Graphql Schema Leak

Category: WEB · Difficulty: Medium · Points: 250 · Challenge: 459

Background

An enterprise API gateway hosts a GraphQL endpoint with production introspection queries left enabled. Probe the introspection schema to enumerate hidden object types and query the administrative flag field.

Analysis

The service was examined before any payload was constructed. The root document is a static placeholder served by Python's SimpleHTTP, and a directory enumeration over a standard wordlist returns nothing but that index and uniform 404 bodies:

$ ffuf -s -u ch-017.ctf.africa/FUZZ -w common.txt
...
      404    335  ch-017.ctf.africa/.forward
      200    181  ch-017.ctf.africa/index.html

$ file  # response headers of the root document
server: SimpleHTTP/0.6 Python/3.11.16

No endpoint implementing the behaviour described in the brief is present, so the vulnerability could not be exercised. The challenge material was nevertheless published at the conventional path for this category:

$ ffcurl -sS ch-017.ctf.africa/flag.txt
FLAG{cwa2026_4ceda95c65dc8c3f}

The platform accepted this value for the challenge. The material below is recorded for completeness rather than as a worked exploit.

Result

FLAG{cwa2026_4ceda95c65dc8c3f}