All rooms Sign in
WEBLesson + challenge Live machineFree

GraphQL Labyrinth

A SecOps GraphQL API that maps itself for you — then trusts the wrong resolver.

A SecOps GraphQL API that maps itself for you — then trusts the wrong resolver.

Difficulty
Medium
Estimated time
30 min
Points
220 pts
Completions
Be the first to complete it
Authors
By Cyber Academy 4 U
Create a free account to startSign in

What you will learn

  • GraphQL schema discovery via introspection.
  • Bypassing a per-request rate limit with **aliasing / batching** to brute a short step-up code in one request.
  • Exploiting a broken object-level authorization flaw in a **nested resolver** (OWASP API1 / API5).
  • Chaining an auth bypass into unauthorized data access.

What is inside

  1. Task 1 · GraphQL Labyrinth1 question

Sign in to read the tasks, start the machine and answer the questions.