tl;dr

- Create a note with meta redirect tag to get callback.
- Leak the flag using search functionality.

Original writeup (https://blog.bi0s.in/2022/04/14/Web/NarutoKeeper-SecurinetsCTFQuals2022/).