PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

GraphQL Week on The Hacker101 Capture the Flag Challenges

hackerone.com | blog | #ctf | #api-security | #graphql | #training | #hackerone | #hacker101
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

HackerOne released three GraphQL-based Hacker101 CTF challenges built around a bug tracker called BugDB, teaching queries, mutations and file handling to help hunters find real GraphQL security mistakes.
Published
Collected

Related coverage

blog · wiz.io
The Red Agent POV: Exploiting Broken Object-Level Authorization in an Airline GraphQL API
Part 2 of the Red Agent POV series: an autonomous BOLA exploit against an airline's GraphQL booking API used sequential IDs to read two years of passenger records and even modify live bookings.
research · slcyber.io
Exploiting GraphQL
A guide to exploiting GraphQL APIs: finding endpoints, introspection enumeration and bypass, batching attacks, CSRF, and authorization vulnerabilities.
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Critical PHP Vulnerabilities: What Security Teams Need to Know
Learn about the critical PHP vulnerabilities, HackerOne’s response, and the rise in reports. Review patching guidance and coordinated disclosure practices.
blog · hackerone.com
Project Glasswing: What We Learned Running a Frontier Model on Our Own Codebase
HackerOne ran Anthropic's Mythos 5 model against its own production code; it surfaced a critical RCE spanning three safe-in-isolation commits, illustrating compositional risk that diff review misses.
blog · hackerone.com
CTEM for Enterprise: Scaling Continuous Exposure Management Across Complex Environments
This coverage gives security teams current context for monitoring, validation, and remediation.
Back