webProeasy
Lab 290 — PayLedger — GraphQL Broken Access Control
hackadvisor
Task: Payment platform with GraphQL API and role-based access (admin/finance/viewer), given finance credentials. Solution: Used GraphQL introspection to discover admin-only queries, then exploited missing resolver-level authorization to access adminConfig containing the flag.
$ ls tags/ techniques/
broken_access_controlgraphql_introspectionauthorization_bypassschema_enumeration
🔒
Permission denied (requires tier.pro)
Sign in to access full writeups
Sign in with GitHub to continue. No email required.
$sign in$ grep --similar
Similar writeups
- [web][Pro]Lab 198 — PayrollSync — Broken Auth via GraphQL Introspection— hackadvisor
- [web][Pro]Lab 298 — PayLedger — SQL Injection via GraphQL Date Filters— hackadvisor
- [web][Pro]Lab 294 — TeamForge — GraphQL Self-Escalation via UpdateMembership— hackadvisor
- [web][Pro]Lab 303 — DevGateway — Broken Access Control in Admin API— hackadvisor
- [web][Pro]Lab 31 — PayStream — IDOR in GraphQL Billing API— hackadvisor