Note : Incomplete write-up.
http://rawsec.ml/en/WhiteHat-GrandPrix-2016-web-100-banh-can/

Original writeup (http://rawsec.ml/en/WhiteHat-GrandPrix-2016-web-100-banh-can/).