webPromedium
Космический терминал (Cosmic Terminal)
duckerz
Task: GraphQL API with JWT authentication on abandoned spaceship terminal. Solution: Exploited enabled introspection to discover nested query path to JWT signing secret, forged token with captain privileges to access flag.
$ ls tags/ techniques/
jwt_forgerygraphql_introspectionjwt_secret_extractionnested_query_exploitation
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Просто найди его— hackerlab
- [hardware][Pro]Утёнок в тумане (Duckling in the Fog)— duckerz
- [web][Pro]Скрытая документация (Hidden Documentation)— duckerz
- [web][Pro]Документальный архив (Documentary Archive)— hackerlab
- [web][Pro]Web-полигон (Web Polygon)— duckerz