This was considered a hard challenge. After finding and analysing the source code we found a GQL injection. Unfortuantely there is a system in place that will ban you for too many requests. So we use a modified binary search algorithm to finish in time. gql.py: https://gist.github.com/LiveOverflow/16f0e4ff0ca9b0b993c25e14759de731 =[ ❤️ Support ]= → per Video: https://www.patreon.com/join/liveoverflow → per Month: null =[ 🐕 Social ]= → Twitter: https://twitter.com/LiveOverflow/ → Website: https://liveoverflow.com/ → Subreddit: https://www.reddit.com/r/LiveOverflow/ → Facebook: https://www.facebook.com/LiveOverflow/ #WebSecurity #CTF