Add GraphQL Galaxy lab with Docker configuration and application code

- Introduced a new service `graphql-galaxy` in `docker-compose.yml` with specific network settings and port mapping.
- Added application code for a GraphQL API in `additional-labs/GraphQL/app.py`, demonstrating vulnerabilities such as GraphQL Introspection and IDOR.
- Created a Dockerfile for the GraphQL lab to facilitate containerization.
- Updated `README.md` in the GraphQL lab directory to outline the lab's objectives, installation instructions, and challenges.
- Revised main `README.md` to include the new lab's details, including its IP address and port.

Author: santosomar

README.md

@@ -72,14 +72,15 @@ Custom-built labs focusing on specific vulnerability categories. These labs are
 | **hydra-nexus** | 10.6.6.30 | 5010 | Multi-Vulnerability Gauntlet (SQLi, XSS, IDOR, XXE, etc.) |
 | **phantom-script** | 10.6.6.31 | 5011 | Cross-Site Scripting (Reflected, Stored, DOM) |
 | **trojan-relay** | 10.6.6.32 | 5012 | Server-Side Request Forgery (SSRF) |
-| **sqli-breach** | 10.6.6.33 | 5000 | SQL Injection |
+| **sqli-breach** | 10.6.6.33 | 5001 | SQL Injection |
 | **shell-inject** | 10.6.6.34 | 5002 | OS Command Injection |
 | **maze-walker** | 10.6.6.35 | 5003 | Path/Directory Traversal |
 | **entity-smuggler** | 10.6.6.36 | 5013 | XML External Entity (XXE) Injection |
 | **token-tower** | 10.6.6.40 | 5020 | JWT Vulnerability |
 | **render-reign** | 10.6.6.41 | 5021 | Server-Side Template Injection |
 | **deserial-gate** | 10.6.6.42 | 5022 | Insecure Deserialization |
 | **redis-rogue** | 10.6.6.43 | - | DEF CON 31 Challenge |
+| **graphql-galaxy** | 10.6.6.44 | 5023 | GraphQL Introspection, IDOR |
 
 ---
 
@@ -133,7 +134,8 @@ docker compose build --no-cache [container_name]
 │  ├── token-tower       10.6.6.40                            │
 │  ├── render-reign      10.6.6.41                            │
 │  ├── deserial-gate     10.6.6.42                            │
-│  └── redis-rogue       10.6.6.43                            │
+│  ├── redis-rogue       10.6.6.43                            │
+│  └── graphql-galaxy    10.6.6.44                            │
 └─────────────────────────────────────────────────────────────┘
 ```
 

additional-labs/GraphQL/Dockerfile

@@ -0,0 +1,13 @@
+FROM python:3.9-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+EXPOSE 5023
+
+CMD ["python", "app.py"]
+

additional-labs/GraphQL/README.md

@@ -0,0 +1,28 @@
+# GraphQL Galaxy: API Hacking Lab
+
+**Lab Name:** `graphql-galaxy`
+**Vulnerability:** GraphQL Introspection, Information Disclosure, IDOR
+
+## Description
+This lab simulates a futuristic communications hub that exposes a GraphQL API. The API is misconfigured to allow full schema introspection, revealing sensitive fields and internal types. Additionally, the resolvers lack proper authorization checks, allowing users to access data they shouldn't (IDOR).
+
+## Learning Objectives
+- Understand GraphQL Introspection and how to use it for reconnaissance.
+- Identify sensitive fields in a GraphQL schema.
+- Exploit IDOR vulnerabilities in GraphQL resolvers.
+- Learn how to use GraphiQL to interact with the API.
+
+## Installation
+This lab is part of the WebSploit Labs framework.
+To run it individually:
+```bash
+docker build -t graphql-galaxy .
+docker run -p 5023:5023 graphql-galaxy
+```
+
+## Challenge
+1.  **Reconnaissance:** Use the GraphiQL interface to inspect the available queries and types.
+2.  **Introspection:** Find the hidden `api_token` field in the `User` type.
+3.  **Exploitation:** Query the `user` field with the ID of the administrator (`1`) and request the `api_token`.
+4.  **Flag:** The flag is the value of the administrator's `api_token`.
+

additional-labs/GraphQL/app.py

@@ -0,0 +1,142 @@
+#!/usr/bin/env python3
+import graphene
+from flask import Flask
+from flask_graphql import GraphQLView
+
+# --- Mock Database ---
+users_db = [
+    {
+        "id": "1", 
+        "username": "admin", 
+        "email": "admin@galactic.gov", 
+        "api_token": "FLAG{GRAPHQL_INTROSPECTION_MASTER}", 
+        "is_admin": True,
+        "notes": "System Administrator with full access."
+    },
+    {
+        "id": "2", 
+        "username": "skywalker", 
+        "email": "luke@rebel.alliance", 
+        "api_token": "force-user-001", 
+        "is_admin": False,
+        "notes": "Pilot. Keep an eye on him."
+    },
+    {
+        "id": "3", 
+        "username": "vader", 
+        "email": "darth@empire.gov", 
+        "api_token": "dark-side-999", 
+        "is_admin": False,
+        "notes": "Lord Vader."
+    }
+]
+
+# --- GraphQL Schema ---
+
+class User(graphene.ObjectType):
+    id = graphene.ID()
+    username = graphene.String()
+    email = graphene.String()
+    api_token = graphene.String(description="The API Token for the user. Restricted access.")
+    is_admin = graphene.Boolean()
+    notes = graphene.String()
+
+class SystemInfo(graphene.ObjectType):
+    version = graphene.String()
+    status = graphene.String()
+    debug_mode = graphene.Boolean()
+
+class Query(graphene.ObjectType):
+    user = graphene.Field(User, id=graphene.ID(required=True), description="Get a user by ID")
+    users = graphene.List(User, description="List all users")
+    system_status = graphene.Field(SystemInfo, description="Check the system status")
+    
+    def resolve_user(self, info, id):
+        # Insecure Direct Object Reference (IDOR) equivalent in GraphQL
+        # No auth check here!
+        for user in users_db:
+            if user["id"] == id:
+                return User(
+                    id=user["id"],
+                    username=user["username"],
+                    email=user["email"],
+                    api_token=user["api_token"],
+                    is_admin=user["is_admin"],
+                    notes=user["notes"]
+                )
+        return None
+
+    def resolve_users(self, info):
+        # Returns all users but filters sensitive info in this view (mocking a "public" list)
+        # But if they query 'user(id: "1")' directly, they get everything!
+        safe_users = []
+        for user in users_db:
+            safe_users.append(User(
+                id=user["id"],
+                username=user["username"],
+                email=user["email"],
+                api_token="[REDACTED]", # Redacted in the list view
+                is_admin=user["is_admin"],
+                notes=user["notes"]
+            ))
+        return safe_users
+
+    def resolve_system_status(self, info):
+        return SystemInfo(version="2.0.1-alpha", status="Operational", debug_mode=True)
+
+class CreateUser(graphene.Mutation):
+    class Arguments:
+        username = graphene.String(required=True)
+        email = graphene.String(required=True)
+
+    user = graphene.Field(lambda: User)
+
+    def mutate(self, info, username, email):
+        user = User(username=username, email=email, id=str(len(users_db) + 1))
+        return CreateUser(user=user)
+
+class Mutation(graphene.ObjectType):
+    create_user = CreateUser.Field()
+
+schema = graphene.Schema(query=Query, mutation=Mutation)
+
+# --- Flask App ---
+app = Flask(__name__)
+app.debug = True
+
+# Add the GraphQL endpoint
+app.add_url_rule(
+    '/graphql',
+    view_func=GraphQLView.as_view(
+        'graphql',
+        schema=schema,
+        graphiql=True  # Enable the GraphiQL interface
+    )
+)
+
+@app.route('/')
+def index():
+    return """
+    <html>
+        <head>
+            <title>Galactic Communications Hub</title>
+            <style>
+                body { font-family: sans-serif; background: #0f172a; color: white; text-align: center; padding: 50px; }
+                h1 { color: #3b82f6; }
+                a { color: #60a5fa; text-decoration: none; font-size: 1.2em; }
+                a:hover { text-decoration: underline; }
+            </style>
+        </head>
+        <body>
+            <h1>Galactic Communications Hub</h1>
+            <p>Welcome to the secure internal API.</p>
+            <p>Access the GraphiQL Interface below:</p>
+            <br>
