بِسْمِ اللَّـهِ الرَّحْمَـٰنِ الرَّحِيمِ
Challenge Overview
Mall Albostan is a multi-stage web security challenge authored by Mohamed Aly (@00xcanelo) for EYCC CTF 2026.
The challenge requires chaining multiple vulnerabilities to gain full remote code execution on the backend server.
Video Walkthrough
Exploitation Path
- SQL Injection: Extract the secret key used for signing administrative JSON Web Tokens (JWT).
- JWT Forgery: Generate an authenticated admin token using the retrieved signing key to access privileged endpoints.
- File Upload Filter Bypass: Circumvent server-side MIME type and extension restrictions to upload a malicious payload.
- XXE Injection to Remote Code Execution (RCE): Exploit an unsafe XML parser parsing uploaded data to trigger an External Entity expansion leading to code execution.
