webProeasy
Lab 251 — PulseBoard — IDOR via Unauthenticated GraphQL User Profile Query
hackadvisor
Task: PulseBoard GraphQL API exposes getUserProfile(userId) query without authentication. Solution: enumerate schema via introspection, query admin user (ID 1) to extract flag from internalNotes field.
$ ls tags/ techniques/
idor_exploitationgraphql_introspectionuser_enumerationsensitive_field_extraction
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 259 — TalentBridge — IDOR in Employee Profile Endpoints— hackadvisor
- [web][Pro]Lab 15 — ProfileHub — IDOR in User Profile API— hackadvisor
- [web][Pro]Lab 116 — InsightForge — IDOR via Undocumented Internal API— hackadvisor
- [web][Pro]Lab 198 — PayrollSync — Broken Auth via GraphQL Introspection— hackadvisor
- [web][Pro]Lab 112 — MetricFlow — IDOR in Usage Analytics API— hackadvisor