Struggling with Hacker101's GraphQL CTF and solving an XSS challenge from Bug Bounty Notes!

### Overview In this live stream recording, the speaker works through Hacker101's "BugDB v3" GraphQL CTF challenge after encountering technical issues, including 100% CPU usage and unrecorded footage of an earlier cross-site scripting (XSS) exercise. Racing against a tight time limit before having to log off and travel to AppSec DC Global, the speaker collaborates with live chat participants (notably C1, DC, Elliot, and Cody) to understand the target application's GraphQL schema, identify an arbitrary file read vulnerability, and locate the hidden flag.

### Key Topics - **Live CTF Troubleshooting**: Dealing with system resource constraints, resetting broken challenge instances, and working against strict personal time limits. - **GraphQL Reconnaissance and Schema Exploration**: Querying users, bugs, edges, nodes, and attachments to understand data models and identify query/mutation capabilities. - **File Traversal / Arbitrary File Read**: Using mutations on attachments to point to internal server file paths instead of uploading user content. - **Source Code Review via File Inclusion**: Reading local Python source files (`main.py`, `model.py`, `schema.py`) to discover backend architecture and references to internal databases.

### Technical Details - **Target Identification**: The challenge revolves around a Hacker101 BugDB v3 instance built on Python/Flask with a GraphQL API. - **Schema Enumeration**: Querying through `users` -> `bugs` -> `attachments` revealed fields including `id` and `fileName`. - **Exploiting Attachment Mutations**: The speaker utilized a `modifyAttachment` mutation. By targeting attachment ID 2 and manipulating the `fileName` parameter with directory traversal sequences (e.g., `../main.py`), the backend fetched and stored server-side files into the attachment rather than taking user-supplied input. - **Source Code Reconnaissance**: Inspecting the contents loaded into the attachment revealed source code from `main.py`, which imported local modules like `schema` and `model`. Examining `model.py` uncovered a reference to an SQLite database (`level18.db` / level 18 database). - **Extracting the Flag**: Fetching the contents of the referenced database file into the attachment and inspecting the raw text allowed the speaker to locate the flag string directly.

### Takeaways - GraphQL CTFs often require careful inspection of input arguments in mutations that may interact directly with the local filesystem. - When path traversal or file inclusion is identified in source-code driven challenges, traversing to entry point files like `main.py` and reviewing local application imports (`model.py`, `schema.py`) is an effective method for discovering critical backend assets and databases. - The XSS challenge mentioned in the title was noted as missing from the recording due to high CPU load at the start of the stream.