A

app/api/onevone.py

@@ -238,6 +238,29 @@ def _check_red_answer(challenge_row: dict, payload: str) -> bool:
     return False
 
 
+async def _ai_check_red_answer(challenge_row: dict, payload: str) -> bool:
+    """Red Team (web-exploitation): AI-based evaluation via Mistral.
+
+    Falls back to deterministic flag match when Mistral is unavailable.
+    The evaluator returns True when Mistral judges the payload as a
+    successful exploit, OR when the flag matches exactly.
+    """
+    # Quick deterministic check first
+    if _check_red_answer(challenge_row, payload):
+        return True
+    # Try AI evaluation
+    from app.services.evaluator import _grade_web_exploit_with_mistral
+    result = await _grade_web_exploit_with_mistral(
+        payload=payload,
+        vuln_type=challenge_row.get("vulnerability_type", ""),
+        vuln_description=challenge_row.get("vulnerability_description", ""),
+        http_request=challenge_row.get("http_request", ""),
+        http_response=challenge_row.get("http_response", ""),
+        expected_flag=challenge_row.get("flag_preview", ""),
+    )
+    return result.get("secured", False)
+
+
 async def _ai_check_blue_answer(challenge_row: dict, challenge_type: str, payload: dict) -> bool:
     """Blue Team: delegate to the existing AI evaluators (code-fix, log-analysis, vuln-hunter).
 
@@ -621,9 +644,12 @@ async def submit_answer(match_id: str, req: SubmitRequest, user: dict = Depends(
     if not is_blue_clientverdict:
         challenge_row = await _load_challenge_row(match["challenge_id"], match["challenge_type"])
 
-    if match["challenge_type"] in ("crypto", "steganography", "web-exploitation"):
+    if match["challenge_type"] in ("crypto", "steganography"):
         # Red team: deterministic flag match. Server is the source of truth.
         correct = _check_red_answer(challenge_row, str(req.submission or ""))
+    elif match["challenge_type"] == "web-exploitation":
+        # Web exploitation: flag match + AI fallback
+        correct = await _ai_check_red_answer(challenge_row, str(req.submission or ""))
     elif match["challenge_type"] in ("code-fixing", "log-analysis", "vulnerability-hunter"):
         # Blue team: the local TrainingSession evaluation is the source of
         # truth. The AI verifier is non-deterministic and re-evaluating on

app/services/evaluator.py

@@ -612,13 +612,83 @@ async def evaluate_vuln_hunter(req, background_tasks: BackgroundTasks) -> dict:
 
 
 # --------------------------------------------------------------------------- #
-#  Web Exploitation — flag-based match (Red Team)                             #
+#  Web Exploitation — flag + AI evaluation (Red Team)                        #
 # --------------------------------------------------------------------------- #
 
+async def _grade_web_exploit_with_mistral(
+    payload: str,
+    vuln_type: str,
+    vuln_description: str,
+    http_request: str,
+    http_response: str,
+    expected_flag: str,
+) -> dict:
+    """Ask Mistral to evaluate whether the submitted payload successfully
+    exploits the web vulnerability described in the challenge.
+
+    Returns ``{"secured": True|False, "feedback": "..."}``. On any Mistral
+    error, returns a hard fail so the student can retry.
+    """
+    if not MISTRAL_API_KEY:
+        return {"secured": False, "feedback": "Mistral غير مهيأ للتقييم"}
+
+    system_prompt = (
+        "أنت خبير أمن تطبيقات ويب مهمتك تقييم إجابة الطالب في تحدي استغلال ثغرات ويب. "
+        "الطالب يرسل حمولة (payload) تستهدف ثغرة معينة. مهمتك تحديد ما إذا كانت الحمولة "
+        "تستغل الثغرة بنجاح أم لا.\n\n"
+        "معايير التقييم:\n"
+        "- إذا كانت الحمولة تستغل الثغرة بشكل صحيح وتؤدي إلى نجاح الهجوم، فالإجابة صحيحة.\n"
+        "- إذا كانت الحمولة غير صحيحة أو لا تستغل الثغرة، فالإجابة خاطئة.\n"
+        "- الحمولة قد تكون مختلفه عن العلم المتوقع ولكنها ما زالت صحيحة إذا كانت تستغل الثغرة.\n\n"
+        "أرجع JSON فقط:\n"
+        '{"secured": true|false, "feedback": "..."}'
+    )
+
+    user_prompt = (
+        f"نوع الثغرة: {vuln_type}\n"
+        f"وصف الثغرة: {vuln_description}\n"
+        f"الطلب الأصلي (HTTP Request):\n{http_request}\n\n"
+        f"الاستجابة الأصلية (HTTP Response):\n{http_response}\n\n"
+        f"العلم المتوقع: {expected_flag}\n"
+        f"---\n"
+        f"حمولة الطالب: {payload}\n\n"
+        "هل هذه الحمولة تستغل الثغرة بنجاح؟ قيمها."
+    )
+
+    try:
+        async with httpx.AsyncClient(timeout=25) as client:
+            r = await client.post(
+                MISTRAL_API_URL,
+                json={
+                    "model": MISTRAL_MODEL,
+                    "messages": [
+                        {"role": "system", "content": system_prompt},
+                        {"role": "user", "content": user_prompt},
+                    ],
+                    "temperature": 0.0,
+                    "max_tokens": 400,
+                    "response_format": {"type": "json_object"},
+                },
+                headers={
+                    "Content-Type": "application/json",
+                    "Authorization": f"Bearer {MISTRAL_API_KEY}",
+                },
+            )
+        if r.status_code != 200:
+            return {"secured": False, "feedback": f"Mistral HTTP {r.status_code}"}
+        content = r.json().get("choices", [{}])[0].get("message", {}).get("content", "")
+        data = parse_json_safe(content) or {}
+        secured = bool(data.get("secured", False))
+        feedback = str(data.get("feedback", "")).strip() or "تم التقييم بواسطة Mistral"
+        return {"secured": secured, "feedback": feedback}
+    except Exception as e:
+        return {"secured": False, "feedback": f"خطأ في التقييم: {e}"}
+
+
 async def ai_evaluate_web_exploit(
     challenge_id: str, payload: str, team_role: str = "red"
 ) -> dict:
-    """Evaluate a web exploitation payload submission."""
+    """Evaluate a web exploitation payload submission — flag match first, then AI."""
     row = await fetch_scenario_by_id(
         team_role, challenge_id, challenge_type="web-exploitation"
     )
@@ -652,10 +722,16 @@ async def ai_evaluate_web_exploit(
             "secured": True,
             "feedback": "إجابة صحيحة! تم استغلال الثغرة بنجاح.",
         }
-    return {
-        "secured": False,
-        "feedback": "الإجابة غير صحيحة. تأكد من أنك استخدمت العلم الصحيح أو الحمولة المناسبة للثغرة.",
-    }
+
+    # Flag didn't match — fall back to AI semantic evaluation
+    return await _grade_web_exploit_with_mistral(
+        payload=payload,
+        vuln_type=row.get("vulnerability_type", ""),
+        vuln_description=row.get("vulnerability_description", ""),
+        http_request=row.get("http_request", ""),
+        http_response=row.get("http_response", ""),
+        expected_flag=expected,
+    )
 
 
 async def evaluate_web_exploit(req, background_tasks: BackgroundTasks) -> dict: