Please, do not write just a link to original writeup here.

Original writeup (http://www.abdilahrf.me/web%20exploitation/securityfest2017-freddy-vs-json).