Overgrowth

The brief

Overgrowth is a gardening-supply API. The team swears it's locked down for production. The flag is just a field, one that only the head gardener is allowed to pick.

In short

Overgrowth hides its GraphQL schema, but its validation errors name an unauthenticated password reset with a four digit code and no attempt limit. Aliased resetPassword calls tried all 10,000 codes in about 3.5 seconds and took over the admin account that reads the flag.

A GraphQL API with the map switched off

Overgrowth is a garden supply shop on a GraphQL API with introspection disabled. The flag is a field on the root query, and it answers only a logged in admin.

The schema, rebuilt from error messages

The lab let the validator draw the map. A guess like forgotPassword came back with a suggestion, resetPassword, and the missing argument errors spelled out its shape, username, token and newPassword.

A four digit code with no limit

requestPasswordReset needs no login and sets a four digit code for any account, admin included. resetPassword takes that code and a new password and never counts wrong guesses. That leaves 10,000 codes.

Thousands of guesses per request

GraphQL lets one document call the same mutation many times under different aliases. The lab packed thousands of resetPassword calls into each request and covered all 10,000 codes in about 3.5 seconds.

The head gardener's field

Code 7243 matched. The lab logged in as admin with its new password and sent the session token as a Bearer header. The flag field answered, 28 minutes after the start.

The insight

GraphQL aliases let one request carry thousands of guesses, so a four digit reset code with no attempt limit falls in seconds.

The flag

hiCTF{graphql_al1as_batch1ng_brute_f0rces_the_0tp_a09b4abe22}