from flask import Flask, make_response, request
from Crypto.Util.number import *
from Crypto.Cipher import ChaCha20_Poly1305
import secrets
import requests
import hashlib
CHACHA_KEY = secrets.token_bytes(32)
app = Flask(__name__)

encrypted_text = []
def sha256(msg):
    return hashlib.sha256(msg).digest()

def encrypt_msg(msg, nonce):
    nonce = sha256(msg[:32] + nonce[:32])[:12]
    cipher = ChaCha20_Poly1305.new(key=CHACHA_KEY, nonce=nonce)
    ct, tag = cipher.encrypt_and_digest(msg)
    return ct+tag+nonce

def decrypt_msg(msg):
    ct = msg[:-28]
    tag = msg[-28:-12]
    nonce = msg[-12:]
    cipher = ChaCha20_Poly1305.new(key=CHACHA_KEY, nonce=nonce)
    pt = cipher.decrypt_and_verify(ct, tag)
    return pt

def curl(url):
    try:
        url = "http://" + url
        resource = open("resource.txt","r").read().strip()
        requests.post(url,data = resource,timeout=1)
        return "Succes"
    except:
        return None

@app.route('/api',methods=['POST'])
def api():
    try:
        pkt = request.headers.get('pkt')
        ctk = encrypt_msg(bytes.fromhex(pkt),b"random_text_Lorem_ipsum_sim_ahmet_next_ales")
        encrypted_text.append(ctk.hex())
        return make_response(ctk.hex())
    except:
        return make_response("Error")

@app.route('/resource',methods=['POST'])
def send_flag(): 
    try:
        pkt = request.headers.get('pkt')
        ip = request.headers.get('ip')
        if pkt in encrypted_text:
            return make_response("You already try that!")
        pt = decrypt_msg(bytes.fromhex(pkt))
        if pt:
            curl(ip)
            return make_response('Succes')
    except:
        return make_response("Error")
    
if __name__ == '__main__':
    app.run(debug=False, host='0.0.0.0', port=5002)

Which type of attack should i serch and how should i approach this problem?

The encrypt_msg function generates a nonce by hashing a combination of the message and a fixed string, then truncating the result. How secure is this method in terms of nonce uniqueness and unpredictability?

I need to break into it and get the resource.txt