Accidental exposure of private GraphQL fields

PRACTITIONER

Task

The user management functions for this lab are powered by a GraphQL endpoint. The lab contains an access control vulnerability whereby you can induce the API to reveal user credential fields.

To solve the lab, sign in as the administrator and delete the username carlos.

Steps

First, with Burpsuite intercepting traffic, attempt to log into an account in the lab.

Next, the user should copy the URL and place it in the InQL Scanner. Within the InQL Scanner there will be a query named getUser.

This request that is used to log in initially should be sent to the repeater and within the InQL tab underneath 'Query, the user should replace the mutation information with the getUser query.

The user will need to change to the 'Pretty' tab to change the ID and remove the operation name 'login'

It is important to note that the administrator is usually 1 throughout BSA, so changing this value here is needed. Also removing the login operator from the ',' is needed as well. i.e. , "operationName": "login"

Once complete, the user can log on with the credentials and delete the account carlos.