بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ
Challenge Overview
2hwa fat7 m7aweeg is a Flask and Docker web challenge authored by Mohamed Aly (@00xcanelo) for EYCC CTF 2026.
The application is a URL viewer: it accepts a link, fetches it from the server, and returns the result. Because the full source is provided, the challenge is less about guessing and more about reading the Flask app carefully, understanding how the submitted URL reaches the request layer, and finding where the sanitization stops being effective.
Video Walkthrough
Exploitation Path
- Review the Flask app and Docker setup — Map the routes, identify the URL-fetching endpoint, and note how the container is networked. The Docker context matters because the target you need to reach may not be exposed publicly.
- Trace the URL Viewer request flow — Follow the submitted URL from the frontend JavaScript to
app.py. Confirm whether validation happens in the browser, on the server, or both. - Find the sanitization blind spot — The filter checks the URL string, but the final request is made after the URL is parsed. A crafted URL can therefore resolve to a destination the filter did not intend to allow.
- Bypass the filter and retrieve the flag — Use the gap to make the server request the internal target, then read the flag from the response.
Key Takeaway
Validating a URL as a string is not the same as validating where the request will actually go. Resolve and enforce the destination at the point of the request, not just at the edge of the input.
