tl;dr

• Create a note with meta redirect tag to get callback.
• Leak the flag using search functionality.

Original writeup (https://blog.bi0s.in/2022/04/14/Web/NarutoKeeper-SecurinetsCTFQuals2022/).