Rating:

Original writeup (http://security.szurek.pl/qiwictf-2016-web-writeup.html#javascript).