There is a NoSQL injection. You can see the parameter 'n' on the page.
Trying to make GET request will set the user_n key with random uuid4 value.
If you try to enter a command like `set` or `flushdb` (all commands except `get`), you'll get message "Ah, another hacker".
Just try some commands and you'll see that there is a Redis db. Another way is buying hint for 100 points which tell you that is Redis.
Redis scripting language is LUA. All redis functions are callable by redis.call.
Injection is
`http://ctf.knastu.ru/webch/admin?n=123') and redis.call('get', 'admin`

Flag is HumanCTF{n0t_a_f1ag}