A friendly demo of server-side template injection.
This is the platform's reference instance-backed challenge — solving it is mostly about understanding the spawn / connect / exfiltrate / submit loop. The vuln itself is intentionally obvious.
- Spawn an instance from this page.
- Visit the URL.
- The site echoes a search query through a Jinja2 template without escaping.
- Coerce the template engine into evaluating
{{ flag }}(or read it out of the environment) and submit what you get.
Flag format: flag{...} (per-user, derived from your account).