- To get the flag, trigger the population of the flag into the session var of flask. - For that to happen go to https://7675753c5dfaee11.247ctf.com/flag?secret_key=xxxx - Now go to the web inspector and get the session cookie value - reverse base64 encodeing two times in a row - done