GraphQL API Security Assessment - CTF
Assess the security of a GraphQL-based fitness application API. Perform reconnaissance to discover the target, exploit introspection to map the attack surface, crack JWT tokens, and abuse broken access controls to escalate privileges. Conclude by leveraging SSRF to access internal services.
By CyberTask · Easy level · 4.0 (1 rating)
18
Tasks
6
Sections
190
Points
1 hr
Duration
What You'll Learn
- Discover and identify GraphQL API endpoints
- Extract schema information using introspection queries
- Crack JWT signing secrets and forge tokens
- Exploit broken object-level authorization vulnerabilities
- Escalate privileges through token manipulation
- Leverage SSRF to access internal services
Prerequisites
- Basic HTTP request and response concepts
- JSON data format fundamentals
- Linux command line navigation skills
- Understanding of API authentication mechanisms
- Basic networking and port scanning knowledge
Tools & Technologies
Nmap
curl
jq
Hashcat
jwt_tool
base64
Ready to Begin?
Sign in or create an account to start this lab and earn points.