Webverselabs Challenge Breach GraphQL

Scenario :

Breach is an internal collaboration tool where teams share notes and documents. The developers implemented access controls, but the architecture has layers — and not all of them agree on who can see what.

Solution :

We start by navigating the app just like a normal user, check the different endpoints , see if we find anything interesting, from there we check Burp’s History to see what requests were made to the server .

/Profile :

This returns information about our profile, we see that we have an ID , we will keep this in mind.

/Teams :

This lists Team members we see that danial is the Administrator , we will note this info as well .

/About !

Finally the About page is just a static page that returns information about the company :

Nothing really useful .

Let’s check Burp’s History :

We see that we have a GraphQL endpoint , which means the app uses graphql :

I already have a detailed section on my mehtodology on how we can attack GraphQL :

https://elmehdilaassiri.github.io/posts/web-app-pentesting-methodology/#graphql-

Now first thing to test whenever we have GraphQL is the introspection query , as this will return valuable information about the entire structure of the backend, and we can use that with a tool like Voyager to be able to view the entire structure as a graph.

First we identify the engine being used :

+ We can use graphw00f , it will send multiple queries to identify the engine used : 
https://github.com/dolevf/graphw00f
python3 main.py -d -f -t https://6d887ea1-4327-breach-2308d.challenges.webverselabs-pro.com/about

Once again the engine used is Apollo :

It also gives us a link to check for misconfigurations on Apollo :

We see that by default Introspection is enabled on this engine , we can try and use Burp to send the introspection request :

If we send the introspection request :

We get the response which we can paste into Voyager to be able to get the entire structure of the backend in a graph.

We see that we have the flag query which we can try , we already have the fields we need to retrieve :

If we try that , we get an error. Looking back at the Graph from Voyager :

We can see that the Flag Query requires a parameter which is debug , which takes a Boolean .

Now if we add this to our Request :

We get our flag .

That was all for this challenge, see you in the next one :)