🕸️ Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce. 🕸️
Alternatives To Graphinder
Project NameStarsDownloadsRepos Using ThisPackages Using ThisMost Recent CommitTotal ReleasesLatest ReleaseOpen IssuesLicenseLanguage
a month ago6mitPython
🕸️ Blazing fast GraphQL endpoints finder using subdomain enumeration, scripts analysis and bruteforce. 🕸️
6 months agomitDart
Pet project with Flutter + Firebase + Hasura.
Taxi Finder Graphql6
2 months agoTypeScript
🚕 Taxi Finder GraphQL - A nodejs apollo graphQL server to find Taxi
Taxi Finder Client5
2 months agoJavaScript
🚕 Taxi Finder Client - A react web client to find taxi
Marvel Hero Finder3
3 years ago1mitJavaScript
An app for finding your favorite Marvel Hero made with React and using the MarvelQL API
Github Issue Finder3
3 years ago11mitJavaScript
GitHub issue finder
Pokemon Finder2
3 years ago3TypeScript
A dynamic reporting application based on the PokéAPI GraphQL (beta)
Alternatives To Graphinder
Select To Compare

Alternative Project Comparisons

Graphinder PyPI CI codecov

Graphinder is a tool that extracts all GraphQL endpoints from a given domain.


Docker Pulls Docker Image Size (latest by date) PyPI - Downloads

Run with docker

docker pull escapetech/graphinder
docker run -it --rm escapetech/graphinder -d

If you want to save your results.json file, you can use:

docker run -it --name graphinder escapetech/graphinder -d
docker cp graphinder:/graphinder/results.json results.json
docker rm -f graphinder

Install using Pip

pip install graphinder

# using specific python binary
python3 -m pip install graphinder

Run it with

graphinder ...


A Scan consistes of:

  • Running specific domain (-d, --domain).
  • Searching all scripts loaded by the browser for graphql endpoint (-s, --script)
  • Brute forcing the directories of all discovered urls (-b, --bruteforce)
  • Using precision mode (-p, --precision)

By default, bruteforce and script search are enabled.

graphinder -d
graphinder -f domains.txt

Extra features

  • --no-bruteforce: Disable bruteforce
  • --no-script: Disable script search
  • -p --precision --no-precision: Enable/disable precision mode (default: enabled) (precision mode is slower but more accurate)
  • -w --max-workers <int>: Maximum of concurrent workers on multiple domains.
  • -o --output-file <FILE_PATH>: Output the results to file
  • -v --verbose --no-verbose: Verbose mode
  • -r --reduce: The maximum number of subdomains to scan.
  • -wb --webhook_url: The discord webhook url to send the results to.

If you experience any issues, irregularities or networking bottlenecks, please reduce your number of workers, otherwise, better is your network, the more workers you can have.

Local installation

Clone the repository and run the installation script

git clone
cd graphinder

Run this command to enter the virtual enviroment

poetry shell

Profit !

graphinder -d

How do you make sure this is a valid graphql endpoint ?



Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

Please make sure to update tests as appropriate.

License PyPI - License


Popular Finder Projects
Popular Graphql Projects
Popular Data Processing Categories
Related Searches

Get A Weekly Email With Trending Projects For These Categories
No Spam. Unsubscribe easily at any time.
Subdomain Scanner