Challenge

A GraphQL endpoint that refuses an empty request.

{"errors":[{"message":"Must provide query string."}]}

Approach

Introspection was disabled, so the schema would not come back through the usual __schema query. Mutations were accepted, but nothing pointed at the field names directly. With the schema hidden, the way forward is guessing field names, so I ran a wordlist of likely query fields against the endpoint and watched for one that resolved instead of erroring.

secretQuery was the hit.

Solution

GET /graphql?query={ secretQuery }

1

{"data":{"secretQuery":"RS{PROB3_WA$_$UCC3$$FUL}"}}

Flag

RS{PROB3_WA$_$UCC3$$FUL}