Webverselabs Challenge Schematic GraphQL

Scenario :

Schematic Inc built a slick dashboard for their team. Everything looks polished on the surface, but the API powering it might expose more than the UI lets on. Dig deeper.

Solution :

We first start by navigating the app just like a normal user would, check the different endpoints, use different features and then check Burp’s History to see what kind of requests were made to the server.

/Team :

This is a static page that returns all users with their appropriate role and status .

/Products :

A list of products with their prices, etc.

/About :

Another static page , nothing we can work with here .

If we check Burp’s History :

We find that the app uses GraphQL for most of the requests , i already have a detailed section on my mehtodology on how we can attack GraphQL :

https://elmehdilaassiri.github.io/posts/web-app-pentesting-methodology/#graphql-

Now first thing to test whenever we have GraphQL is the introspection query , as this will return valuable information about the entire structure of the backend, and we can use that with a tool like Voyager to be able to view the entire structure as a graph.

First we identify the engine being used :

+ We can use graphw00f , it will send multiple queries to identify the engine used : 
https://github.com/dolevf/graphw00f
python3 main.py -d -f -t https://8a3f31b4-4327-schematic-e9433.challenges.webverselabs-pro.com/

We identified that the template it Apollo . It also gives us a link to check for misconfigurations on Apollo :

We see that by default Introspection is enabled on this engine , we can try and use Burp to send the introspection request :

I already have the GraphQL extension .

Once we send it , we get the response containing all the details about the GraphQL endpoint :

The different relationships between different queries and objects .

We can use Voyager and paste the introspection response there and it will generate the graph for us :

From there we should get our graph to be able to visualize everything :

We already saw the Products , and Users but the SystemConfig Query wasn’t mentionned anywhere .

We can attempt to get the System Config , to be able to query it , we already have the fields we want to select id/key/value from the graph :

To make a query is pretty simple using the GraphQL extension , we just type the query field we want to call and the fields we want back :

{ systemConfigs { id key value } }

And we should find our flag :

That was all for this challenge, see you in the next one :)