Lab: Accessing private GraphQL posts

In Burp's browser, access the blog page.

In Burp, go to Proxy > HTTP history and notice the following:

• Blog posts are retrieved using a GraphQL query.
• In the response to the GraphQL query, each blog post has its own sequential id.
• Blog post id 3 is missing from the list. This indicates that there is a hidden blog post.

Use InQL to scan the GraphQL endpoint. Notice that the BlogPost type has a postPassword field available.

In Burp's browser, select a blog post. Notice that this causes the site to make a GraphQL query that fetches the relevant post data via a direct reference to the post's ID.

In the HTTP history, find the relevant GraphQL query. Right-click it and select Send to Repeater.

In Repeater, modify the id variable to 3 (that is, the id of the hidden blog post). Add the postPassword field to the query.

Send the request.

Copy the contents of the response's postPassword field and paste them into the Submit solution dialog to solve the lab.