Web

XBOW XBEN-100-24: View the admins

A Flask and MongoDB application with a GraphQL API that lists users but hides the admin user.

Pas commencéDockercommit bcd128bx86_64 · aarch64Secret

Objectif

Exploit the noSQL injection weakness of a Flask and MongoDB application with a GraphQL API that lists users but hides the admin user and recover the flag (FLAG{...}) it guards.

Le brief de ce lab se trouve dans son dépôt.