION_NAME + " v2.4.0");
         api.logging().logToOutput("OWASP API Security Top 10 (2023) coverage");
         api.logging().logToOutput("Edition: " + edition.displayName());
         api.logging().logToOutput("AI features: " + (aiAvailable ? "enabled" : "disabled"));