Hintru ENES ← All labs

Breach - WebVerse (GraphQL)

EN easy CTF challenge GraphQLIntrospectionBroken Access ControlInformation DisclosureAPI Security

The Breach challenge on WebVerse Labs exposes a GraphQL API backing a notes application. The notes are visible in the UI, but a GraphQL schema often has surfaces the front-end never touches. Map what's really there, and find a way to reach the flag.

0/4
solved
👁 Step 1 Step 2 Step 3 Step 4
loot

Step 4 · Pass an Argument to Reach the Restricted Field

Objective: Pass `debug:true` as an argument to the `flag` field and retrieve the flag value along with its other fields.

Context: Querying `flag { value }` without arguments results in an error. Introspection revealed that the `flag` field accepts a `debug` boolean argument — similar to how `notes` accepts `includePrivate`. The naming strongly implies that setting `debug: true` may unlock access to the flag value.

Progressive hints

Only reveal the ones you need. Claude tracks how many you used to calibrate the feedback.

Hint 1 — directional nudge

You already know that GraphQL fields can take arguments in parentheses. Think about what argument the `flag` field accepts and what value might unlock it.

Hint 2 — technique / vuln class

The `flag` field accepts a `debug` boolean argument, just like `notes` accepts `includePrivate`. Try passing `debug:true` to the flag query the same way `includePrivate:false` was passed to notes.

Hint 3 — near solution

Send this query:
```json
{"query":"{ flag(debug:true) { id value accessLevel } }"}
```
This should bypass the access restriction and return the flag.

Your attempt