TLDR

`input=asd;ls` reveals the contents of the directory the web app was running on, encoded in base64. `input=asd;cat flag` reveals the contents in the 'flag' file, but says "haha, you're not done yet". `input=asd;cat Dockerfile` reveals a docker image.


pull and run the image to get the flag