Please, do not write just a link to original writeup here.

Original writeup (https://tcode2k16.github.io/blog/posts/picoctf-2018-writeup/web-exploitation/#client-side-is-still-bad).