Clear it in 3 steps
-
Start the environment
-
Investigate the target
-
Submit the flag
All challenges
In progress
Web-27. GraphQL Introspection Leak
Mission
This GraphQL API exposes a schema of User objects with introspection enabled. Investigate whether undocumented queries or fields exist beyond what the default UI shows.
Hints
Hint 1 Show
A GraphQL introspection query can retrieve the entire schema
Hint 2 Show
Try using __schema and __type
Hint 3 Show
There may be undocumented queries or fields not shown in the UI