+            <a href="/graphql">>> Enter GraphiQL Console <<</a>
+        </body>
+    </html>
+    """
+
+if __name__ == '__main__':
+    app.run(host='0.0.0.0', port=5023)
+

additional-labs/GraphQL/requirements.txt

@@ -0,0 +1,5 @@
+flask==2.3.3
+graphene==3.3.0
+flask-graphql==2.0.1
+werkzeug==2.3.7
+

additional-labs/Prototype_Pollution/Dockerfile

@@ -0,0 +1,14 @@
+FROM node:14-alpine
+
+WORKDIR /usr/src/app
+
+COPY package*.json ./
+
+RUN npm install
+
+COPY . .
+
+EXPOSE 3000
+
+CMD [ "node", "server.js" ]
+

additional-labs/Prototype_Pollution/package.json

@@ -0,0 +1,14 @@
+{
+  "name": "prototype-pollution-lab",
+  "version": "1.0.0",
+  "description": "Lab for Prototype Pollution and DOM Clobbering",
+  "main": "server.js",
+  "scripts": {
+    "start": "node server.js"
+  },
+  "dependencies": {
+    "express": "^4.17.1",
+    "body-parser": "^1.19.0"
+  }
+}
+

additional-labs/Prototype_Pollution/public/index.html

@@ -0,0 +1,126 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Client-Side Logic Lab</title>
+    <style>
+        body { font-family: Arial, sans-serif; max-width: 800px; margin: 0 auto; padding: 20px; }
+        .lab-section { border: 1px solid #ccc; padding: 20px; margin-bottom: 20px; border-radius: 5px; }
+        h2 { color: #d32f2f; }
+        pre { background: #f4f4f4; padding: 10px; border-radius: 5px; }
+        button { background: #007bff; color: white; border: none; padding: 10px 20px; cursor: pointer; }
+        button:hover { background: #0056b3; }
+        input { padding: 10px; width: 300px; }
+        .result { margin-top: 10px; font-weight: bold; }
+    </style>
+</head>
+<body>
+    <h1>Client-Side Logic & Prototype Pollution</h1>
+
+    <!-- Lab 1: DOM Clobbering -->
+    <div class="lab-section">
+        <h2>Lab 1: DOM Clobbering</h2>
+        <p>Goal: Inject HTML to clobber the global <code>config</code> variable and force the application to load a malicious script (or simulate it).</p>
+        <p>The application runs this logic:</p>
+        <pre>
+window.onload = function() {
+    let scriptUrl = window.config?.scriptUrl || 'default.js';
+    document.getElementById('current-script').innerText = "Loading script: " + scriptUrl;
+};
+        </pre>
+        
+        <!-- Vulnerable Output Sink -->
+        <div id="user-content">
+            <!-- This simulates user-controlled content being rendered without proper sanitization -->
+            <!-- In a real scenario, this would be an XSS sink or content injection point -->
+            <!-- For this lab, enter HTML below to see it rendered here -->
+        </div>
+
+        <h3>Inject HTML:</h3>
+        <textarea id="html-input" rows="4" cols="50" placeholder="Enter HTML here (e.g. <a id=config>...</a>)"></textarea><br>
+        <button onclick="renderUserHtml()">Inject & Reload</button>
+        
+        <p>Current Status: <span id="current-script">Waiting...</span></p>
+    </div>
+
+    <!-- Lab 2: Prototype Pollution -->
+    <div class="lab-section">
+        <h2>Lab 2: Server-Side Prototype Pollution</h2>
+        <p>Goal: Pollute the server-side Object prototype to gain Admin access.</p>
+        <p>Send a JSON payload to merge settings. If successful, <code>isAdmin</code> will become true for all objects.</p>
+        
+        <h3>Update Settings:</h3>
+        <textarea id="json-input" rows="4" cols="50">{"theme": "dark"}</textarea><br>
+        <button onclick="sendUpdate()">Send Update</button>
+        
+        <div id="server-response" class="result"></div>
+        <br>
+        <button onclick="checkAdmin()">Check Admin Access</button>
+        <div id="admin-status" class="result"></div>
+    </div>
+
+    <script>
+        // Vulnerable DOM Clobbering Logic
+        function renderUserHtml() {
+            const input = document.getElementById('html-input').value;
+            // DANGEROUS: Directly setting innerHTML (simulating an XSS/injection sink)
+            document.getElementById('user-content').innerHTML = input;
+            
+            // Re-run the vulnerable logic to see if 'config' was clobbered
+            setTimeout(() => {
+                let scriptUrl = 'default.js';
+                
+                // Vulnerable check
+                if (window.config && window.config.scriptUrl) {
+                    scriptUrl = window.config.scriptUrl;
+                    
+                    // Note: In real DOM clobbering with <a> tags, toString() gives the href.
+                    // We simulate this behavior check.
+                    if (typeof scriptUrl === 'object') { // It might be an element collection if clobbered
+                         scriptUrl = scriptUrl.toString();
+                    }
+                }
+                
+                document.getElementById('current-script').innerText = "Loading script: " + scriptUrl;
+                
+                if (scriptUrl.includes('malicious')) {
+                    alert("DOM Clobbering Successful! Malicious script path detected.");
+                }
+            }, 100);
+        }
+
+        // Prototype Pollution Logic
+        async function sendUpdate() {
+            const input = document.getElementById('json-input').value;
+            try {
+                const json = JSON.parse(input);
+                const response = await fetch('/api/update-settings', {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify(json)
+                });
+                const result = await response.json();
+                document.getElementById('server-response').innerText = JSON.stringify(result, null, 2);
+            } catch (e) {
+                document.getElementById('server-response').innerText = "Error: " + e.message;
+            }
+        }
+
+        async function checkAdmin() {
+            try {
+                const response = await fetch('/api/admin-check');
+                const result = await response.json();
+                document.getElementById('admin-status').innerText = result.message;
+                if(result.flag) {
+                    document.getElementById('admin-status').innerText += "\n" + result.flag;
+                    document.getElementById('admin-status').style.color = "green";
+                }
+            } catch (e) {
+                document.getElementById('admin-status').innerText = "Error: " + e.message;
+            }
+        }
+    </script>
+</body>
+</html>
+