A Flask and MongoDB application with a GraphQL API that lists users but hides the admin user.
Not startedDockercommit bcd128bx86_64 · aarch64Secret
Exploit the noSQL injection weakness of a Flask and MongoDB application with a GraphQL API that lists users but hides the admin user and recover the flag (FLAG{...}) it guards.
The brief for this lab lives in its repository.