webmedium

Hydroadmin

hackthebox

Task: Fix a GraphQL batching vulnerability that allows PIN brute-force bypass of rate limiting. Solution: Use the online code editor API to read index.js, change allowBatchedHttpRequests from true to false in Apollo Server config, save the patched file, restart the server, and verify the fix to receive the flag.

$ ls tags/ techniques/
graphqlapi_exploitationbatching_attackrate_limit_bypasscode_editorpatch_challenge
graphql_batchingpin_bruteforcefile_manipulationserver_restart
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Create a free account with GitHub, then upgrade to Pro.

$ssh [email protected]