[hackstreetboys] InCTF 2018 — The Most Secure File Uploader web challenge
Aj Dumanhug

but in challenge when i name the file as you described it show something else … my challenge ip :-

after changing file name it says

File is an image — image/jpeg

Filename: $(cat flag).png

I think its called blacklisting…!

so think python commands are being blacklisted… now how to get flag!?!? any idea ?