Lab: Accidental exposure of private GraphQL fields

In Burp's browser, access the lab and select My account.

Attempt to log in to the site.

In Burp, go to Proxy > HTTP history and notice that the login attempt is sent as a GraphQL mutation containing a username and password.

Right-click the login request and select Send to Repeater.

Use InQL to scan the GraphQL endpoint. Notice the following:

• There is a getUser query that returns a user's username and password.
• This query fetches the relevant user information via a direct reference to an id number.

Copy the contents of the getUser query.

Go to the Repeater tab and select the InQL subtab.

Paste the contents of the getUser query into the Query box, replacing the original GraphQL login mutation.

Select the Pretty tab and remove the operationName property.

Click Send. Notice that the default 1334 user ID causes the API to return an error.

Test alternative user IDs until the API returns the administrator's credentials. In this case, the administrator's ID is 1.

Log in to the site as the administrator, go to the Admin panel, and delete carlos to solve the lab.