Avatar

Labs / GraphQL Gateway

  • Daily Challenge
  • Released 12 Sep 2025

🚀 Can you unlock the secrets hidden in their GraphQL schema?

This company's modern GraphQL API promises flexible data access and powerful querying capabilities for their internal systems. 🔍 But with great power comes great responsibility - and their developers might have left a few doors unlocked. 💡 Dive deep into schema introspection, discover hidden queries, and exploit authorization flaws to uncover sensitive information that should never see the light of day! 🕵️

1
Flags
1
Points
Daily Challenge
Free Access
Start Lab Environment

Launch your dedicated AWS machine to begin hacking

~1-2 min setup
AWS dedicated
Private instance
Industry standard
Daily Challenge

🚀 Modern API Security: GraphQL Vulnerabilities

GraphQL has revolutionized API development with its flexible query language and single endpoint architecture. However, this flexibility introduces unique security challenges including introspection abuse, authorization bypass, and injection vulnerabilities. This challenge explores real-world GraphQL security issues found in modern applications.

🎯 What You'll Learn
  • ✓ GraphQL introspection and schema discovery
  • ✓ Authorization bypass in GraphQL resolvers
  • ✓ GraphQL injection techniques
  • ✓ Information disclosure through nested queries
🔍 Challenge Overview

You're presented with a company's internal GraphQL API that manages employee data and project information. The API has introspection enabled and contains several security vulnerabilities that allow unauthorized access to sensitive information including administrative data and secret tokens.

Real-World Context: GraphQL APIs are increasingly common in modern web applications, microservices, and mobile backends. Understanding GraphQL security is crucial as these APIs often expose sensitive business logic and data through a single, powerful endpoint.

First Blood 🩸
Malekith
Recent flags ⛳️