Apprentice
← all rooms
GraphQL Medium

GraphQL IDOR

Enumerate GraphQL user objects and steal admin's secret.

Mission briefing

PeopleGraph exposes a GraphQL API for an HR directory with users and secrets. The schema allows fetching any user record by numeric id. Determine whether confidential fields are exposed without proper authorisation.

0 / 1 tasks 0 / 10 pts

Objectives

  • Query user(id) without authz
Task 1 IDOR query Medium 10 pts

Scenario

PeopleGraph lets clients query user records by id through a GraphQL API. Each user object includes a secret field meant for HR only. Retrieve the administrator's secret without authorisation.

Your approach

  1. Open the GraphQL IDE or POST endpoint and explore the schema.
  2. Query user objects with different numeric ids.
  3. Request the secret field on the admin user's record.
  4. Copy the admin secret flag from the response.
  5. Submit that flag.

Find the admin user secret.

Open lab →
Hint

{ user(id: 3) { secret } }